HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsAEI IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
DocsBlog
Dashboard

JA4 TLS client fingerprint

t13i131200_f57a46bbacb6_7e55ffd90fc1

Seen 2026-06-12 to 2026-08-23 across the retained window.

Open in lookup →

4

Source IPs

1

Networks

3

Countries

10

Ports hit

11.2K

Events

4

IPs / network

Top networks

AS396982 Google LLC4 IPs11.2K

Countries

US 2NL 1BE 1

Ports targeted

5173/tcp 2.1K9000/tcp 1.5K5000/tcp 1.5K3000/tcp 1.4K8443/tcp 1.1K443/tcp 1.0K2376/tcp 9702375/tcp 5949090/tcp 5519443/tcp 488
Source IPCCNetworkEvents
136.70.99.185USAS396982 Google LLC5.9K
35.204.188.41NLAS396982 Google LLC2.8K
34.145.254.163USAS396982 Google LLC2.2K
104.155.113.219BEAS396982 Google LLC313

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.