{
  "generated": "2026-10-30T18:37:43.766Z",
  "source": "https://publicmosaic.com",
  "tlp": "CLEAR",
  "scope": "template 5b6770778fe8_5b6770778fe8_f3465fcaa762 — https://publicmosaic.com/ja4x/5b6770778fe8_5b6770778fe8_f3465fcaa762",
  "caveat": "Combine with network scope. A JA4X names a certificate template, which everyone using the same tooling shares; a template seen on several families is a library default. discriminating: false marks singletons and multi-family templates. JA4X+ entries (template, issuer CN and not-before day) are a finer key.",
  "templates": [
    {
      "ja4x": "5b6770778fe8_5b6770778fe8_f3465fcaa762",
      "url": "/ja4x/5b6770778fe8_5b6770778fe8_f3465fcaa762",
      "hosts": 6,
      "listed": 6,
      "families": [
        "cobalt_strike"
      ],
      "networks": [
        45090,
        37963,
        153371
      ],
      "first_seen": "2026-10-26T06:18:41.368Z",
      "last_seen": "2026-10-30T03:08:54.798Z",
      "discriminating": true,
      "plus": [
        {
          "issuer_cn": "Major Cobalt Strike",
          "not_before_day": "2026-07-20",
          "hosts": 1,
          "listed": 1
        },
        {
          "issuer_cn": "Major Cobalt Strike",
          "not_before_day": "2026-07-22",
          "hosts": 1,
          "listed": 1
        },
        {
          "issuer_cn": "Major Cobalt Strike",
          "not_before_day": "2026-07-28",
          "hosts": 1,
          "listed": 1
        },
        {
          "issuer_cn": "Major Cobalt Strike",
          "not_before_day": "2026-08-13",
          "hosts": 1,
          "listed": 1
        },
        {
          "issuer_cn": "Major Cobalt Strike",
          "not_before_day": "2026-08-18",
          "hosts": 1,
          "listed": 1
        },
        {
          "issuer_cn": "Major Cobalt Strike",
          "not_before_day": "2026-10-13",
          "hosts": 1,
          "listed": 1
        }
      ]
    }
  ]
}