JA4 TLS client fingerprint

t13i351200_bfa337485184_678a800b2221

Seen 2026-06-21 to 2026-07-23 across the retained window.

Open in lookup →

Source IPs

Networks

Countries

Ports hit

346

Events

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS7393 CYBERCON, INC.1 IPs195

AS204428 SS-Net1 IPs144

AS43180 Trunk Networks LTD1 IPs4

AS0 1 IPs3

Countries

RO 1SG 1US 1ES 1

Ports targeted

7443/tcp 183 465/tcp 144 8443/tcp 3 18080/tcp 2 4567/tcp 2 443/tcp 2 80/tcp 2 5000/tcp 2 5985/tcp 1 10443/tcp 1 7777/tcp 1 5357/tcp 1

Source IPCCNetworkEvents

66.154.119.224USAS7393 CYBERCON, INC.195

80.94.95.7ROAS204428 SS-Net144

85.137.51.115ESAS0 7

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.