HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13i170900_5b57614c22b0_78e6aca7449b

Seen 2026-02-19 to 2026-10-07 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS45102 sends an email when it next hits a sensor.

131

Source IPs

80

Networks

38

Countries

1

Ports hit

8.6K

Events

2

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS45102 Alibaba (US) Technology Co., Ltd.10 IPs677
AS51167 Contabo GmbH7 IPs343
AS31898 Oracle Corporation5 IPs340
AS45090 Shenzhen Tencent Computer Systems Company Limited5 IPs240
AS8560 IONOS SE4 IPs159
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED4 IPs151
AS132203 Tencent Building, Kejizhongyi Avenue4 IPs143
AS37963 Hangzhou Alibaba Advertising Co.,Ltd.3 IPs198
AS36352 HostPapa3 IPs147
AS4134 Chinanet3 IPs85
AS150462 PT Air Lintas Komunikasi2 IPs588
AS202660 Uzbektelekom Joint Stock Company2 IPs441

Countries

US 24CN 14SG 12VN 9FR 8ID 6IN 5DE 5HK 4UZ 3

Ports targeted

443/tcp 8.6K

What it requests

POST/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh200
POST/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh199
POST/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input191
POST/?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input189
GET/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php184
GET/vendor/phpunit/Util/PHP/eval-stdin.php182
GET/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php182
GET/vendor/phpunit/src/Util/PHP/eval-stdin.php182
GET/vendor/phpunit/phpunit/LICENSE/eval-stdin.php182
GET/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php181
GET/phpunit/phpunit/Util/PHP/eval-stdin.php180
GET/phpunit/phpunit/src/Util/PHP/eval-stdin.php180

User agents claimed

libredtail-http131 IPs8.6K
Source IPCCNetwork Last seenEvents
103.46.186.85IDAS150462 PT Air Lintas Komunikasi2026-10-02343
186.182.105.49PYAS11664 Techtel LMDS Comunicaciones Interactivas S.A.2026-10-07294
87.192.253.110UZAS202660 Uzbektelekom Joint Stock Company2026-09-30294
160.250.132.238VNAS150895 EZ TECHNOLOGY COMPANY LIMITED2026-10-06289
103.46.186.148IDAS150462 PT Air Lintas Komunikasi2026-09-26245
31.132.90.3KZAS197556 Kar-Tel LLC2026-09-22230
103.63.101.24IDAS150273 PT Berkah Maju Interasional2026-10-01196
102.244.97.185CMAS36912 Orange Cameroun SA2026-10-03196
165.99.207.153PKAS45773 PERN AS Content Servie Provider, Islamabad, Pakistan2026-10-03147
89.126.211.166UZAS202660 Uzbektelekom Joint Stock Company2026-10-07147
196.189.236.67ETAS24757 Ethio Telecom2026-10-07147
223.123.65.54PKAS59257 CMPak Limited2026-09-25147
31.57.62.245LVAS56971 Cgi Global Limited2026-09-23106
8.219.220.7SGAS45102 Alibaba (US) Technology Co., Ltd.2026-09-1998
138.2.102.66SGAS31898 Oracle Corporation2026-09-0898
178.88.115.30KZAS9198 JSC Kazakhtelecom2026-09-2998
47.250.221.153MYAS45102 Alibaba (US) Technology Co., Ltd.2026-10-0198
124.158.13.4VNAS38733 CMC Telecom Infrastructure Company2026-09-2098
47.236.173.77SGAS45102 Alibaba (US) Technology Co., Ltd.2026-09-2898
121.6.97.6SGAS9506 Singtel Fibre Broadband2026-10-0798

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.