HoneyLabs

JA4 TLS client fingerprint

t13i1010h1_61a7ad8aa9b6_3a8073edd8ef

Seen 2026-02-20 to 2026-07-28 across the retained window.

107

Source IPs

42

Networks

27

Countries

69

Ports hit

6.3K

Events

3

IPs / network

Top networks

Countries

US 51NL 6PL 5DE 5FI 5RU 4FR 3AL 3CN 2VN 2

Ports targeted

Source IPCCNetworkEvents
89.169.98.0FIAS213291 Nebius B.V.453
147.224.207.174USAS31898 Oracle Corporation331
152.42.128.167NLAS14061 DigitalOcean, LLC305
134.122.58.254NLAS14061 DigitalOcean, LLC303
161.35.111.43USAS14061 DigitalOcean, LLC286
137.184.53.204USAS14061 DigitalOcean, LLC286
67.207.84.130USAS14061 DigitalOcean, LLC286
157.230.176.29USAS14061 DigitalOcean, LLC286
178.128.145.150USAS14061 DigitalOcean, LLC261
142.93.248.194USAS14061 DigitalOcean, LLC261
134.122.18.168USAS14061 DigitalOcean, LLC261
159.203.188.17USAS14061 DigitalOcean, LLC261
161.35.127.118USAS14061 DigitalOcean, LLC261
163.192.193.212USAS31898 Oracle Corporation228
147.224.137.108USAS31898 Oracle Corporation226
64.181.201.187USAS31898 Oracle Corporation178
138.197.93.111USAS14061 DigitalOcean, LLC150
142.93.69.149USAS14061 DigitalOcean, LLC150
142.93.74.169USAS14061 DigitalOcean, LLC150
95.214.55.244PLAS201814 MEVSPACE sp. z o.o.139

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.