JA4 TLS client fingerprint

t13i250900_b78ed14e2fd0_e7c285222651

Seen 2026-02-20 to 2026-09-24 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS396982 sends an email when it next hits a sensor.

2.0K

Source IPs

Networks

Countries

428

Ports hit

15.1K

Events

246

IPs / network

Top networks

AS396982 Google LLC1.4K IPs12.6K

AS45102 Alibaba (US) Technology Co., Ltd.489 IPs2.3K

AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED59 IPs144

AS14061 DigitalOcean, LLC11 IPs68

AS137280 Kingsoft cloud corporation limited4 IPs29

AS207695 LUME Solutions1 IPs4

AS6134 XNNET LLC1 IPs2

AS142002 Scloud Pte Ltd1 IPs2

Countries

BE 1.4KSG 331US 216HK 10SC 8DE 1GB 1

Ports targeted

143/tcp 2.4K 21/tcp 2.4K 990/tcp 2.3K 23/tcp 2.2K 110/tcp 2.1K 636/tcp 191 3389/tcp 159 25/tcp 158 443/tcp 128 445/tcp 91 53/tcp 88 389/tcp 79

What it requests

GET/4.5K

GET/favicon.ico55

GET/ui/favicon.ico33

GET/ui/login/33

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.361.4K IPs2.1K

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.02 IPs4

Mozilla/5.0 (compatible; sFox/1.0)1 IPs4

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.362 IPs3

Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.01 IPs3

Source IPCCNetwork Last seenEvents

34.156.149.17AS0 Google LLC2026-09-2348

34.22.210.51AS0 Google LLC2026-09-1840

35.195.27.135AS0 Google LLC2026-09-1040

34.38.228.31AS0 Google LLC2026-09-0640

207.175.96.134AS0 Google LLC2026-09-2239

34.156.92.167AS0 Google LLC2026-09-0639

34.38.65.219AS0 Google LLC2026-09-1739

34.79.245.251AS0 Google LLC2026-09-1438

34.38.79.11AS0 Google LLC2026-09-0438

104.199.21.33AS0 Google LLC2026-09-2138

35.205.97.250AS0 Google LLC2026-09-2438

35.195.131.158AS0 Google LLC2026-09-2337

35.205.152.207AS0 Google LLC2026-09-0737

35.233.42.115AS0 Google LLC2026-09-2437

207.175.97.174AS0 Google LLC2026-09-0536

34.79.22.130AS0 Google LLC2026-09-0730

35.195.61.17AS0 Google LLC2026-09-1530

34.156.193.123AS0 Google LLC2026-09-2330

34.77.54.24AS0 Google LLC2026-09-2030

23.251.136.213AS0 Google LLC2026-09-2230

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.