HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13d1312h2_a44d0ee8b3cc_e381dae6da6b

Seen 2026-09-21 to 2026-09-24 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS13335 sends an email when it next hits a sensor.

78

Source IPs

1

Networks

6

Countries

1

Ports hit

1.4K

Events

78

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS13335 Cloudflare, Inc.78 IPs1.4K

Countries

SG 23TW 19CA 18HK 9US 8NL 1

Ports targeted

443/tcp 1.4K

What it requests

POST/api/designer/v1/file-content13
POST/api/templates/preview13
POST/read-document13
POST/v1/graphql11
POST/graphql11
GET/11
GET/api/config10
POST/api/graphql10
POST/icecoder/lib/terminal-xhr.php8
GET/debug/vars8
DELETE/api/inngest8
POST/mcp8

User agents claimed

Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)19 IPs72
DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)17 IPs65
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot18 IPs63
Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)16 IPs62
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)19 IPs61
Source IPCCNetwork Last seenEvents
162.158.243.225AS0 Cloudflare, Inc.2026-09-22167
172.69.176.162AS0 Cloudflare, Inc.2026-09-24166
162.158.243.224AS0 Cloudflare, Inc.2026-09-22143
104.23.175.76AS0 Cloudflare, Inc.2026-09-24130
172.69.176.22AS0 Cloudflare, Inc.2026-09-22112
172.70.50.169AS0 Cloudflare, Inc.2026-09-2193
172.69.176.23AS0 Cloudflare, Inc.2026-09-2280
172.71.210.193AS0 Cloudflare, Inc.2026-09-2371
172.70.80.101AS0 Cloudflare, Inc.2026-09-2170
172.70.80.100AS0 Cloudflare, Inc.2026-09-2169
104.22.24.217AS0 Cloudflare, Inc.2026-09-2144
172.71.210.192AS0 Cloudflare, Inc.2026-09-2342
162.158.114.77AS0 Cloudflare, Inc.2026-09-2341
162.158.114.76AS0 Cloudflare, Inc.2026-09-2331
104.23.175.91AS0 Cloudflare, Inc.2026-09-2429
104.23.175.77AS0 Cloudflare, Inc.2026-09-2424
104.22.24.216AS0 Cloudflare, Inc.2026-09-2118
104.23.175.90AS0 Cloudflare, Inc.2026-09-2413
104.22.24.57AS0 Cloudflare, Inc.2026-09-2110
162.159.106.207AS0 Cloudflare, Inc.2026-09-232

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.