JA4 TLS client fingerprint

t13i311000_e8f1e7e78f70_d41ae481755e

Seen 2026-02-19 to 2026-10-26 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14061 sends an email when it next hits a sensor.

690

Source IPs

Networks

Countries

584

Ports hit

50.7K

Events

IPs / network

Top networks

AS14061 DigitalOcean, LLC353 IPs28.4K

AS63949 Akamai Connected Cloud244 IPs20.4K

AS199457 SolidCore Hosting LTD10 IPs25

AS213790 Limited Network LTD9 IPs97

AS399629 BL Networks7 IPs332

AS51167 Contabo GmbH7 IPs55

AS202425 IP Volume inc5 IPs478

AS197170 TechTies Inc.4 IPs93

AS34665 Petersburg Internet Network ltd.3 IPs24

AS213802 Tianfeng (Hong Kong) Communications Limited3 IPs11

AS56048 China Mobile Communicaitons Corporation3 IPs9

AS53667 FranTech Solutions2 IPs72

Countries

US 567CA 20DE 20GB 15AU 12NL 11HK 11FR 9RU 4SG 3

Ports targeted

3388/tcp 1.4K 27017/tcp 1.3K 3389/tcp 1.0K 5901/tcp 763 5900/tcp 687 6001/tcp 608 443/tcp 556 9200/tcp 460 6000/tcp 418 801/tcp 268 800/tcp 267 80/tcp 215

What it requests

GET/3.6K

GET/nice%20ports%2C/Tri%6Eity.txt%2ebak1.3K

GET/favicon.ico504

GET/abc655

GET/abc855

GET/abc755

POST/api2/json/access/ticket45

GET/.git/config44

GET/healthz34

GET/app29

GET/pods29

GET/user29

User agents claimed

zern-scanner (+https://zern.io)3 IPs555

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.369 IPs504

internal-exposure-audit/1.02 IPs254

Mozilla/5.044 IPs249

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.361 IP87

Source IPCCNetwork Last seenEvents

167.172.119.27USAS14061 DigitalOcean, LLC2026-10-09342

45.79.177.18USAS63949 Akamai Connected Cloud2026-10-08304

24.199.95.74USAS14061 DigitalOcean, LLC2026-10-15304

165.227.19.8USAS14061 DigitalOcean, LLC2026-10-09266

206.189.185.18USAS14061 DigitalOcean, LLC2026-10-15266

104.248.117.95USAS14061 DigitalOcean, LLC2026-10-08266

173.230.145.106USAS63949 Akamai Connected Cloud2026-10-08266

157.245.191.129USAS14061 DigitalOcean, LLC2026-10-09266

147.182.135.44USAS14061 DigitalOcean, LLC2026-10-22234

67.205.180.190USAS14061 DigitalOcean, LLC2026-10-09232

23.92.26.50USAS63949 Akamai Connected Cloud2026-10-10230

24.199.88.124USAS14061 DigitalOcean, LLC2026-10-10228

64.227.21.226USAS14061 DigitalOcean, LLC2026-10-09228

64.227.93.102USAS14061 DigitalOcean, LLC2026-10-09228

206.189.79.156USAS14061 DigitalOcean, LLC2026-10-08228

45.79.223.14USAS63949 Akamai Connected Cloud2026-10-14228

134.209.60.158USAS14061 DigitalOcean, LLC2026-10-09228

67.205.164.100USAS14061 DigitalOcean, LLC2026-10-08228

104.248.208.115USAS14061 DigitalOcean, LLC2026-10-22228

134.209.60.115USAS14061 DigitalOcean, LLC2026-10-08228

Interaction

Sessions

Sessions in the last 30 days in which a sensor answered as a product and recorded what a client with this fingerprint did once inside. Logged in, ran commands, named a download and handed over files each count sessions. Reported beside the counts above and never added to them.

1.0K

Sessions

Source IPs

Logged in

Ran commands

Named a download

521

Handed over files

Services

http:443 82http:8443 66http:18852 24http:9193 18http:9192 15http:9195 15http:50001 14http:2087 14http:14430 14http:6688 14http:30005 14http:12171 14

ATT&CK techniques

5 techniques, 4 tactics

What the sessions did in MITRE ATT&CK terms. The sensors map each session from its verdict, its labels and what it named, so one session can show several techniques. The count is sessions.

TechniqueTacticSessions

T1595 Active ScanningReconnaissance680

T1190 Exploit Public-Facing ApplicationInitial Access301

T1078 Valid AccountsInitial Access2

T1059.004 Command and Scripting Interpreter: Unix ShellExecution2

T1110 Brute ForceCredential Access2

Source IPs in these sessions

most sessions first

Source IPCCNetworkLast seenSessions

103.120.170.113IDAS63859 PT. Eka Mas Republik2026-10-22509

185.136.15.2KZAS210328 AO ALMAZ2026-10-2551

147.182.135.44USAS14061 DigitalOcean, LLC2026-10-1538

165.227.102.187USAS14061 DigitalOcean, LLC2026-10-2534

176.65.132.7NLAS197170 TechTies Inc.2026-10-2429

134.209.119.139USAS14061 DigitalOcean, LLC2026-10-2228

94.102.49.210NLAS202425 IP Volume inc2026-10-2126

138.124.108.76NLAS210644 Aeza Group LLC2026-10-2324

64.94.85.57USAS399629 BL Networks2026-10-2224

103.141.235.158SGAS931 Hyonix2026-10-2124

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.