Cohort …b416941b943d_a92d258e848d
39 hosts listed upstream across 19 networks presented certificates cut from the same template on the same day — the same JA4X, the same issuer name and the same not-before date. This archive holds 40 hosts whose certificates match that template, across 19 networks — listed and archived alike, so the two counts are not the same population.
2166164053c1_2166164053c1_000000000000_b416941b943d_a92d258e848d
Read this first
Kinship, not attribution. The hosts in a cohort were provisioned from one certificate-issuance template: the same generator, run the same way, on the same day. That is consistent with one operator running several servers — and equally with several customers of one panel provider whose generator stamps every tenant’s certificate identically. HOLLOWPOINT measures roughly 130–180 of its 591 master hosts as customer certificates sitting in operator IP space (as measured September 2026). Treat a cohort as a set of hosts to investigate together, never as a statement about who runs them.
Template
A JA4X fingerprint hashes a certificate’s distinguished-name fields in order, and many unrelated deployments of one tool share it. A cohort narrows that to certificates that also name the same issuer and were issued on the same day — the signature of one issuance step run once for several hosts. It links tooling and provisioning, not people.
Members in this archive · 40
Joined from this archive’s own records — the same template, issuer name and not-before day — so every address below is one the archive holds and stands behind. Archived addresses are included and marked.
Listed in error?
These pages are generated from automated scanning and are publicly available. Write to support@publicmosaic.com — see abuse & takedown, or opt-out to exclude a network range from scanning.