JA4 TLS client fingerprint

t13i311100_e8f1e7e78f70_ccd0985badbe

Seen 2026-02-19 to 2026-06-04 across the retained window.

Open in lookup →

976

Source IPs

Networks

Countries

3.3K

Ports hit

290.3K

Events

976

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS213412 ONYPHE SAS976 IPs290.3K

Countries

US 480FR 432CN 64

Ports targeted

5432/tcp 452 58603/tcp 401 22323/tcp 397 9443/tcp 383 8000/tcp 382 8015/tcp 379 51005/tcp 377 5357/tcp 376 554/tcp 374 8085/tcp 373 8088/tcp 362 888/tcp 360

Source IPCCNetworkEvents

91.230.168.180USAS213412 ONYPHE SAS516

195.184.76.240USAS213412 ONYPHE SAS503

91.230.168.181USAS213412 ONYPHE SAS497

195.184.76.174USAS213412 ONYPHE SAS491

91.230.168.25USAS213412 ONYPHE SAS489

91.230.168.236USAS213412 ONYPHE SAS487

91.230.168.35USAS213412 ONYPHE SAS486

195.184.76.95USAS213412 ONYPHE SAS484

91.230.168.10USAS213412 ONYPHE SAS483

91.230.168.3USAS213412 ONYPHE SAS482

91.230.168.232USAS213412 ONYPHE SAS479

91.230.168.128USAS213412 ONYPHE SAS478

91.230.168.80USAS213412 ONYPHE SAS478

91.230.168.161USAS213412 ONYPHE SAS478

91.230.168.138USAS213412 ONYPHE SAS477

91.230.168.172USAS213412 ONYPHE SAS476

195.184.76.166USAS213412 ONYPHE SAS476

195.184.76.92USAS213412 ONYPHE SAS475

91.230.168.24USAS213412 ONYPHE SAS475

195.184.76.65USAS213412 ONYPHE SAS475

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.