HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsAEI IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13i131000_f57a46bbacb6_ab7e3b40a677

Seen 2026-02-19 to 2026-09-02 across the retained window.

Open in lookup →

5.4K

Source IPs

79

Networks

31

Countries

30.1K

Ports hit

288.7K

Events

68

IPs / network

Top networks

AS45102 Alibaba (US) Technology Co., Ltd.2.6K IPs15.7K
AS396982 Google LLC1.9K IPs86.7K
AS398324 Censys, Inc.270 IPs87.6K
AS398722 Censys, Inc.128 IPs13.9K
AS14987 Rethem Hosting LLC114 IPs9.8K
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED72 IPs78
AS14061 DigitalOcean, LLC41 IPs740
AS8075 Microsoft Corporation29 IPs302
AS398705 Censys, Inc.16 IPs65.2K
AS16276 OVH SAS11 IPs294
AS207043 Dedik Services Limited11 IPs169
AS51167 Contabo GmbH11 IPs162

Countries

US 2.8KJP 517DE 502GB 501SG 478MY 446NL 22FR 22HK 22CN 13

Ports targeted

443/tcp 5.6K3000/tcp 1.4K8443/tcp 6921962/tcp 6614841/tcp 6451963/tcp 6314839/tcp 6054840/tcp 6041961/tcp 58118789/tcp 50718245/tcp 49220546/tcp 472

What it requests

GET/favicon.ico166.9K
GET/104.4K
POST/wsman6.9K
GET/logs?format=xml429
GET/wp-login.php195
GET/manager/html195
GET/wp/wp-login.php129
GET/blog/wp-login.php128
GET/wordpress/wp-login.php128
GET/.env97
GET/api/config93
GET/ws82

User agents claimed

Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)414 IPs166.7K
Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity1.9K IPs86.3K
curl/7.64.12.6K IPs15.6K
Microsoft WinRM Client114 IPs6.9K
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)21 IPs2.0K
Source IPCCNetwork Last seenEvents
167.94.146.55USAS398705 Censys, Inc.2026-09-024.4K
167.94.146.52USAS398705 Censys, Inc.2026-09-024.3K
167.94.146.63USAS398705 Censys, Inc.2026-09-024.2K
167.94.146.57USAS398705 Censys, Inc.2026-09-024.2K
167.94.146.50USAS398705 Censys, Inc.2026-09-024.1K
167.94.146.59USAS398705 Censys, Inc.2026-09-024.1K
167.94.146.62USAS398705 Censys, Inc.2026-09-024.1K
167.94.146.60USAS398705 Censys, Inc.2026-09-024.1K
167.94.146.58USAS398705 Censys, Inc.2026-09-024.1K
167.94.146.56USAS398705 Censys, Inc.2026-09-024.1K
167.94.146.49USAS398705 Censys, Inc.2026-09-024.0K
167.94.146.53USAS398705 Censys, Inc.2026-09-024.0K
167.94.146.51USAS398705 Censys, Inc.2026-09-023.9K
167.94.146.48USAS398705 Censys, Inc.2026-09-023.9K
167.94.146.54USAS398705 Censys, Inc.2026-09-023.9K
167.94.146.61USAS398705 Censys, Inc.2026-09-023.8K
80.94.95.211ROAS204428 SS-Net2026-08-111.2K
194.180.49.37BGAS201814 MEVSPACE sp. z o.o.2026-09-021.1K
45.142.193.144ROAS213388 Iic Rail Limited2026-08-30723
185.243.5.47HKAS23470 ReliableSite.Net LLC2026-08-16597

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.