HoneyLabs

JA4 TLS client fingerprint

t13i3111h2_e8f1e7e78f70_b26ce05bbdd6

Seen 2026-02-19 to 2026-07-27 across the retained window.

41

Source IPs

20

Networks

11

Countries

194

Ports hit

5.4K

Events

2

IPs / network

Top networks

Countries

US 21GB 4RU 3DE 3AR 3UA 2FR 1PL 1BG 1SG 1

Ports targeted

Source IPCCNetworkEvents
167.86.68.175DEAS51167 Contabo GmbH774
194.164.107.6USAS50219 Valence Technology Co.534
194.164.107.5USAS50219 Valence Technology Co.508
194.164.107.4USAS50219 Valence Technology Co.492
203.55.131.3USAS32475 Internap Holding LLC483
203.55.131.5USAS32475 Internap Holding LLC416
80.87.206.251RUAS16276 OVH SAS405
203.55.131.4USAS32475 Internap Holding LLC356
216.226.76.30USAS50219 Valence Technology Co.319
216.226.76.20USAS50219 Valence Technology Co.303
216.226.76.10USAS50219 Valence Technology Co.268
20.9.240.150USAS8075 Microsoft Corporation142
157.245.56.210SGAS14061 DigitalOcean, LLC87
93.123.109.214BGAS48090 Techoff Srv Limited76
92.63.197.197UAAS211736 FOP Dmytro Nedilskyi41
34.136.212.158USAS396982 Google LLC40
80.87.206.72RUAS16276 OVH SAS27
57.129.48.19DEAS16276 OVH SAS12
173.212.223.121FRAS51167 Contabo GmbH11
35.254.134.5USAS396982 Google LLC9

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.