JA4 TLS client fingerprint

t13i311000_e8f1e7e78f70_d41ae481755e

Seen 2026-02-19 to 2026-10-13 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14061 sends an email when it next hits a sensor.

838

Source IPs

Networks

Countries

744

Ports hit

95.2K

Events

IPs / network

Top networks

AS14061 DigitalOcean, LLC441 IPs53.8K

AS63949 Akamai Connected Cloud298 IPs38.6K

AS51167 Contabo GmbH12 IPs761

AS399629 BL Networks8 IPs271

AS202425 IP Volume inc5 IPs423

AS16276 OVH SAS5 IPs203

AS8075 Microsoft Corporation5 IPs39

AS16509 Amazon.com, Inc.5 IPs28

AS34665 Petersburg Internet Network ltd.3 IPs15

AS213802 Tianfeng (Hong Kong) Communications Limited3 IPs11

AS56048 China Mobile Communicaitons Corporation3 IPs5

AS207043 Dedik Services Limited2 IPs174

Countries

US 688CA 34DE 24GB 18AU 16FR 15NL 9SG 6RU 6IN 4

Ports targeted

3388/tcp 1.6K 27017/tcp 1.6K 3389/tcp 1.2K 443/tcp 975 5901/tcp 839 5900/tcp 725 8443/tcp 682 9200/tcp 652 6000/tcp 608 6001/tcp 570 8172/tcp 306 5002/tcp 306

What it requests

GET/5.8K

GET/nice%20ports%2C/Tri%6Eity.txt%2ebak2.4K

GET/favicon.ico443

GET/wp-json/wp/v2/posts361

GET/wp-login.php355

POST/api2/json/access/ticket45

GET/version44

GET/abc842

GET/abc742

GET/abc642

GET/.git/config33

GET/.env30

User agents claimed

Python/3.12 aiohttp/3.9.57 IPs716

Mozilla/5.040 IPs565

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.3610 IPs443

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.364 IPs371

zern-scanner (+https://zern.io)2 IPs197

Source IPCCNetwork Last seenEvents

178.238.224.34FRAS51167 Contabo GmbH2026-09-30616

206.189.79.156USAS14061 DigitalOcean, LLC2026-10-08569

167.172.119.27USAS14061 DigitalOcean, LLC2026-10-09456

157.245.191.129USAS14061 DigitalOcean, LLC2026-10-09418

134.209.60.115USAS14061 DigitalOcean, LLC2026-10-08418

165.227.19.8USAS14061 DigitalOcean, LLC2026-10-09380

24.199.88.124USAS14061 DigitalOcean, LLC2026-10-10380

104.248.117.95USAS14061 DigitalOcean, LLC2026-10-08380

159.89.135.7USAS14061 DigitalOcean, LLC2026-10-02380

173.230.145.106USAS63949 Akamai Connected Cloud2026-10-08380

67.205.164.100USAS14061 DigitalOcean, LLC2026-10-08380

69.164.213.99USAS63949 Akamai Connected Cloud2026-10-06380

45.79.177.18USAS63949 Akamai Connected Cloud2026-10-08380

50.116.20.82USAS63949 Akamai Connected Cloud2026-10-09380

134.122.22.68USAS14061 DigitalOcean, LLC2026-10-08356

137.184.16.18USAS14061 DigitalOcean, LLC2026-10-09342

206.189.185.18USAS14061 DigitalOcean, LLC2026-10-08342

198.199.123.131USAS14061 DigitalOcean, LLC2026-10-01342

50.116.44.24USAS63949 Akamai Connected Cloud2026-09-29342

45.33.54.133USAS63949 Akamai Connected Cloud2026-10-10342

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.