HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13i1811h1_85036bcba153_b26ce05bbdd6

Seen 2026-02-19 to 2026-09-23 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS135377 sends an email when it next hits a sensor.

50

Source IPs

18

Networks

24

Countries

18

Ports hit

1.5K

Events

3

IPs / network

Top networks

AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED26 IPs27
AS12876 Scaleway SAS8 IPs48
AS200019 Alexhost Srl1 IPs802
AS45102 Alibaba (US) Technology Co., Ltd.1 IPs566
AS13335 Cloudflare, Inc.1 IPs18
AS174 Cogent Communications, LLC1 IPs18
AS14061 DigitalOcean, LLC1 IPs7
AS20473 The Constant Company, LLC1 IPs6
AS211443 Sino Worldwide Trading Limited1 IPs4
AS8075 Microsoft Corporation1 IPs4
AS215930 Cipher Operations Doo Beograd - Novi Beograd1 IPs3
AS399629 BL Networks1 IPs3

Countries

US 10PL 5TH 5HK 5FR 3NL 2IN 2PH 2ID 1MA 1

Ports targeted

443/tcp 8539119/tcp 5664153/tcp 187001/tcp 185678/tcp 125985/tcp 1128080/tcp 102375/tcp 73128/tcp 64443/tcp 311434/tcp 32083/tcp 2

What it requests

GET/295
GET/wp-content/plugins/elementor-pro/readme.txt21
GET/wp-content/plugins/wp-fastest-cache/readme.txt20
GET/wp-content/plugins/duplicator/readme.txt20
GET/wp-content/plugins/litespeed-cache/readme.txt20
GET/wp-content/plugins/forminator/readme.txt20
GET/wp-content/plugins/updraftplus/readme.txt20
GET/wp-content/plugins/pixelyoursite/readme.txt20
GET/wp-content/plugins/wordpress-seo/readme.txt20
GET/wp-content/plugins/powerpress/readme.txt20
GET/wp-content/plugins/seo-by-rank-math/readme.txt20
GET/wp-content/plugins/mail-mint/readme.txt20

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.362 IPs804
Mozilla/5.0 (iPad; CPU OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.11 IPs94
Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.144 Mobile Safari/537.361 IPs93
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_3_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.151 IPs78
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.01 IPs77
Source IPCCNetwork Last seenEvents
46.16.34.21AS0 Alexhost Srl2026-09-08802
147.139.204.195AS0 Alibaba (US) Technology Co., Ltd.2026-09-10566
104.28.238.128AS0 Cloudflare, Inc.2026-09-1818
91.124.17.36AS0 Cogent Communications, LLC2026-09-0718
159.89.88.24AS0 DigitalOcean, LLC2026-09-217
51.159.107.12AS0 Scaleway SAS2026-09-086
151.115.100.39AS0 Scaleway SAS2026-09-066
151.115.99.198AS0 Scaleway SAS2026-09-096
151.115.90.238AS0 Scaleway SAS2026-09-116
62.210.198.206AS0 Scaleway SAS2026-09-236
151.115.100.30AS0 Scaleway SAS2026-09-176
151.115.99.180AS0 Scaleway SAS2026-09-166
136.244.81.109AS0 The Constant Company, LLC2026-09-156
62.210.198.215AS0 Scaleway SAS2026-09-116
91.92.41.55AS0 Sino Worldwide Trading Limited2026-09-014
20.106.228.98AS0 Microsoft Corporation2026-09-124
62.60.130.247AS0 Cipher Operations Doo Beograd - Novi Beograd2026-09-223
206.188.197.97AS0 BL Networks2026-09-153
13.208.248.92AS0 Amazon.com, Inc.2026-08-273
152.52.78.232AS0 BHARTI Airtel Ltd.2026-09-022

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.