HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13d1516h2_8daaf6152771_d8a2da3f94cd

Seen 2026-09-20 to 2026-10-13 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS396982 sends an email when it next hits a sensor.

23

Source IPs

4

Networks

9

Countries

2

Ports hit

6.5K

Events

6

IPs / network

Top networks

AS396982 Google LLC17 IPs6.5K
AS14061 DigitalOcean, LLC3 IPs3
AS14618 Amazon.com, Inc.2 IPs4
AS30860 Virtual Systems LLC1 IP2

Countries

US 8NL 5SG 2DE 2JP 2BE 1CA 1TW 1UA 1

Ports targeted

443/tcp 6.3K8443/tcp 236

What it requests

GET/43
POST/v1/graphql37
POST/api/designer/v1/file-content32
POST/api/templates/preview32
POST/read-document32
POST/api/graphql29
POST/graphql29
POST/feast/read-document28
GET/api/config28
GET/openapi.json20
GET/console20
GET/debug/vars19

User agents claimed

Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)17 IPs223
Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)17 IPs217
Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)17 IPs212
Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)17 IPs209
Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)17 IPs208
Source IPCCNetwork Last seenEvents
35.204.118.149NLAS396982 Google LLC2026-10-06890
136.90.54.131USAS396982 Google LLC2026-09-28873
35.187.246.147SGAS396982 Google LLC2026-09-29505
207.175.110.40BEAS396982 Google LLC2026-09-29466
34.89.245.228DEAS396982 Google LLC2026-09-29408
34.178.199.198NLAS396982 Google LLC2026-10-13402
34.95.4.198CAAS396982 Google LLC2026-09-29388
34.26.207.140USAS396982 Google LLC2026-10-12281
34.73.172.220USAS396982 Google LLC2026-10-12281
35.229.167.222TWAS396982 Google LLC2026-10-11281
34.24.155.236USAS396982 Google LLC2026-10-12281
136.70.235.57USAS396982 Google LLC2026-10-11281
136.90.15.166USAS396982 Google LLC2026-09-29249
35.198.131.152DEAS396982 Google LLC2026-09-29242
34.124.215.33SGAS396982 Google LLC2026-09-30241
34.84.217.48JPAS396982 Google LLC2026-09-29210
35.221.64.237JPAS396982 Google LLC2026-09-29210
31.42.187.226UAAS30860 Virtual Systems LLC2026-09-212
54.163.198.228USAS14618 Amazon.com, Inc.2026-10-102
98.80.206.79USAS14618 Amazon.com, Inc.2026-10-082

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.