JA4H HTTP client fingerprint
he11nn0400_8fd06a127c33
Seen 2026-06-03 to 2026-09-07 across the retained window.
22
Source IPs
1
Networks
2
Countries
1
Ports hit
22
Events
22
IPs / network
This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.
Top networks
Countries
US 20SG 2
Ports targeted
What it requests
User agents claimed
Python-urllib/3.1422 IPs22
Source IPCCNetwork
Last seenEvents
About this fingerprint
JA4H fingerprints the shape of an HTTP request: method, version, the ordered set of headers and the cookie and language handling. It identifies the HTTP client independently of the URL it asks for.