HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13i170900_5b57614c22b0_78e6aca7449b

Seen 2026-02-19 to 2026-10-04 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS45102 sends an email when it next hits a sensor.

136

Source IPs

83

Networks

37

Countries

1

Ports hit

8.7K

Events

2

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS45102 Alibaba (US) Technology Co., Ltd.11 IPs726
AS45090 Shenzhen Tencent Computer Systems Company Limited7 IPs257
AS51167 Contabo GmbH6 IPs294
AS31898 Oracle Corporation5 IPs340
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED4 IPs198
AS8560 IONOS SE4 IPs159
AS132203 Tencent Building, Kejizhongyi Avenue4 IPs143
AS59257 CMPak Limited3 IPs294
AS37963 Hangzhou Alibaba Advertising Co.,Ltd.3 IPs151
AS36352 HostPapa3 IPs147
AS4134 Chinanet3 IPs85
AS150462 PT Air Lintas Komunikasi2 IPs588

Countries

US 22CN 17SG 13VN 10FR 8ID 6DE 6IN 6PK 4HK 4

Ports targeted

443/tcp 8.7K

What it requests

POST/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh202
POST/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh201
POST/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input193
POST/?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input191
GET/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php186
GET/vendor/phpunit/Util/PHP/eval-stdin.php184
GET/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php184
GET/vendor/phpunit/src/Util/PHP/eval-stdin.php184
GET/vendor/phpunit/phpunit/LICENSE/eval-stdin.php184
GET/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php182
GET/phpunit/phpunit/Util/PHP/eval-stdin.php181
GET/phpunit/phpunit/src/Util/PHP/eval-stdin.php181

User agents claimed

libredtail-http136 IPs8.7K
Source IPCCNetwork Last seenEvents
31.132.90.3KZAS197556 Kar-Tel LLC2026-09-22368
103.46.186.85IDAS150462 PT Air Lintas Komunikasi2026-10-02343
87.192.253.110UZAS202660 Uzbektelekom Joint Stock Company2026-09-30343
103.46.186.148IDAS150462 PT Air Lintas Komunikasi2026-09-26245
160.250.132.238VNAS150895 EZ TECHNOLOGY COMPANY LIMITED2026-10-02240
102.244.97.185CMAS36912 Orange Cameroun SA2026-10-03196
103.63.101.24IDAS150273 PT Berkah Maju Interasional2026-10-01196
186.182.105.49PYAS11664 Techtel LMDS Comunicaciones Interactivas S.A.2026-09-13147
124.158.13.4VNAS38733 CMC Telecom Infrastructure Company2026-09-20147
165.99.207.153PKAS45773 PERN AS Content Servie Provider, Islamabad, Pakistan2026-10-03147
223.123.65.54PKAS59257 CMPak Limited2026-09-25147
31.57.62.245LVAS56971 Cgi Global Limited2026-09-23106
107.150.97.10USAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2598
223.123.92.77PKAS59257 CMPak Limited2026-09-0598
95.130.227.78UZAS35682 Best Internet Solution Xk2026-09-2398
8.219.220.7SGAS45102 Alibaba (US) Technology Co., Ltd.2026-09-1998
138.2.102.66SGAS31898 Oracle Corporation2026-09-0898
178.88.115.30KZAS9198 JSC Kazakhtelecom2026-09-2998
129.121.128.211SGAS31898 Oracle Corporation2026-09-2798
47.236.173.77SGAS45102 Alibaba (US) Technology Co., Ltd.2026-09-2898

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.