HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13i4311h1_c7886603b240_b26ce05bbdd6

Seen 2026-02-19 to 2026-09-24 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS400619 sends an email when it next hits a sensor.

21

Source IPs

10

Networks

11

Countries

4

Ports hit

614

Events

2

IPs / network

Top networks

AS400619 AROSSCLOUD INC.10 IPs20
AS14061 DigitalOcean, LLC2 IPs10
AS4134 Chinanet2 IPs4
AS139952 PT Trisari Data Indonusa1 IPs567
AS16276 OVH SAS1 IPs6
AS26496 GoDaddy.com, LLC1 IPs2
AS50053 Anton Levin1 IPs2
AS25820 IT7 Networks Inc1 IPs1
AS51167 Contabo GmbH1 IPs1
AS207043 Dedik Services Limited1 IPs1

Countries

HK 5CL 4SG 2US 2CN 2ID 1AU 1NL 1SC 1DE 1

Ports targeted

443/tcp 6042087/tcp 810443/tcp 111434/tcp 1

What it requests

HEAD/19
GET/.git/config11
GET/api/10
POST/login/?login_only=14
GET/openid_connect/cpanelid4
GET/.env3
GET/config/database.yml3
GET/favicon.ico2
GET/secrets.json2
GET/.aws/config2
GET/.aws/credentials2
GET/application.properties2

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.361 IPs559
Mozilla/5.011 IPs21
python-requests/2.25.14 IPs15
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.363 IPs12
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:52.0) Gecko/20100101 Firefox/52.02 IPs2
Source IPCCNetwork Last seenEvents
203.175.125.156AS0 PT Trisari Data Indonusa2026-09-22567
168.144.175.77AS0 DigitalOcean, LLC2026-09-227
15.235.145.211AS0 OVH SAS2026-09-116
170.64.160.198AS0 DigitalOcean, LLC2026-09-223
148.66.135.237AS0 GoDaddy.com, LLC2026-09-222
191.124.126.225AS0 AROSSCLOUD INC.2026-08-292
191.124.126.14AS0 AROSSCLOUD INC.2026-08-302
191.124.7.190AS0 AROSSCLOUD INC.2026-08-312
154.211.7.220AS0 AROSSCLOUD INC.2026-08-292
183.36.35.198AS0 Chinanet2026-09-222
191.124.7.164AS0 AROSSCLOUD INC.2026-08-292
185.196.41.22AS0 Anton Levin2026-09-112
103.215.79.157AS0 AROSSCLOUD INC.2026-08-292
103.215.79.217AS0 AROSSCLOUD INC.2026-08-292
183.36.35.205AS0 Chinanet2026-09-182
191.124.7.206AS0 AROSSCLOUD INC.2026-08-292
103.215.79.229AS0 AROSSCLOUD INC.2026-08-292
191.124.126.207AS0 AROSSCLOUD INC.2026-08-292
164.68.123.123AS0 Contabo GmbH2026-08-281
2.27.248.95AS0 Dedik Services Limited2026-09-241

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.