HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t12i130500_2d7513195f68_e51b7354d87f

Seen 2026-02-19 to 2026-09-22 across the retained window.

Open in lookup →

1.3K

Source IPs

14

Networks

13

Countries

914

Ports hit

63.1K

Events

90

IPs / network

Top networks

AS6939 Hurricane Electric LLC958 IPs59.5K
AS8075 Microsoft Corporation187 IPs213
AS63949 Akamai Connected Cloud67 IPs207
AS45204 GEMNET LLC23 IPs56
AS10439 CariNet, Inc.8 IPs42
AS47890 Unmanaged Ltd4 IPs2.9K
AS14061 DigitalOcean, LLC4 IPs35
AS213790 Limited Network LTD2 IPs103
AS210644 Aeza Group LLC2 IPs30
AS12876 Scaleway SAS2 IPs10
AS402226 OnlyScans LLC1 IPs27
AS137951 ASLINE LIMITED1 IPs20

Countries

US 1.2KMN 23DE 4RO 4FR 3JP 2IN 2SG 2NL 1AT 1

Ports targeted

443/tcp 1.5K449/tcp 1.3K13443/tcp 1.3K5665/tcp 1.3K11443/tcp 1.3K4434/tcp 1.3K11434/tcp 1.3K33443/tcp 1.3K20443/tcp 1.3K5678/tcp 1.3K9090/tcp 1.3K65443/tcp 1.3K

What it requests

GET/11.1K
GET/favicon.ico10.5K
GET/api/v2/static/not.found3.8K
GET/remote/logincheck3.8K
GET/login?redir=/ng3.8K
GET/lang//custom/sbin/init3.8K
GET/lang/legacy/filechecksum3.8K
GET/migadmin/lang/legacy/legacy/filechecksum3.8K
GET/static/lang//custom/sbin/init3.8K
GET/lang/custom/sbin/init3.8K
GET/fonts/ftnt-icons.woff3.8K
GET/static/lang/custom/sbin/init3.8K

User agents claimed

Mozilla/5.0 zgrab/0.x197 IPs455
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36144 IPs376
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0140 IPs374
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0151 IPs369
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36158 IPs369
Source IPCCNetwork Last seenEvents
65.49.20.67USAS6939 Hurricane Electric LLC2026-09-221.1K
184.105.247.252USAS6939 Hurricane Electric LLC2026-09-221.1K
184.105.247.254USAS6939 Hurricane Electric LLC2026-09-221.1K
65.49.20.68USAS6939 Hurricane Electric LLC2026-09-221.1K
74.82.47.2USAS6939 Hurricane Electric LLC2026-09-221.1K
184.105.247.196USAS6939 Hurricane Electric LLC2026-09-221.0K
74.82.47.3USAS6939 Hurricane Electric LLC2026-09-221.0K
184.105.139.67USAS6939 Hurricane Electric LLC2026-09-221.0K
184.105.139.68USAS6939 Hurricane Electric LLC2026-09-22998
65.49.20.69USAS6939 Hurricane Electric LLC2026-09-22993
65.49.20.66USAS6939 Hurricane Electric LLC2026-09-22993
74.82.47.5USAS6939 Hurricane Electric LLC2026-09-22943
184.105.139.70USAS6939 Hurricane Electric LLC2026-09-22932
74.82.47.4USAS6939 Hurricane Electric LLC2026-09-22930
216.218.206.68USAS6939 Hurricane Electric LLC2026-09-22920
184.105.139.69USAS6939 Hurricane Electric LLC2026-09-22908
184.105.247.195USAS6939 Hurricane Electric LLC2026-09-22906
193.46.255.142ROAS47890 Unmanaged Ltd2026-09-15862
216.218.206.66USAS6939 Hurricane Electric LLC2026-09-22843
184.105.247.194USAS6939 Hurricane Electric LLC2026-09-22826

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.