HoneyLabs

JA4 TLS client fingerprint

t13i2013h2_a09f3c656075_14788d8d241b

Seen 2026-03-15 to 2026-07-27 across the retained window.

54

Source IPs

32

Networks

11

Countries

35

Ports hit

602

Events

2

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

Countries

US 16GB 14DE 9FR 5PL 4VE 1BR 1MD 1JM 1IT 1

Ports targeted

Source IPCCNetworkEvents
185.181.229.69MDAS60602 Inovare-Prim SRL341
104.167.25.34USAS200373 3xK Tech GmbH82
209.50.170.4USAS200373 3xK Tech GmbH42
65.111.13.80USAS200373 3xK Tech GmbH39
216.26.239.16BRAS200373 3xK Tech GmbH26
65.111.31.219FRAS200373 3xK Tech GmbH7
185.202.158.93DEAS42366 TerraTransit AG7
209.50.186.65ITAS200373 3xK Tech GmbH5
45.3.33.211USAS200373 3xK Tech GmbH4
185.177.72.130FRAS211590 Bucklog SARL2
185.177.72.158FRAS211590 Bucklog SARL2
185.177.72.152FRAS211590 Bucklog SARL2
185.177.72.143FRAS211590 Bucklog SARL2
82.11.163.43GBAS5089 Virgin Media1
94.15.189.73GBAS5607 Sky UK Limited1
212.185.227.33DEAS3320 Deutsche Telekom AG1
51.179.205.37GBAS5482 AllPoints Fibre Limited1
51.190.108.2GBAS5607 Sky UK Limited1
94.2.131.83GBAS5607 Sky UK Limited1
75.210.52.242USAS6167 Verizon Business1

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.