Cohort …b936f4a6b450_ebaf4b33e75f
3 hosts listed upstream across 2 networks presented certificates cut from the same template on the same day — the same JA4X, the same issuer name and the same not-before date. This archive holds 3 hosts whose certificates match that template, across 2 networks — listed and archived alike, so the two counts are not the same population.
0b479b1b5763_0b479b1b5763_e9d2b55797df_b936f4a6b450_ebaf4b33e75f
Read this first
Kinship, not attribution. The hosts in a cohort were provisioned from one certificate-issuance template: the same generator, run the same way, on the same day. That is consistent with one operator running several servers — and equally with several customers of one panel provider whose generator stamps every tenant’s certificate identically. HOLLOWPOINT measures roughly 130–180 of its 591 master hosts as customer certificates sitting in operator IP space (as measured September 2026). Treat a cohort as a set of hosts to investigate together, never as a statement about who runs them.
Template
A JA4X fingerprint hashes a certificate’s distinguished-name fields in order, and many unrelated deployments of one tool share it. A cohort narrows that to certificates that also name the same issuer and were issued on the same day — the signature of one issuance step run once for several hosts. It links tooling and provisioning, not people.
Members in this archive · 3
Joined from this archive’s own records — the same template, issuer name and not-before day — so every address below is one the archive holds and stands behind. Archived addresses are included and marked.
Listed in error?
These pages are generated from automated scanning and are publicly available. Write to support@publicmosaic.com — see abuse & takedown, or opt-out to exclude a network range from scanning.