HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13i131000_f57a46bbacb6_f50d94e863eb

Seen 2026-08-27 to 2026-09-24 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS45102 sends an email when it next hits a sensor.

2.6K

Source IPs

29

Networks

18

Countries

2.9K

Ports hit

9.9K

Events

89

IPs / network

Top networks

AS45102 Alibaba (US) Technology Co., Ltd.2.4K IPs6.5K
AS14987 Rethem Hosting LLC113 IPs2.0K
AS14061 DigitalOcean, LLC20 IPs32
AS219502 Storm Industries LLC3 IPs353
AS51167 Contabo GmbH3 IPs16
AS51396 Pfcloud UG (haftungsbeschrankt)3 IPs13
AS16509 Amazon.com, Inc.3 IPs3
Unattributed2 IPs26
AS213790 Limited Network LTD2 IPs14
AS12876 Scaleway SAS2 IPs9
AS396982 Google LLC2 IPs3
AS150436 Byteplus Pte. Ltd.1 IPs440

Countries

US 811JP 468DE 455MY 402SG 401NL 13FR 5AE 3IN 2ID 1

Ports targeted

443/tcp 8151880/tcp 2378443/tcp 1258080/tcp 761881/tcp 759443/tcp 681883/tcp 487681/tcp 469100/tcp 428020/tcp 428002/tcp 428090/tcp 41

What it requests

GET/6.9K
POST/wsman1.4K
GET/settings399
GET/flows74
GET/api/config45
GET/ws43
GET/login23
GET/wp-login.php14
GET/wp/wp-login.php13
GET/cms/wp-login.php13
GET/admin/wp-login.php13
GET/wordpress/wp-login.php13

User agents claimed

curl/7.64.12.4K IPs6.5K
Microsoft WinRM Client111 IPs1.4K
Go-http-client/1.17 IPs547
curl/7.61.191 IPs222
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.01 IPs87
Source IPCCNetwork Last seenEvents
69.5.20.14AS0 Byteplus Pte. Ltd.2026-09-16440
130.12.180.42AS0 Omegatech LTD2026-09-22234
94.154.43.7AS0 Storm Industries LLC2026-09-22206
94.154.43.163AS0 Storm Industries LLC2026-09-24166
45.148.10.95AS0 Techoff Srv Limited2026-09-1889
104.152.52.202AS0 Rethem Hosting LLC2026-09-2352
104.152.52.212AS0 Rethem Hosting LLC2026-09-2351
130.78.189.159AS0 Lightbyte Ltd2026-09-2443
104.152.52.201AS0 Rethem Hosting LLC2026-09-2443
104.152.52.240AS0 Rethem Hosting LLC2026-09-2339
104.152.52.205AS0 Rethem Hosting LLC2026-09-2338
104.152.52.217AS0 Rethem Hosting LLC2026-09-2336
104.152.52.213AS0 Rethem Hosting LLC2026-09-2436
198.144.189.91AS0 HostPapa2026-09-2335
104.152.52.207AS0 Rethem Hosting LLC2026-09-2434
104.152.52.200AS0 Rethem Hosting LLC2026-09-2434
104.152.52.211AS0 Rethem Hosting LLC2026-09-2434
104.152.52.214AS0 Rethem Hosting LLC2026-09-2332
104.152.52.210AS0 Rethem Hosting LLC2026-09-2331
104.152.52.206AS0 Rethem Hosting LLC2026-09-2431

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.