JA4 TLS client fingerprint
t13i311100_e8f1e7e78f70_ccd0985badbe
Seen 2026-02-19 to 2026-10-25 across the retained window.
The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS213412 sends an email when it next hits a sensor.
1.0K
Source IPs
1
Networks
3
Countries
5.0K
Ports hit
171.5K
Events
1024
IPs / network
This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.
Top networks
Countries
What it requests
User agents claimed
Interaction
Sessions
Sessions in the last 30 days in which a sensor answered as a product and recorded what a client with this fingerprint did once inside. Logged in, ran commands, named a download and handed over files each count sessions. Reported beside the counts above and never added to them.
23.9K
Sessions
1.0K
Source IPs
0
Logged in
0
Ran commands
0
Named a download
0
Handed over files
Services
ATT&CK techniques
2 techniques, 2 tacticsWhat the sessions did in MITRE ATT&CK terms. The sensors map each session from its verdict, its labels and what it named, so one session can show several techniques. The count is sessions.
Source IPs in these sessions
most sessions firstAbout this fingerprint
JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.