JA4H HTTP client fingerprint

ge11nn0500_e6b1eaaea03a

Seen 2026-06-20 to 2026-09-18 across the retained window.

Open in lookup →

3

Source IPs

2

Networks

2

Countries

11

Ports hit

47.8K

Events

2

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS213790 Limited Network LTD2 IPs39.0K

AS208137 Feo Prest SRL1 IPs8.8K

Countries

NL 2DE 1

Ports targeted

3000/tcp 12.1K 3001/tcp 11.3K 5005/tcp 10.0K 443/tcp 4.8K 80/tcp 4.7K 5000/tcp 2.5K 5001/tcp 576 8080/tcp 576 5002/tcp 384 5003/tcp 384 5004/tcp 384

What it requests

GET/.env100

GET/.aws/credentials98

GET/.aws/config98

GET/.azure/credentials98

GET/.env.example92

GET/.env.local88

GET/.docker/config.json87

GET/.dockercfg87

GET/.env.docker86

GET/.env.production86

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.363 IPs6.2K

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.03 IPs6.1K

Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.153 IPs6.0K

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.03 IPs5.9K

Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.03 IPs5.9K

Source IPCCNetwork Last seenEvents

192.253.248.173NLAS213790 Limited Network LTD2026-09-1837.1K

213.209.159.148DEAS208137 Feo Prest SRL2026-09-098.8K

192.253.248.163NLAS213790 Limited Network LTD2026-09-121.9K

About this fingerprint

JA4H fingerprints the shape of an HTTP request: method, version, the ordered set of headers and the cookie and language handling. It identifies the HTTP client independently of the URL it asks for.