HoneyLabs
Lookup
Explore
CVEsPayloadsCampaignsAEI IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / Enrich
DocsBlog
Dashboard

JA4H HTTP client fingerprint

ge11nn0200_5594a17e7e7e

Seen 2026-05-04 to 2026-07-15 across the retained window.

Open in lookup →

189

Source IPs

1

Networks

1

Countries

1

Ports hit

252

Events

189

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS396982 Google LLC189 IPs252

Countries

US 189

Ports targeted

5984/tcp 252
Source IPCCNetworkEvents
147.185.132.126USAS396982 Google LLC4
205.210.31.240USAS396982 Google LLC3
205.210.31.249USAS396982 Google LLC3
198.235.24.38USAS396982 Google LLC3
205.210.31.200USAS396982 Google LLC3
205.210.31.173USAS396982 Google LLC3
205.210.31.166USAS396982 Google LLC3
205.210.31.206USAS396982 Google LLC3
205.210.31.227USAS396982 Google LLC3
205.210.31.235USAS396982 Google LLC2
205.210.31.230USAS396982 Google LLC2
205.210.31.71USAS396982 Google LLC2
205.210.31.251USAS396982 Google LLC2
205.210.31.212USAS396982 Google LLC2
147.185.132.159USAS396982 Google LLC2
147.185.132.81USAS396982 Google LLC2
205.210.31.167USAS396982 Google LLC2
205.210.31.44USAS396982 Google LLC2
205.210.31.216USAS396982 Google LLC2
198.235.24.116USAS396982 Google LLC2

About this fingerprint

JA4H fingerprints the shape of an HTTP request: method, version, the ordered set of headers and the cookie and language handling. It identifies the HTTP client independently of the URL it asks for.