JA4 TLS client fingerprint

t13i311100_e8f1e7e78f70_ccd0985badbe

Seen 2026-02-19 to 2026-07-27 across the retained window.

Open in lookup →

976

Source IPs

Networks

Countries

4.6K

Ports hit

516.7K

Events

976

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS213412 ONYPHE SAS976 IPs516.7K

Countries

US 480FR 432CN 64

Ports targeted

58603/tcp 640 9443/tcp 623 5432/tcp 622 554/tcp 619 22323/tcp 619 51005/tcp 617 8000/tcp 615 8015/tcp 608 8085/tcp 604 20201/tcp 578 53/tcp 575 443/tcp 567

Source IPCCNetworkEvents

91.230.168.136USAS213412 ONYPHE SAS872

195.184.76.166USAS213412 ONYPHE SAS866

91.230.168.10USAS213412 ONYPHE SAS863

91.230.168.232USAS213412 ONYPHE SAS861

91.230.168.8USAS213412 ONYPHE SAS859

91.230.168.128USAS213412 ONYPHE SAS858

195.184.76.32USAS213412 ONYPHE SAS856

91.230.168.3USAS213412 ONYPHE SAS855

195.184.76.174USAS213412 ONYPHE SAS852

195.184.76.240USAS213412 ONYPHE SAS850

91.230.168.18USAS213412 ONYPHE SAS850

91.230.168.25USAS213412 ONYPHE SAS849

195.184.76.173USAS213412 ONYPHE SAS849

91.230.168.189USAS213412 ONYPHE SAS848

195.184.76.168USAS213412 ONYPHE SAS842

91.230.168.251USAS213412 ONYPHE SAS840

91.230.168.123USAS213412 ONYPHE SAS839

91.230.168.186USAS213412 ONYPHE SAS838

91.230.168.253USAS213412 ONYPHE SAS838

91.230.168.31USAS213412 ONYPHE SAS838

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.