JA4 TLS client fingerprint

t13i251000_b78ed14e2fd0_ab7e3b40a677

Seen 2026-02-19 to 2026-09-24 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14061 sends an email when it next hits a sensor.

100

Source IPs

Networks

Countries

141

Ports hit

877

Events

IPs / network

Top networks

AS14061 DigitalOcean, LLC38 IPs109

AS202412 Omegatech LTD10 IPs191

AS9009 M247 Europe SRL4 IPs174

AS207043 Dedik Services Limited3 IPs132

AS213790 Limited Network LTD3 IPs29

AS401626 Netiface America, Inc.3 IPs14

AS25820 IT7 Networks Inc3 IPs8

AS14956 RouterHosting LLC3 IPs7

AS200019 Alexhost Srl3 IPs5

AS48090 Techoff Srv Limited2 IPs49

AS51167 Contabo GmbH2 IPs4

AS63949 Akamai Connected Cloud2 IPs2

Countries

US 56DE 8GB 5FR 4NL 4BG 3UA 3IR 3CA 3RU 2

Ports targeted

443/tcp 233 8443/tcp 38 80/tcp 29 4433/tcp 25 9443/tcp 18 636/tcp 18 4443/tcp 15 445/tcp 12 4444/tcp 12 444/tcp 12 4434/tcp 10 9142/tcp 8

What it requests

GET/480

GET/remote/login?lang=en130

GET/favicon.ico95

GET/.env22

GET/global-protect/login.esp17

GET/.git/config11

GET/+CSCOE+/logon.html10

GET/.git/index9

GET/.git/HEAD9

GET/config.js6

POST/api/jolokia/6

GET/app/config6

User agents claimed

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.364 IPs20

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.10 Safari/605.1.13 IPs6

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.1 Safari/605.1.154 IPs5

Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.02 IPs5

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.03 IPs5

Source IPCCNetwork Last seenEvents

96.62.71.3AS0 Dedik Services Limited2026-09-1986

45.74.57.253AS0 M247 Europe SRL2026-09-0552

45.74.20.254AS0 Omegatech LTD2026-09-0650

45.74.20.253AS0 Omegatech LTD2026-09-0648

2.27.160.71AS0 Dedik Services Limited2026-09-1344

45.74.57.254AS0 M247 Europe SRL2026-09-0643

45.74.57.250AS0 M247 Europe SRL2026-09-0643

45.74.20.252AS0 Omegatech LTD2026-09-0641

45.74.57.252AS0 M247 Europe SRL2026-09-1836

209.141.59.162AS0 FranTech Solutions2026-09-1735

195.178.110.97AS0 Techoff Srv Limited2026-09-1930

77.83.39.94AS0 Pfcloud UG (haftungsbeschrankt)2026-09-2130

45.74.20.250AS0 Omegatech LTD2026-09-0627

93.123.109.214AS0 Techoff Srv Limited2026-09-2319

185.93.89.112AS0 Limited Network LTD2026-09-2115

45.227.254.52AS0 Flyservers S.A.2026-09-0715

195.128.248.33AS0 Virtual Systems LLC2026-08-2612

164.90.142.158AS0 DigitalOcean, LLC2026-09-1012

185.93.89.43AS0 Limited Network LTD2026-09-0812

142.93.177.228AS0 DigitalOcean, LLC2026-08-2611

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.