cert serial (decimal)15703083208084145031921691513920168179032456111
cert names*.lala1.latlala1.lat
The certificate names above were validated by the issuing authority at issuance. They describe the certificate, not conduct by the names' owner — a legitimately issued certificate can be deployed on a listed host by whoever holds its private key, so treat the name as a pivot to investigate rather than as an attribution.
cert serial (decimal)15703083208084145031921691513920168179032456111
cert names*.lala1.latlala1.lat
The certificate names above were validated by the issuing authority at issuance. They describe the certificate, not conduct by the names' owner — a legitimately issued certificate can be deployed on a listed host by whoever holds its private key, so treat the name as a pivot to investigate rather than as an attribution.
callbackcf.lala1.lat · operator-supplied; a redirector or impersonation target, not an attribution
beacon typeHTTPS
cs versionCobalt Strike 4.9 (Sep 19, 2023)
getGET /api/v1/get
postPOST /api/v1/post
user-agentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sleep15s ±45%
watermark666666666
server key md581e53a532f0b1910957a4f2dc3b87fd3
inject stube781a4479f7c5a03b2dcfe4bd436366f
spawn to x86%allusersprofile%\CrashReport\CrashReport.exe
spawn to x64%allusersprofile%\CrashReport\CrashReport64.exe
Observation history
18d agotoday
Observed on 18 of the 18 days since this archive began recording, 2026-08-29 UTC. Presence is per UTC day: a day is marked when the scanner confirmed this address at least once, not once per scan.
Shared JA4X issuance template · 1 host
These hosts issued certificates from the same template — the same distinguished-name
fields hashed in the same order. It links tooling, not necessarily an operator. Full cohort →
A watermark identifies the Cobalt Strike licence a beacon was generated from. Hosts sharing
one were built from the same copy of the software — which is not the same as one operator,
since cracked and leaked builds circulate widely and share a watermark by definition.
This page is generated from automated scanning and is publicly available. If you
are responsible for this address and it should not be listed, write to
support@publicmosaic.com —
see abuse & takedown for what we need and what happens next, or
opt-out to exclude a whole range from scanning.
Addresses are frequently compromised third-party hosts rather than
infrastructure their owner stood up. A listing records what a scan observed at a point in
time; it is not an allegation about whoever pays for the address.