HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13i131200_f57a46bbacb6_1bd98dace775

Seen 2026-02-23 to 2026-10-12 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14061 sends an email when it next hits a sensor.

26

Source IPs

1

Networks

2

Countries

5

Ports hit

33

Events

26

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS14061 DigitalOcean, LLC26 IPs33

Countries

GB 21NL 5

Ports targeted

990/tcp 10443/tcp 8993/tcp 7995/tcp 48443/tcp 4

What it requests

GET/12

User agents claimed

CGrab/v8.24.1-dev-throughput11 IPs12
Source IPCCNetwork Last seenEvents
146.190.21.73NLAS14061 DigitalOcean, LLC2026-09-233
161.35.38.190GBAS14061 DigitalOcean, LLC2026-10-112
178.128.250.218NLAS14061 DigitalOcean, LLC2026-09-222
159.65.22.166GBAS14061 DigitalOcean, LLC2026-09-302
159.65.28.123GBAS14061 DigitalOcean, LLC2026-10-112
144.126.234.45GBAS14061 DigitalOcean, LLC2026-10-112
178.128.160.189GBAS14061 DigitalOcean, LLC2026-10-101
68.183.37.176GBAS14061 DigitalOcean, LLC2026-10-121
165.232.99.171GBAS14061 DigitalOcean, LLC2026-10-021
46.101.56.115GBAS14061 DigitalOcean, LLC2026-09-281
128.199.44.215NLAS14061 DigitalOcean, LLC2026-09-231
209.97.141.164GBAS14061 DigitalOcean, LLC2026-10-121
104.248.172.103GBAS14061 DigitalOcean, LLC2026-10-121
178.62.125.193GBAS14061 DigitalOcean, LLC2026-10-021
134.122.109.75GBAS14061 DigitalOcean, LLC2026-10-101
142.93.135.160NLAS14061 DigitalOcean, LLC2026-09-231
167.71.131.2GBAS14061 DigitalOcean, LLC2026-09-281
138.68.179.38GBAS14061 DigitalOcean, LLC2026-10-021
165.232.103.173GBAS14061 DigitalOcean, LLC2026-10-081
134.209.184.195GBAS14061 DigitalOcean, LLC2026-10-061

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.