HoneyLabs

JA4 TLS client fingerprint

t13i1909h2_9dc949149365_97f8aa674fd9

Seen 2026-02-19 to 2026-07-27 across the retained window.

2.5K

Source IPs

52

Networks

21

Countries

62.1K

Ports hit

449.6K

Events

48

IPs / network

Top networks

AS0 190 IPs64.1K

Countries

US 2.3KNL 44DE 41CN 40CA 13SG 9AU 7CH 7IN 6GB 5

Ports targeted

Source IPCCNetworkEvents
167.94.146.63USAS398705 Censys, Inc.10.1K
167.94.146.50USAS398705 Censys, Inc.10.1K
167.94.146.59USAS398705 Censys, Inc.10.0K
167.94.146.55USAS398705 Censys, Inc.10.0K
167.94.146.56USAS398705 Censys, Inc.10.0K
167.94.146.53USAS398705 Censys, Inc.10.0K
167.94.146.57USAS398705 Censys, Inc.10.0K
167.94.146.58USAS398705 Censys, Inc.9.9K
167.94.146.54USAS398705 Censys, Inc.9.8K
167.94.146.52USAS398705 Censys, Inc.9.8K
167.94.146.51USAS398705 Censys, Inc.9.8K
167.94.146.48USAS398705 Censys, Inc.9.8K
167.94.146.49USAS398705 Censys, Inc.9.8K
167.94.146.62USAS398705 Censys, Inc.9.7K
167.94.146.61USAS398705 Censys, Inc.9.7K
167.94.146.60USAS398705 Censys, Inc.9.7K
16.58.56.214USAS16509 Amazon.com, Inc.6.1K
18.116.101.220USAS16509 Amazon.com, Inc.5.8K
18.218.118.203USAS16509 Amazon.com, Inc.5.1K
3.129.187.38USAS16509 Amazon.com, Inc.4.1K

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.