JA4 TLS client fingerprint

t13i2412h1_df98b6d6dfe4_1b3407e2c936

Seen 2026-02-19 to 2026-09-24 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS45102 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

232

Events

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS45102 Alibaba (US) Technology Co., Ltd.89 IPs232

Countries

SG 36JP 31HK 22

Ports targeted

18789/tcp 86 443/tcp 8 21/tcp 3 31380/tcp 3 2083/tcp 3 2087/tcp 3 2096/tcp 3 2342/tcp 3 2377/tcp 3 2718/tcp 3 3210/tcp 3 3307/tcp 3

What it requests

GET/favicon.ico232

User agents claimed

Opera/9.80 (Windows NT 6.1; U; en) Presto/2.8.131 Version/11.1125 IPs39

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Firefox/53.020 IPs27

Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.3621 IPs26

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.1622 IPs26

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0;23 IPs23

Source IPCCNetwork Last seenEvents

47.74.26.155AS0 Alibaba (US) Technology Co., Ltd.2026-09-1311

47.84.82.107AS0 Alibaba (US) Technology Co., Ltd.2026-09-177

8.209.196.52AS0 Alibaba (US) Technology Co., Ltd.2026-09-157

47.84.93.5AS0 Alibaba (US) Technology Co., Ltd.2026-09-176

47.84.91.206AS0 Alibaba (US) Technology Co., Ltd.2026-09-176

8.222.235.163AS0 Alibaba (US) Technology Co., Ltd.2026-09-176

47.84.83.137AS0 Alibaba (US) Technology Co., Ltd.2026-09-176

8.211.184.234AS0 Alibaba (US) Technology Co., Ltd.2026-09-156

47.84.93.76AS0 Alibaba (US) Technology Co., Ltd.2026-09-175

47.91.23.189AS0 Alibaba (US) Technology Co., Ltd.2026-09-085

47.84.95.163AS0 Alibaba (US) Technology Co., Ltd.2026-09-175

47.84.95.149AS0 Alibaba (US) Technology Co., Ltd.2026-09-175

8.211.176.82AS0 Alibaba (US) Technology Co., Ltd.2026-09-144

8.216.9.53AS0 Alibaba (US) Technology Co., Ltd.2026-09-094

47.84.75.197AS0 Alibaba (US) Technology Co., Ltd.2026-09-174

47.74.16.3AS0 Alibaba (US) Technology Co., Ltd.2026-09-094

47.84.81.214AS0 Alibaba (US) Technology Co., Ltd.2026-09-174

47.84.84.184AS0 Alibaba (US) Technology Co., Ltd.2026-09-174

47.245.83.229AS0 Alibaba (US) Technology Co., Ltd.2026-09-174

47.84.77.80AS0 Alibaba (US) Technology Co., Ltd.2026-09-174

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.