JA4 TLS client fingerprint
t13i3111h2_e8f1e7e78f70_8d633dac7124
Seen 2026-02-26 to 2026-07-06 across the retained window.
72
Source IPs
3
Networks
4
Countries
1
Ports hit
15.3K
Events
24
IPs / network
This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.
Top networks
Countries
GB 51US 19ID 1RU 1
Ports targeted
Source IPCCNetworkEvents
About this fingerprint
JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.