HoneyLabs
LookupEnrichFeedsCVEsCampaignsASN IndexMCPBlogDocs
Dashboard

JA4 TLS client fingerprint

t13i131000_f57a46bbacb6_ab7e3b40a677

Seen 2026-02-19 to 2026-06-04 across the retained window.

Open in lookup →

7.1K

Source IPs

274

Networks

62

Countries

56.0K

Ports hit

776.4K

Events

26

IPs / network

Top networks

AS45102 Alibaba US Technology Co., Ltd.3.3K IPs56.9K
AS396982 Google LLC2.0K IPs165.8K
AS398324 Censys, Inc.368 IPs167.6K
AS0 217 IPs101.3K
AS14061 DigitalOcean, LLC125 IPs16.0K
AS14956 RouterHosting LLC125 IPs320
AS8075 Microsoft Corporation121 IPs437
AS398722 Censys, Inc.96 IPs41.8K
AS16509 Amazon.com, Inc.93 IPs104
AS51167 Contabo GmbH49 IPs94
AS14618 Amazon.com, Inc.38 IPs46
AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED28 IPs33

Countries

US 3.6KMY 622DE 612SG 610JP 541GB 525IN 76FR 64NL 44RU 39

Ports targeted

443/tcp 8.3K8443/tcp 4.0K4841/tcp 1.8K4840/tcp 1.8K4839/tcp 1.8K1963/tcp 1.8K1962/tcp 1.7K1961/tcp 1.6K18245/tcp 1.4K44817/tcp 1.4K18244/tcp 1.3K20546/tcp 1.3K
Source IPCCNetworkEvents
165.227.213.98USAS14061 DigitalOcean, LLC14.6K
167.94.146.55USAS398705 Censys, Inc.13.6K
167.94.146.50USAS398705 Censys, Inc.13.6K
167.94.146.56USAS398705 Censys, Inc.13.5K
167.94.146.59USAS398705 Censys, Inc.13.5K
167.94.146.58USAS398705 Censys, Inc.13.4K
167.94.146.57USAS398705 Censys, Inc.13.4K
167.94.146.53USAS398705 Censys, Inc.13.3K
167.94.146.63USAS398705 Censys, Inc.13.3K
167.94.146.51USAS398705 Censys, Inc.13.3K
167.94.146.62USAS398705 Censys, Inc.13.2K
167.94.146.48USAS398705 Censys, Inc.13.2K
167.94.146.52USAS398705 Censys, Inc.13.1K
167.94.146.54USAS398705 Censys, Inc.13.1K
167.94.146.49USAS398705 Censys, Inc.13.1K
167.94.146.61USAS398705 Censys, Inc.13.0K
167.94.146.60USAS398705 Censys, Inc.12.9K
141.98.11.153LTAS209605 UAB Host Baltic2.9K
66.132.172.129USAS398324 Censys, Inc.1.2K
66.132.172.143USAS398324 Censys, Inc.1.2K

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.