JA4 TLS client fingerprint
t13i3612h1_bcee18a5b459_e10b9050f4c9
Seen 2026-02-27 to 2026-09-17 across the retained window.
The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked.
Or watch the top network: AS37963 sends an email when it next hits a sensor.
This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.
User agents claimed
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.3696 IPs211
Source IPCCNetwork
Last seenEvents
121.41.166.50AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-135 121.41.167.40AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-124 121.41.166.218AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-174 47.94.210.24AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-034 47.97.111.180AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-164 121.41.169.9AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-134 47.95.194.74AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-024 39.100.85.124AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-174 47.95.204.194AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-174 121.43.116.147AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-133 47.95.207.179AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-133 47.95.212.22AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-123 112.124.37.42AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-133 121.40.46.166AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-133 121.41.167.124AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-033 47.95.209.196AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-033 47.95.209.124AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-043 47.95.200.161AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-133 121.40.44.5AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-033 47.95.209.142AS0 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-123
About this fingerprint
JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.