JA4 TLS client fingerprint

t13i251000_b78ed14e2fd0_f50d94e863eb

Seen 2026-08-27 to 2026-09-28 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14061 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

1.4K

Events

IPs / network

Top networks

AS14061 DigitalOcean, LLC30 IPs337

AS202412 Omegatech LTD2 IPs46

AS44901 Belcloud LTD1 IPs471

AS200019 Alexhost Srl1 IPs240

AS214036 Ultahost, Inc.1 IPs240

AS9009 M247 Europe SRL1 IPs53

AS16509 Amazon.com, Inc.1 IPs1

AS51396 Pfcloud UG (haftungsbeschrankt)1 IPs1

Countries

US 17DE 13SG 4BG 1MD 1ES 1AE 1

Ports targeted

10001/tcp 951 81/tcp 64 82/tcp 54 444/tcp 50 808/tcp 45 888/tcp 44 443/tcp 31 801/tcp 24 8080/tcp 21 2083/tcp 11 8443/tcp 8 4433/tcp 6

What it requests

GET/129

GET/remote/login?lang=en40

GET/.env.development30

GET/.env.production30

GET/backend/.env30

GET/.env30

GET/.env.bak30

GET/.env.backup30

GET/.env.local30

GET/api/.env30

GET/app/.env30

GET/.env.staging30

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.363 IPs623

nerva/1.03 IPs308

Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.362 IPs4

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Safari/605.1.153 IPs3

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/115.03 IPs3

Source IPCCNetwork Last seenEvents

185.141.60.128BGAS44901 Belcloud LTD2026-09-23471

143.246.221.223MDAS200019 Alexhost Srl2026-09-24240

154.44.186.37ESAS214036 Ultahost, Inc.2026-09-24240

45.74.57.251USAS9009 M247 Europe SRL2026-09-0653

45.74.20.251USAS202412 Omegatech LTD2026-09-0642

104.248.119.122USAS14061 DigitalOcean, LLC2026-09-2732

192.241.160.85USAS14061 DigitalOcean, LLC2026-09-2732

46.101.174.66DEAS14061 DigitalOcean, LLC2026-09-2731

162.243.232.228USAS14061 DigitalOcean, LLC2026-09-2730

161.35.221.135DEAS14061 DigitalOcean, LLC2026-09-2722

165.227.167.59DEAS14061 DigitalOcean, LLC2026-09-2722

104.248.239.174USAS14061 DigitalOcean, LLC2026-09-2720

134.122.71.111DEAS14061 DigitalOcean, LLC2026-09-2720

167.172.182.242DEAS14061 DigitalOcean, LLC2026-09-2720

46.101.227.193DEAS14061 DigitalOcean, LLC2026-09-2813

165.22.21.73DEAS14061 DigitalOcean, LLC2026-09-2812

162.243.11.223USAS14061 DigitalOcean, LLC2026-09-2712

68.183.78.151DEAS14061 DigitalOcean, LLC2026-09-2711

167.99.247.230DEAS14061 DigitalOcean, LLC2026-09-2710

146.190.74.36USAS14061 DigitalOcean, LLC2026-09-2710

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.