HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13i1711h1_ab0a1bf427ad_882d495ac381

Seen 2026-04-01 to 2026-10-15 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS396982 sends an email when it next hits a sensor.

29

Source IPs

14

Networks

8

Countries

8

Ports hit

446

Events

2

IPs / network

Top networks

AS396982 Google LLC12 IPs13
AS14061 DigitalOcean, LLC5 IPs5
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED1 IP372
AS50060 Annet Ltd.1 IP15
AS39378 servinga GmbH1 IP13
AS206479 AceRDP Ltd1 IP10
AS16276 OVH SAS1 IP9
AS51167 Contabo GmbH1 IP2
AS56047 China Mobile communications corporation1 IP2
AS212238 Datacamp Limited1 IP1
AS13335 Cloudflare, Inc.1 IP1
AS12876 Scaleway SAS1 IP1

Countries

US 18RU 2DE 2FR 2GB 2HK 1NL 1CN 1

Ports targeted

36659/tcp 372443/tcp 4112359/tcp 1325461/tcp 122000/tcp 310250/tcp 225463/tcp 210443/tcp 1

What it requests

GET/21
GET/player_api.php14
GET/level/15/exec/-/show/configuration/CR13
GET/.env11
GET/ui/4
GET/api/user/ismustmobile4
POST/sdk4
GET/vbr3
GET/pods2
POST/adfa2
GET/h5/2
POST/api/revalidate2

User agents claimed

Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/128.3 Mobile/15E148 Safari/604.11 IP69
Mozilla/5.0 (iPhone; CPU iPhone OS 14 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/134.0 Mobile/15E148 Safari/604.11 IP67
Mozilla/5.0 (Linux; Android 8; Mi Pad 5 Pro 5G; Build/OPM5.230827.132) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.361 IP49
Mozilla/5.0 (Linux; Android 12; 15; Build/SQ1D.220729.177) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Mobile Safari/537.361 IP40
Mozilla/5.0 (Linux; Android 14; SM-G316HU; Build/UD2A.221009.156) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Mobile Safari/537.361 IP38
Source IPCCNetwork Last seenEvents
165.154.72.141HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-10-11372
109.94.87.173RUAS50060 Annet Ltd.2026-10-0415
79.132.131.147DEAS39378 servinga GmbH2026-10-0813
5.175.189.149NLAS206479 AceRDP Ltd2026-09-1610
80.87.206.148RUAS16276 OVH SAS2026-10-159
109.123.248.42FRAS51167 Contabo GmbH2026-09-182
216.180.246.92USAS396982 Google LLC2026-10-132
120.227.95.106CNAS56047 China Mobile communications corporation2026-10-092
167.71.24.236USAS14061 DigitalOcean, LLC2026-09-191
216.180.246.171USAS396982 Google LLC2026-10-011
216.180.246.221USAS396982 Google LLC2026-10-051
216.180.246.160USAS396982 Google LLC2026-10-081
216.180.246.166USAS396982 Google LLC2026-10-021
157.230.159.66USAS14061 DigitalOcean, LLC2026-09-231
134.209.57.134USAS14061 DigitalOcean, LLC2026-10-071
216.180.246.158USAS396982 Google LLC2026-10-101
216.180.246.23USAS396982 Google LLC2026-09-291
216.180.246.186USAS396982 Google LLC2026-10-141
216.180.246.74USAS396982 Google LLC2026-10-091
104.28.244.86GBAS13335 Cloudflare, Inc.2026-10-111

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.