HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13i3111h2_e8f1e7e78f70_b26ce05bbdd6

Seen 2026-02-19 to 2026-10-15 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS50219 sends an email when it next hits a sensor.

20

Source IPs

8

Networks

8

Countries

158

Ports hit

1.5K

Events

2

IPs / network

Top networks

AS50219 Valence Technology Co.6 IPs555
AS14061 DigitalOcean, LLC5 IPs66
AS32475 Internap Holding LLC3 IPs276
AS132203 Tencent Building, Kejizhongyi Avenue2 IPs11
AS48090 Techoff Srv Limited1 IP539
AS198610 Beget LLC1 IP8
AS135905 VIETNAM POSTS AND TELECOMMUNICATIONS GROUP1 IP2
AS400619 AROSSCLOUD INC.1 IP1

Countries

US 10SG 4BG 1RU 1DE 1CN 1VN 1SC 1

Ports targeted

8161/tcp 3543306/tcp 1213000/tcp 72446/tcp 47443/tcp 382022/tcp 11989/tcp 10135/tcp 108088/tcp 1010250/tcp 104321/tcp 109090/tcp 9

What it requests

GET/favicon.ico831
GET/12
GET/v1/models8
GET/login.php6
GET/agc/vicidial.php5
GET/valid8.php5
GET/RECORDINGS/5
GET/server-status5
GET/agc/5
GET/vicidial/admin.php4
GET/env.json4
GET/.env.test4

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.369 IPs831
curl/8.5.04 IPs556
Mozilla/5.0 (Windows NT 10.0; Win64; x64)4 IPs62
Mozilla/5.02 IPs6
Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/1311 IP3
Source IPCCNetwork Last seenEvents
93.123.109.214BGAS48090 Techoff Srv Limited2026-09-25539
216.226.76.30USAS50219 Valence Technology Co.2026-10-14133
203.55.131.5USAS32475 Internap Holding LLC2026-10-14111
203.55.131.4USAS32475 Internap Holding LLC2026-10-14102
194.164.107.4USAS50219 Valence Technology Co.2026-10-14101
216.226.76.10USAS50219 Valence Technology Co.2026-10-14100
194.164.107.5USAS50219 Valence Technology Co.2026-10-1497
216.226.76.20USAS50219 Valence Technology Co.2026-10-1493
203.55.131.3USAS32475 Internap Holding LLC2026-09-3063
139.59.250.28SGAS14061 DigitalOcean, LLC2026-10-1331
194.164.107.6USAS50219 Valence Technology Co.2026-09-1831
159.223.48.115SGAS14061 DigitalOcean, LLC2026-09-2314
165.245.177.51SGAS14061 DigitalOcean, LLC2026-09-219
109.172.37.101RUAS198610 Beget LLC2026-09-248
170.106.117.80USAS132203 Tencent Building, Kejizhongyi Avenue2026-09-278
159.223.40.14SGAS14061 DigitalOcean, LLC2026-09-308
207.154.239.168DEAS14061 DigitalOcean, LLC2026-10-094
161.120.186.93CNAS132203 Tencent Building, Kejizhongyi Avenue2026-10-153
103.226.250.98VNAS135905 VIETNAM POSTS AND TELECOMMUNICATIONS GROUP2026-09-192
156.239.42.225SCAS400619 AROSSCLOUD INC.2026-09-271

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.