HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsAEI IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13i190800_9dc949149365_97f8aa674fd9

Seen 2026-02-19 to 2026-09-02 across the retained window.

Open in lookup →

2.0K

Source IPs

50

Networks

32

Countries

43.7K

Ports hit

557.1K

Events

40

IPs / network

Top networks

AS396982 Google LLC578 IPs9.0K
AS8075 Microsoft Corporation490 IPs600
AS14618 Amazon.com, Inc.285 IPs1.4K
AS398324 Censys, Inc.270 IPs122.9K
AS398722 Censys, Inc.128 IPs19.7K
AS209334 Modat B.V.94 IPs298.9K
AS14061 DigitalOcean, LLC24 IPs2.6K
AS398705 Censys, Inc.16 IPs87.5K
AS137409 GSL Networks Pty LTD12 IPs13
AS63199 CDS Global Cloud Co., Ltd8 IPs1.1K
AS197170 TechTies Inc.7 IPs136
AS9009 M247 Europe SRL5 IPs10

Countries

US 1.8KCA 75NL 21FR 21DE 10CN 6HK 5BR 3UA 3RO 2

Ports targeted

443/tcp 1.6K9090/tcp 1.3K4841/tcp 9001962/tcp 9001963/tcp 8744839/tcp 8501961/tcp 8274840/tcp 8209200/tcp 79018789/tcp 72444818/tcp 66918245/tcp 663

What it requests

GET/125.0K
GET/robots.txt10.5K
GET/.well-known/security.txt10.0K
GET/sitemap.xml9.9K
GET/wiki9.8K
GET/security.txt9.7K
GET/login9.6K
GET/favicon.ico1.0K
GET/llms.txt326
POST/wsman203
GET/version200
POST/ipp168

User agents claimed

Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)414 IPs175.4K
Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity572 IPs8.8K
Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)85 IPs3.7K
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4 240.111 Safari/537.369 IPs1.6K
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36285 IPs1.4K
Source IPCCNetwork Last seenEvents
85.217.149.2CAAS209334 Modat B.V.2026-09-027.8K
31.14.32.4NLAS201401 NewVM B.V.2026-09-027.3K
85.217.149.22CAAS209334 Modat B.V.2026-09-027.2K
85.217.149.1CAAS209334 Modat B.V.2026-09-027.0K
85.217.149.33CAAS209334 Modat B.V.2026-09-027.0K
85.217.149.3CAAS209334 Modat B.V.2026-09-026.9K
85.217.149.15CAAS209334 Modat B.V.2026-09-026.8K
85.217.149.13CAAS209334 Modat B.V.2026-09-026.8K
85.217.149.28CAAS209334 Modat B.V.2026-09-026.6K
85.217.149.18CAAS209334 Modat B.V.2026-09-026.6K
85.217.149.5CAAS209334 Modat B.V.2026-09-026.5K
85.217.149.17CAAS209334 Modat B.V.2026-09-026.5K
85.217.149.19CAAS209334 Modat B.V.2026-09-026.5K
85.217.149.9CAAS209334 Modat B.V.2026-09-026.4K
85.217.149.8CAAS209334 Modat B.V.2026-09-026.2K
85.217.149.6CAAS209334 Modat B.V.2026-09-026.1K
85.217.149.30CAAS209334 Modat B.V.2026-09-025.9K
167.94.146.55USAS398705 Censys, Inc.2026-09-025.9K
85.217.149.32CAAS209334 Modat B.V.2026-09-025.9K
85.217.149.12CAAS209334 Modat B.V.2026-09-025.8K

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.