{
  "field": "endpoint",
  "label": "endpoint",
  "value": "101.96.253.28:443",
  "page": "https://publicmosaic.com/config/endpoint/MTAxLjk2LjI1My4yODo0NDM",
  "generated": "2026-10-30T20:37:43.901Z",
  "tlp": "CLEAR",
  "note": "A shared configuration value is not evidence of a single operator.",
  "samples_total": 3,
  "hosts_total": 1,
  "samples": [
    {
      "sha256": "cd41ef7cdda6cc915aa7a67aa143f2adc0e8a5bcd8d0f930432450a97ceabed9",
      "family": "vshell",
      "provenance": "file analysis",
      "last_seen": "2026-10-05T13:43:19.077946+00:00",
      "served_by": [
        "101.96.253.28:443"
      ]
    },
    {
      "sha256": "f4e305591dc5e5f3b49117069dfc4fb789dc3e8739bd37bbe54b84dd1d7915b5",
      "family": "vshell",
      "provenance": "file analysis",
      "last_seen": "2026-10-05T13:43:17.446052+00:00",
      "served_by": [
        "101.96.253.28:443"
      ]
    },
    {
      "sha256": "e21dc23ef1289ba4051c44aa2b0393adcf07f3e3be4db1676c4bb34343c688f5",
      "family": "vshell",
      "provenance": "file analysis",
      "last_seen": "2026-10-05T13:43:16.177085+00:00",
      "served_by": [
        "101.96.253.28:443"
      ]
    }
  ],
  "hosts": [
    {
      "ip": "101.96.253.28",
      "ports": [
        443
      ],
      "still_listed": true,
      "family": "quasar_rat",
      "asn": 137718,
      "last_seen": "2026-10-30T00:19:58.221Z"
    }
  ]
}