HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t12i330500_5172cef6ed69_021165082e1c

Seen 2026-02-19 to 2026-09-24 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS211680 sends an email when it next hits a sensor.

258

Source IPs

2

Networks

1

Countries

54

Ports hit

1.3K

Events

129

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS211680 Sistemas Informaticos, S.A.163 IPs947
AS21859 Zenlayer Inc95 IPs326

Countries

PT 258

Ports targeted

8443/tcp 380443/tcp 3779443/tcp 70444/tcp 574443/tcp 546443/tcp 365001/tcp 188083/tcp 1510250/tcp 154433/tcp 125577/tcp 116379/tcp 10

What it requests

GET/523
GET/favicon.ico72
GET/license.txt59
GET/wp-json58
GET/progs/homepage54
GET/internal_forms_authentication27
GET/owncloud/status.php25
GET/status.php23
GET/cgi-bin/authLogin.cgi22
GET/api/session/properties20
GET/js/NewWindow_2_all.js18
GET/aspera/faspex/16

User agents claimed

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36256 IPs1.2K
kubectl/v1.12.0 (linux/amd64) kubernetes/0ed338816 IPs24
Source IPCCNetwork Last seenEvents
45.156.129.176AS0 Sistemas Informaticos, S.A.2026-09-1823
45.156.128.166AS0 Sistemas Informaticos, S.A.2026-09-1122
185.226.197.57AS0 Zenlayer Inc2026-09-1522
45.156.128.164AS0 Sistemas Informaticos, S.A.2026-09-1822
45.156.129.179AS0 Sistemas Informaticos, S.A.2026-09-1420
45.156.129.173AS0 Sistemas Informaticos, S.A.2026-09-1520
45.156.128.167AS0 Sistemas Informaticos, S.A.2026-09-1520
45.156.128.128AS0 Sistemas Informaticos, S.A.2026-09-1819
45.156.129.174AS0 Sistemas Informaticos, S.A.2026-09-1718
45.156.129.177AS0 Sistemas Informaticos, S.A.2026-09-1416
185.226.197.58AS0 Zenlayer Inc2026-09-0716
45.156.128.175AS0 Sistemas Informaticos, S.A.2026-09-0416
45.156.128.45AS0 Sistemas Informaticos, S.A.2026-09-1915
45.156.129.112AS0 Sistemas Informaticos, S.A.2026-09-1615
45.156.128.165AS0 Sistemas Informaticos, S.A.2026-09-1515
45.156.129.178AS0 Sistemas Informaticos, S.A.2026-09-2315
45.156.129.190AS0 Sistemas Informaticos, S.A.2026-09-2314
45.156.128.174AS0 Sistemas Informaticos, S.A.2026-09-0714
45.156.128.131AS0 Sistemas Informaticos, S.A.2026-09-1914
45.156.128.130AS0 Sistemas Informaticos, S.A.2026-09-1913

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.