HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13i131300_f57a46bbacb6_3b244d8fbcc8

Seen 2026-04-05 to 2026-10-04 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14061 sends an email when it next hits a sensor.

67

Source IPs

1

Networks

7

Countries

86

Ports hit

5.6K

Events

67

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS14061 DigitalOcean, LLC67 IPs5.6K

Countries

DE 20US 17CA 8GB 7NL 6SG 6IN 3

Ports targeted

12443/tcp 1137401/tcp 1132031/tcp 11282/tcp 1126556/tcp 1128006/tcp 1124532/tcp 1129092/tcp 1128400/tcp 1125017/tcp 1118111/tcp 1118082/tcp 86

What it requests

GET/397
GET/.DS_Store199
GET/actuator/env199
POST/api199
GET/___proxy_subdomain_whm/login199
POST/api/gql199
GET/debug/default/view?panel=config199
GET/@vite/env199
GET/.env199
GET/.vscode/sftp.json199
GET/config.json199
POST/graphql/api199

User agents claimed

Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)39 IPs1.5K
Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)33 IPs1.4K
Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)38 IPs1.4K
Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)34 IPs1.2K
Source IPCCNetwork Last seenEvents
142.93.129.190NLAS14061 DigitalOcean, LLC2026-10-04220
64.227.32.66GBAS14061 DigitalOcean, LLC2026-10-04174
165.227.84.14USAS14061 DigitalOcean, LLC2026-10-04167
165.22.235.3CAAS14061 DigitalOcean, LLC2026-10-03145
157.230.19.140DEAS14061 DigitalOcean, LLC2026-10-04141
167.99.210.137NLAS14061 DigitalOcean, LLC2026-10-03140
209.38.208.202DEAS14061 DigitalOcean, LLC2026-10-04140
159.89.12.166DEAS14061 DigitalOcean, LLC2026-10-04140
159.65.18.197GBAS14061 DigitalOcean, LLC2026-10-03140
138.68.144.227GBAS14061 DigitalOcean, LLC2026-10-04140
157.245.36.108GBAS14061 DigitalOcean, LLC2026-10-04139
146.190.103.103SGAS14061 DigitalOcean, LLC2026-10-04113
159.89.127.165CAAS14061 DigitalOcean, LLC2026-10-03113
159.89.174.87INAS14061 DigitalOcean, LLC2026-10-02112
157.245.113.227USAS14061 DigitalOcean, LLC2026-10-02112
64.225.75.246NLAS14061 DigitalOcean, LLC2026-10-04112
143.110.213.72CAAS14061 DigitalOcean, LLC2026-10-03112
206.81.12.187USAS14061 DigitalOcean, LLC2026-10-02112
165.227.173.41DEAS14061 DigitalOcean, LLC2026-10-04112
64.227.70.2NLAS14061 DigitalOcean, LLC2026-10-02112

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.