HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsAEI IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4H HTTP client fingerprint

ge11nn0400_88d30a62b7ad

Seen 2026-02-19 to 2026-09-02 across the retained window.

Open in lookup →

5.8K

Source IPs

121

Networks

46

Countries

40.3K

Ports hit

573.9K

Events

48

IPs / network

Top networks

AS8075 Microsoft Corporation2.4K IPs6.5K
AS6939 Hurricane Electric LLC743 IPs94.8K
AS14061 DigitalOcean, LLC453 IPs96.9K
AS14618 Amazon.com, Inc.299 IPs2.5K
AS398324 Censys, Inc.270 IPs95.5K
AS396982 Google LLC259 IPs49.6K
AS45102 Alibaba (US) Technology Co., Ltd.215 IPs535
AS211680 Sistemas Informaticos, S.A.214 IPs5.0K
AS21859 Zenlayer Inc157 IPs4.3K
AS398722 Censys, Inc.128 IPs15.1K
AS63949 Akamai Connected Cloud96 IPs4.0K
AS16509 Amazon.com, Inc.90 IPs72.4K

Countries

US 4.7KPT 371SG 163DE 145CA 94FR 76NL 48CN 37JP 36MN 27

Ports targeted

443/tcp 11.2K80/tcp 8.2K3000/tcp 4.6K9090/tcp 3.8K8080/tcp 3.7K8443/tcp 3.5K5000/tcp 3.0K9200/tcp 2.5K5678/tcp 2.5K9443/tcp 2.5K4443/tcp 2.3K8888/tcp 2.3K

What it requests

GET/213.1K
GET/squid-internal-mgr/cachemgr.cgi94.0K
GET/favicon.ico29.5K
GET/login13.0K
GET/robots.txt12.1K
GET/.well-known/security.txt11.0K
GET/sitemap.xml10.7K
GET/security.txt9.9K
GET/wiki9.8K
GET/manage/account/login4.7K
GET/admin/index.html4.3K
GET/api/v2/static/not.found4.2K

User agents claimed

Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)414 IPs176.2K
Mozilla/5.0 zgrab/0.x2.7K IPs102.8K
visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.3688 IPs72.4K
Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)281 IPs56.5K
Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)92 IPs12.6K
Source IPCCNetwork Last seenEvents
18.218.118.203USAS16509 Amazon.com, Inc.2026-09-0215.8K
3.129.187.38USAS16509 Amazon.com, Inc.2026-09-0215.4K
18.116.101.220USAS16509 Amazon.com, Inc.2026-09-0214.9K
3.130.168.2USAS16509 Amazon.com, Inc.2026-09-0212.8K
137.184.24.227USAS14061 DigitalOcean, LLC2026-08-1711.6K
137.184.230.32USAS14061 DigitalOcean, LLC2026-09-0211.1K
24.144.114.246USAS14061 DigitalOcean, LLC2026-08-3011.0K
159.223.91.211SGAS14061 DigitalOcean, LLC2026-08-2710.7K
146.190.25.255NLAS14061 DigitalOcean, LLC2026-08-0810.6K
159.203.61.235CAAS14061 DigitalOcean, LLC2026-08-1110.2K
143.244.191.173USAS14061 DigitalOcean, LLC2026-08-2710.2K
3.131.220.121USAS16509 Amazon.com, Inc.2026-09-0210.0K
167.71.215.225SGAS14061 DigitalOcean, LLC2026-08-249.5K
159.203.82.128USAS14061 DigitalOcean, LLC2026-08-058.0K
167.94.146.55USAS398705 Censys, Inc.2026-09-024.4K
167.94.146.52USAS398705 Censys, Inc.2026-09-024.3K
167.94.146.63USAS398705 Censys, Inc.2026-09-024.3K
167.94.146.57USAS398705 Censys, Inc.2026-09-024.2K
167.94.146.50USAS398705 Censys, Inc.2026-09-024.1K
167.94.146.59USAS398705 Censys, Inc.2026-09-024.1K

About this fingerprint

JA4H fingerprints the shape of an HTTP request: method, version, the ordered set of headers and the cookie and language handling. It identifies the HTTP client independently of the URL it asks for.