HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13i1010h1_61a7ad8aa9b6_3a8073edd8ef

Seen 2026-02-20 to 2026-09-22 across the retained window.

Open in lookup →

4.6K

Source IPs

8

Networks

25

Countries

217

Ports hit

392.4K

Events

573

IPs / network

Top networks

AS396982 Google LLC4.5K IPs390.9K
AS31898 Oracle Corporation23 IPs1.1K
AS8075 Microsoft Corporation4 IPs30
AS150820 LIENVPS TECHNOLOGY COMPANY LIMITED4 IPs8
AS18526 DDPS Networks, LLC2 IPs4
AS16276 OVH SAS1 IPs240
AS198953 Proton66 OOO1 IPs114
AS51396 Pfcloud UG (haftungsbeschrankt)1 IPs26

Countries

US 2.3KBE 314JP 250TW 180CA 132NL 125GB 122SG 115BR 113IN 110

Ports targeted

8190/tcp 14.2K8085/tcp 9.8K8448/tcp 8.3K82/tcp 7.9K4567/tcp 7.6K9800/tcp 7.4K12000/tcp 7.4K8447/tcp 7.3K7443/tcp 7.1K443/tcp 6.9K9202/tcp 6.9K8240/tcp 6.6K

What it requests

GET/3.3K
GET/.git/config2.1K
GET/app/.git/config2.1K
GET/src/.git/config2.1K
GET/backend/.git/config2.1K
GET/api/.git/config2.0K
GET/www/.git/config2.0K
GET/html/.git/config2.0K
GET/public/.git/config2.0K
GET/site/.git/config2.0K
GET/htdocs/.git/config2.0K
GET/wordpress/.git/config2.0K

User agents claimed

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.362.9K IPs365.1K
crusader-worker/1.01.8K IPs25.8K
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.3621 IPs1.1K
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.361 IPs240
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.2031 IPs114
Source IPCCNetwork Last seenEvents
34.93.32.208INAS396982 Google LLC2026-09-064.7K
35.189.7.56AUAS396982 Google LLC2026-09-064.1K
34.88.217.176FIAS396982 Google LLC2026-09-064.1K
34.153.223.172JPAS396982 Google LLC2026-09-063.2K
34.53.45.204USAS396982 Google LLC2026-09-063.1K
34.146.10.239JPAS396982 Google LLC2026-09-063.1K
34.39.208.120BRAS396982 Google LLC2026-09-063.0K
34.106.96.134USAS396982 Google LLC2026-09-063.0K
136.67.125.61USAS396982 Google LLC2026-09-062.9K
136.117.50.181USAS396982 Google LLC2026-09-062.9K
34.116.85.1AUAS396982 Google LLC2026-09-062.7K
34.95.158.26BRAS396982 Google LLC2026-09-072.6K
34.20.230.32USAS396982 Google LLC2026-09-062.6K
34.146.205.220JPAS396982 Google LLC2026-09-072.6K
34.81.25.124TWAS396982 Google LLC2026-09-062.5K
34.100.179.178INAS396982 Google LLC2026-09-062.4K
34.21.205.165SGAS396982 Google LLC2026-09-062.4K
34.97.2.189JPAS396982 Google LLC2026-09-072.3K
35.233.75.198BEAS396982 Google LLC2026-09-072.3K
35.240.25.196BEAS396982 Google LLC2026-09-062.2K

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.