HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13i3112h1_e8f1e7e78f70_d339722ba4af

Seen 2026-02-20 to 2026-09-16 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14061 sends an email when it next hits a sensor.

45

Source IPs

2

Networks

5

Countries

7

Ports hit

2.1K

Events

22

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS14061 DigitalOcean, LLC28 IPs1.1K
AS63949 Akamai Connected Cloud17 IPs972

Countries

US 38CA 4DE 1GB 1AU 1

Ports targeted

4443/tcp 5764433/tcp 4744444/tcp 4748443/tcp 315443/tcp 2465986/tcp 810443/tcp 3

What it requests

GET/wsman34
GET/php/ztp_gate.php/.js.map29
GET/28
GET/Login/Login27
GET/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=%2BCSCOE%2B/portal_inc.lua27
GET/.env27
GET/AHT/AHT_UI/public/js/app.min.js27
GET/admin27
GET/CACHE/sdesktop/install/start.htm27
GET/api/v2/cmdb/system/admin27
GET/.idea/WebServers.xml27
GET/Login.jsp27

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.3641 IPs2.1K
python-urllib3/2.7.04 IPs4
Source IPCCNetwork Last seenEvents
165.227.82.20AS0 DigitalOcean, LLC2026-09-1680
138.68.10.54AS0 DigitalOcean, LLC2026-09-1579
143.244.153.58AS0 DigitalOcean, LLC2026-09-1579
165.227.23.54AS0 DigitalOcean, LLC2026-09-1579
138.197.173.137AS0 DigitalOcean, LLC2026-09-1279
159.223.185.62AS0 DigitalOcean, LLC2026-09-1579
138.68.237.131AS0 DigitalOcean, LLC2026-09-1279
45.79.143.112AS0 Akamai Connected Cloud2026-09-1579
68.183.29.251AS0 DigitalOcean, LLC2026-09-1279
45.79.40.217AS0 Akamai Connected Cloud2026-08-2579
142.93.10.66AS0 DigitalOcean, LLC2026-09-1679
172.104.240.74AS0 Akamai Connected Cloud2026-09-1579
45.79.114.208AS0 Akamai Connected Cloud2026-08-2679
159.223.158.149AS0 DigitalOcean, LLC2026-08-2579
97.107.137.245AS0 Akamai Connected Cloud2026-09-1679
173.255.206.220AS0 Akamai Connected Cloud2026-09-1679
159.223.163.165AS0 DigitalOcean, LLC2026-08-2679
50.116.19.67AS0 Akamai Connected Cloud2026-08-2579
167.172.205.210AS0 DigitalOcean, LLC2026-08-2579
74.207.241.92AS0 Akamai Connected Cloud2026-08-2579

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.