JA4 TLS client fingerprint

t13i311100_e8f1e7e78f70_ccd0985badbe

Seen 2026-02-19 to 2026-09-10 across the retained window.

Open in lookup →

1.0K

Source IPs

Networks

Countries

5.0K

Ports hit

181.4K

Events

1024

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS213412 ONYPHE SAS1.0K IPs181.4K

Countries

US 480FR 480CN 64

Ports targeted

443/tcp 141 9443/tcp 140 554/tcp 139 5357/tcp 137 20201/tcp 136 51005/tcp 134 8085/tcp 132 8000/tcp 132 8088/tcp 130 58603/tcp 130 22323/tcp 126 8015/tcp 124

What it requests

GET/91.0K

GET/favicon.ico90.1K

GET/version?timeout=32s47

POST/wsman34

User agents claimed

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.01.0K IPs181.0K

kubectl/v1.15.2 (linux/amd64) kubernetes/f62783046 IPs47

Source IPCCNetwork Last seenEvents

195.184.76.158USAS213412 ONYPHE SAS2026-09-10335

195.184.76.232USAS213412 ONYPHE SAS2026-09-10326

91.231.89.240FRAS213412 ONYPHE SAS2026-09-10324

195.184.76.122USAS213412 ONYPHE SAS2026-09-10321

91.230.168.203USAS213412 ONYPHE SAS2026-09-10315

91.196.152.174FRAS213412 ONYPHE SAS2026-09-10314

195.184.76.27USAS213412 ONYPHE SAS2026-09-10314

91.231.89.138FRAS213412 ONYPHE SAS2026-09-10313

91.230.168.230USAS213412 ONYPHE SAS2026-09-10312

91.196.152.153FRAS213412 ONYPHE SAS2026-09-10310

195.184.76.28USAS213412 ONYPHE SAS2026-09-10310

91.230.168.59USAS213412 ONYPHE SAS2026-09-10310

91.231.89.246FRAS213412 ONYPHE SAS2026-09-10310

195.184.76.101USAS213412 ONYPHE SAS2026-09-10309

91.196.152.136FRAS213412 ONYPHE SAS2026-09-10307

91.230.168.45USAS213412 ONYPHE SAS2026-09-10306

91.196.152.158FRAS213412 ONYPHE SAS2026-09-10306

91.196.152.57FRAS213412 ONYPHE SAS2026-09-10306

91.230.168.229USAS213412 ONYPHE SAS2026-09-10306

91.196.152.173FRAS213412 ONYPHE SAS2026-09-10305

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.