HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13i191000_9dc949149365_e5728521abd4

Seen 2026-02-19 to 2026-09-24 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14061 sends an email when it next hits a sensor.

202

Source IPs

36

Networks

19

Countries

100

Ports hit

8.8K

Events

6

IPs / network

Top networks

AS14061 DigitalOcean, LLC96 IPs712
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED19 IPs23
AS204428 SS-Net14 IPs212
AS9465 AGOTOZ PTE. LTD.14 IPs16
AS4808 China Unicom Beijing Province Network12 IPs16
AS31898 Oracle Corporation8 IPs36
AS48090 Techoff Srv Limited3 IPs1.6K
AS197769 VPS Dedicated LLC3 IPs958
AS60781 LeaseWeb Netherlands B.V.3 IPs3
AS4837 CHINA UNICOM China169 Backbone2 IPs8
AS4811 China Telecom (Group)2 IPs4
AS8075 Microsoft Corporation2 IPs4

Countries

DE 97HK 30CN 18US 15RO 14IN 4NL 4BG 3SI 3RU 3

Ports targeted

443/tcp 2.4K80/tcp 1.7K8080/tcp 1.2K8000/tcp 7528888/tcp 4148443/tcp 2126443/tcp 1619443/tcp 1168088/tcp 11410250/tcp 852443/tcp 614431/tcp 60

What it requests

GET/1.5K
GET/remote/login?lang=en212
GET/.git/config173
GET/global-protect/login.esp117
GET/+CSCOE+/logon.html117
GET/dana-na/auth/url_default/welcome.cgi117
GET/v1/.git/config99
GET/dashboard/.git/config98
GET/server/.git/config98
GET/dist/.git/config97
GET/media../.git/config97
GET/code/.git/config97

User agents claimed

l9explore/1.2.25 IPs6.4K
Go-http-client/1.1100 IPs1.7K
l9tcpid/v1.1.04 IPs138
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.019 IPs85
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.3612 IPs78
Source IPCCNetwork Last seenEvents
193.32.204.199AS0 Madina IT2026-09-144.7K
93.123.109.228AS0 Techoff Srv Limited2026-08-281.2K
102.220.160.201AS0 VPS Dedicated LLC2026-09-10459
80.87.206.229AS0 OVH SAS2026-09-14399
102.220.160.200AS0 VPS Dedicated LLC2026-09-10308
93.123.109.234AS0 Techoff Srv Limited2026-09-03211
195.178.110.70AS0 Techoff Srv Limited2026-09-04205
102.220.160.199AS0 VPS Dedicated LLC2026-09-11191
80.94.95.101AS0 SS-Net2026-08-2553
80.94.95.112AS0 SS-Net2026-08-2545
80.94.95.187AS0 SS-Net2026-08-2538
167.99.140.99AS0 DigitalOcean, LLC2026-09-0926
142.93.104.231AS0 DigitalOcean, LLC2026-09-0519
164.90.173.183AS0 DigitalOcean, LLC2026-09-1818
157.230.100.204AS0 DigitalOcean, LLC2026-09-1518
153.80.240.58AS0 Global Connectivity Solutions Llp2026-09-1816
164.92.227.102AS0 DigitalOcean, LLC2026-09-1515
164.92.247.156AS0 DigitalOcean, LLC2026-09-2314
167.99.246.220AS0 DigitalOcean, LLC2026-09-1513
68.183.74.245AS0 DigitalOcean, LLC2026-09-0413

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.