HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13i871000_c66346c74e42_24695f2957a7

Seen 2026-02-23 to 2026-09-22 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14061 sends an email when it next hits a sensor.

27

Source IPs

4

Networks

3

Countries

4

Ports hit

33

Events

7

IPs / network

Top networks

AS14061 DigitalOcean, LLC13 IPs13
AS63949 Akamai Connected Cloud13 IPs13
AS219502 Storm Industries LLC1 IPs5
Unattributed1 IPs2

Countries

US 23CA 3NL 1

Ports targeted

27017/tcp 1620128/tcp 75671/tcp 628015/tcp 4

What it requests

GET/login7

User agents claimed

9router/1.01 IPs7
Source IPCCNetwork Last seenEvents
94.154.43.43AS0 Storm Industries LLC2026-09-167
157.245.191.129AS0 DigitalOcean, LLC2026-09-141
104.248.185.225AS0 DigitalOcean, LLC2026-09-221
96.126.102.165AS0 Akamai Connected Cloud2026-09-211
66.228.32.20AS0 Akamai Connected Cloud2026-08-311
96.126.96.230AS0 Akamai Connected Cloud2026-09-141
192.53.123.32AS0 Akamai Connected Cloud2026-09-221
45.33.11.246AS0 Akamai Connected Cloud2026-08-301
69.164.199.185AS0 Akamai Connected Cloud2026-08-301
138.197.157.0AS0 DigitalOcean, LLC2026-09-211
157.245.187.15AS0 DigitalOcean, LLC2026-09-021
134.209.60.115AS0 DigitalOcean, LLC2026-09-211
137.184.143.217AS0 DigitalOcean, LLC2026-08-311
137.184.132.77AS0 DigitalOcean, LLC2026-09-141
165.22.182.106AS0 DigitalOcean, LLC2026-09-071
64.227.55.171AS0 DigitalOcean, LLC2026-09-071
74.207.254.27AS0 Akamai Connected Cloud2026-08-301
167.71.114.153AS0 DigitalOcean, LLC2026-09-021
173.255.192.234AS0 Akamai Connected Cloud2026-08-301
142.93.58.150AS0 DigitalOcean, LLC2026-09-021

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.