HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13i2511h2_b78ed14e2fd0_ab7e3b40a677

Seen 2026-02-20 to 2026-09-18 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14061 sends an email when it next hits a sensor.

79

Source IPs

2

Networks

5

Countries

8

Ports hit

290

Events

40

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS14061 DigitalOcean, LLC46 IPs182
AS63949 Akamai Connected Cloud33 IPs108

Countries

US 64CA 6GB 4DE 4AU 1

Ports targeted

443/tcp 884443/tcp 56444/tcp 494433/tcp 428443/tcp 365986/tcp 86443/tcp 810443/tcp 3

What it requests

GET/60
GET/auth1.html29
GET/api/sonicos/tfa29
GET/auth.html29
GET/api/sonicos/auth29
GET/sslvpnLogin.html29
GET/sonicui/7/sslvpn-portal/29
POST/wsman12
GET/RDWeb4
GET/Remote4
GET/version4
GET/api/v1/pods4

User agents claimed

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.3679 IPs290
Source IPCCNetwork Last seenEvents
159.65.231.231AS0 DigitalOcean, LLC2026-09-158
165.22.160.189AS0 DigitalOcean, LLC2026-09-158
45.79.207.204AS0 Akamai Connected Cloud2026-09-088
173.255.192.58AS0 Akamai Connected Cloud2026-08-277
74.207.243.117AS0 Akamai Connected Cloud2026-09-047
45.33.64.166AS0 Akamai Connected Cloud2026-09-127
159.223.163.165AS0 DigitalOcean, LLC2026-09-157
138.197.206.208AS0 DigitalOcean, LLC2026-08-257
159.223.153.121AS0 DigitalOcean, LLC2026-08-257
206.189.181.188AS0 DigitalOcean, LLC2026-08-257
97.107.136.178AS0 Akamai Connected Cloud2026-09-157
159.89.128.182AS0 DigitalOcean, LLC2026-09-047
50.116.46.114AS0 Akamai Connected Cloud2026-09-157
139.177.194.216AS0 Akamai Connected Cloud2026-09-127
167.172.49.228AS0 DigitalOcean, LLC2026-08-277
192.241.136.162AS0 DigitalOcean, LLC2026-09-127
45.79.207.108AS0 Akamai Connected Cloud2026-08-257
143.244.147.79AS0 DigitalOcean, LLC2026-08-257
64.225.119.153AS0 DigitalOcean, LLC2026-08-257
167.99.98.18AS0 DigitalOcean, LLC2026-09-157

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.