HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13i3012h2_1d37bd780c83_8537cf56674e

Seen 2026-06-17 to 2026-09-28 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS10439 sends an email when it next hits a sensor.

22

Source IPs

7

Networks

3

Countries

155

Ports hit

1.3K

Events

3

IPs / network

Top networks

AS10439 CariNet, Inc.11 IPs890
AS50219 Valence Technology Co.6 IPs385
AS36352 HostPapa1 IPs24
AS38365 Beijing Baidu Netcom Science and Technology Co., Ltd.1 IPs16
AS31898 Oracle Corporation1 IPs16
AS401626 Netiface America, Inc.1 IPs1
AS17816 China Unicom IP network China169 Guangdong province1 IPs1

Countries

US 19CN 2SG 1

Ports targeted

443/tcp 314500/tcp 158080/tcp 15445/tcp 153000/tcp 149092/tcp 1349152/tcp 137002/tcp 128443/tcp 122202/tcp 128889/tcp 125800/tcp 12

What it requests

GET/favicon.ico1.3K
GET/56
GET/login?redir=%2F1
POST/api2/json/access/ticket1

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.3617 IPs1.2K
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.3614 IPs92
curl/8.14.15 IPs58
Source IPCCNetwork Last seenEvents
216.226.77.10USAS50219 Valence Technology Co.2026-09-28133
71.6.134.237USAS10439 CariNet, Inc.2026-09-28114
71.6.134.231USAS10439 CariNet, Inc.2026-09-28108
216.226.77.30USAS50219 Valence Technology Co.2026-09-28106
216.226.77.20USAS50219 Valence Technology Co.2026-09-28105
71.6.134.236USAS10439 CariNet, Inc.2026-09-28105
71.6.134.232USAS10439 CariNet, Inc.2026-09-2895
71.6.134.233USAS10439 CariNet, Inc.2026-09-2895
71.6.134.204USAS10439 CariNet, Inc.2026-09-2872
71.6.134.228USAS10439 CariNet, Inc.2026-09-2869
71.6.134.235USAS10439 CariNet, Inc.2026-09-2861
71.6.134.234USAS10439 CariNet, Inc.2026-09-2859
71.6.134.230USAS10439 CariNet, Inc.2026-09-2457
71.6.134.229USAS10439 CariNet, Inc.2026-09-2855
67.215.253.71USAS36352 HostPapa2026-09-2524
216.226.78.30USAS50219 Valence Technology Co.2026-09-2818
140.245.52.216SGAS31898 Oracle Corporation2026-09-2416
180.76.97.126CNAS38365 Beijing Baidu Netcom Science and Technology Co., Ltd.2026-09-2116
216.226.78.20USAS50219 Valence Technology Co.2026-09-2812
216.226.78.10USAS50219 Valence Technology Co.2026-09-2811

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.