HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13i1909h1_9dc949149365_97f8aa674fd9

Seen 2026-02-19 to 2026-09-24 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS396982 sends an email when it next hits a sensor.

382

Source IPs

7

Networks

11

Countries

858

Ports hit

25.9K

Events

55

IPs / network

Top networks

AS396982 Google LLC249 IPs23.2K
AS21859 Zenlayer Inc54 IPs65
AS211680 Sistemas Informaticos, S.A.38 IPs56
AS12876 Scaleway SAS31 IPs2.6K
AS14061 DigitalOcean, LLC8 IPs8
AS680 Verein zur Foerderung eines Deutschen Forschungsnetzes e.V.1 IPs4
AS400950 nulled LLC1 IPs2

Countries

US 251PT 92FR 31DE 1IN 1GB 1NL 1SG 1CA 1AU 1

Ports targeted

80/tcp 7198080/tcp 26385/tcp 21781/tcp 20817000/tcp 18225461/tcp 1618880/tcp 159443/tcp 1483030/tcp 9211401/tcp 868853/tcp 843500/tcp 83

What it requests

GET/2.5K
GET/manage/account/login2.1K
GET/admin/index.html1.9K
GET/index.html1.8K
GET/+CSCOE+/logon.html1.7K
GET/cgi-bin/login.cgi1.7K
GET/login.htm1.6K
GET/login.html1.6K
GET/login.jsp1.5K
GET/login1.5K
GET/doc/index.html1.4K
GET/remote/login1.4K

User agents claimed

Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)280 IPs25.8K
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.3692 IPs121
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.08 IPs8
Mozilla/5.0 zgrab/0.x1 IPs4
Mozilla/5.0 (compatible; idxd/1.0; +https://idxd.io/)1 IPs2
Source IPCCNetwork Last seenEvents
62.210.142.159AS0 Scaleway SAS2026-09-19304
216.180.246.35AS0 Google LLC2026-09-21273
62.210.142.172AS0 Scaleway SAS2026-09-23272
216.180.246.218AS0 Google LLC2026-09-19230
216.180.246.119AS0 Google LLC2026-09-20220
216.180.246.62AS0 Google LLC2026-09-21215
216.180.246.106AS0 Google LLC2026-09-21210
62.210.142.168AS0 Scaleway SAS2026-09-19208
51.159.125.200AS0 Scaleway SAS2026-09-19208
216.180.246.101AS0 Google LLC2026-09-24200
216.180.246.68AS0 Google LLC2026-09-19199
216.180.246.104AS0 Google LLC2026-09-19196
216.180.246.90AS0 Google LLC2026-09-24195
62.210.142.166AS0 Scaleway SAS2026-09-19192
216.180.246.158AS0 Google LLC2026-09-24186
216.180.246.212AS0 Google LLC2026-09-19184
216.180.246.102AS0 Google LLC2026-09-20179
216.180.246.220AS0 Google LLC2026-09-19175
216.180.246.77AS0 Google LLC2026-09-23174
216.180.246.213AS0 Google LLC2026-09-19173

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.