#ja4 — Public Fediverse posts

I’m still completely lost with logic of JA4+ patent licensing and actual incompatibility with the copyleft-license. So it seems to be a patent-based license and really risky to implement if you want to keep your actual software open source.

Did someone explore alternatives to avoid this? and especially other format which are open source friendly?

#ja4 #ja3 #jarm #cti #opensource #patent #cti
#threatintel #cybersecurity

🔗 https://github.com/FoxIO-LLC/ja4/blob/main/License%20FAQ.md

We planned one report on Keitaro abuse, but we ran out of pages before we ran out of cases.
So here’s Part 2 of 3, a medley of threats that go well beyond AI‑investment scams.

Threat actors abuse Keitaro’s traffic distribution, cloaking, and rule engine to hide malicious landing pages behind geo and device-based filters. They stack bulletproof hosting and reverse proxies to add layers of indirection, making takedown and analysis harder. In this post, we share how we overcame this using multi‑protocol, multi‑vantage telemetry. We leveraged JA4+ web server fingerprints, DNS analytics, and Confiant’s visibility into advertising supply chain data to uncover Keitaro abuse and the delivery of malware downloaders, infostealers, weaponized RMMs, wallet drainer campaigns, scams, and email spam and advertising attack vectors.

If you hunt threats distributed via adtech, these indicators can be useful pivots. https://www.infoblox.com/blog/threat-intelligence/no-reach-no-risk-the-keitaro-abuse-in-modern-cybercrime-distribution/

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising #infostealer #rmm #remotemonitoringmanagement #downloader #malware #spam #airdrop #cryptocurrency #ja4 #ja4_fingerprinting

We planned one report on Keitaro abuse, but we ran out of pages before we ran out of cases.
So here’s Part 2 of 3, a medley of threats that go well beyond AI‑investment scams.

Threat actors abuse Keitaro’s traffic distribution, cloaking, and rule engine to hide malicious landing pages behind geo and device-based filters. They stack bulletproof hosting and reverse proxies to add layers of indirection, making takedown and analysis harder. In this post, we share how we overcame this using multi‑protocol, multi‑vantage telemetry. We leveraged JA4+ web server fingerprints, DNS analytics, and Confiant’s visibility into advertising supply chain data to uncover Keitaro abuse and the delivery of malware downloaders, infostealers, weaponized RMMs, wallet drainer campaigns, scams, and email spam and advertising attack vectors.

If you hunt threats distributed via adtech, these indicators can be useful pivots. https://www.infoblox.com/blog/threat-intelligence/no-reach-no-risk-the-keitaro-abuse-in-modern-cybercrime-distribution/

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising #infostealer #rmm #remotemonitoringmanagement #downloader #malware #spam #airdrop #cryptocurrency #ja4 #ja4_fingerprinting

We planned one report on Keitaro abuse, but we ran out of pages before we ran out of cases.
So here’s Part 2 of 3, a medley of threats that go well beyond AI‑investment scams.

Threat actors abuse Keitaro’s traffic distribution, cloaking, and rule engine to hide malicious landing pages behind geo and device-based filters. They stack bulletproof hosting and reverse proxies to add layers of indirection, making takedown and analysis harder. In this post, we share how we overcame this using multi‑protocol, multi‑vantage telemetry. We leveraged JA4+ web server fingerprints, DNS analytics, and Confiant’s visibility into advertising supply chain data to uncover Keitaro abuse and the delivery of malware downloaders, infostealers, weaponized RMMs, wallet drainer campaigns, scams, and email spam and advertising attack vectors.

If you hunt threats distributed via adtech, these indicators can be useful pivots. https://www.infoblox.com/blog/threat-intelligence/no-reach-no-risk-the-keitaro-abuse-in-modern-cybercrime-distribution/

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising #infostealer #rmm #remotemonitoringmanagement #downloader #malware #spam #airdrop #cryptocurrency #ja4 #ja4_fingerprinting

We planned one report on Keitaro abuse, but we ran out of pages before we ran out of cases.
So here’s Part 2 of 3, a medley of threats that go well beyond AI‑investment scams.

Threat actors abuse Keitaro’s traffic distribution, cloaking, and rule engine to hide malicious landing pages behind geo and device-based filters. They stack bulletproof hosting and reverse proxies to add layers of indirection, making takedown and analysis harder. In this post, we share how we overcame this using multi‑protocol, multi‑vantage telemetry. We leveraged JA4+ web server fingerprints, DNS analytics, and Confiant’s visibility into advertising supply chain data to uncover Keitaro abuse and the delivery of malware downloaders, infostealers, weaponized RMMs, wallet drainer campaigns, scams, and email spam and advertising attack vectors.

If you hunt threats distributed via adtech, these indicators can be useful pivots. https://www.infoblox.com/blog/threat-intelligence/no-reach-no-risk-the-keitaro-abuse-in-modern-cybercrime-distribution/

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising #infostealer #rmm #remotemonitoringmanagement #downloader #malware #spam #airdrop #cryptocurrency #ja4 #ja4_fingerprinting

We planned one report on Keitaro abuse, but we ran out of pages before we ran out of cases.
So here’s Part 2 of 3, a medley of threats that go well beyond AI‑investment scams.

Threat actors abuse Keitaro’s traffic distribution, cloaking, and rule engine to hide malicious landing pages behind geo and device-based filters. They stack bulletproof hosting and reverse proxies to add layers of indirection, making takedown and analysis harder. In this post, we share how we overcame this using multi‑protocol, multi‑vantage telemetry. We leveraged JA4+ web server fingerprints, DNS analytics, and Confiant’s visibility into advertising supply chain data to uncover Keitaro abuse and the delivery of malware downloaders, infostealers, weaponized RMMs, wallet drainer campaigns, scams, and email spam and advertising attack vectors.

If you hunt threats distributed via adtech, these indicators can be useful pivots. https://www.infoblox.com/blog/threat-intelligence/no-reach-no-risk-the-keitaro-abuse-in-modern-cybercrime-distribution/

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising #infostealer #rmm #remotemonitoringmanagement #downloader #malware #spam #airdrop #cryptocurrency #ja4 #ja4_fingerprinting

Анатомия DPI анализа: что происходит с твоим пакетом за первые 16 КБ

Пошаговый разбор того, как ТСПУ анализирует трафик — от первого SYN до поведенческого ML. С конкретными числами, реальными алгоритмами и объяснением почему одни протоколы умирают на первом байте, а другие живут месяцами Большинство объяснений про DPI звучат так: «система смотрит на пакеты и блокирует плохие». Это примерно как объяснить работу компилятора словами «берёт код и делает программу». Давай пройдём по тому, что реально происходит с пакетом от момента выхода с твоего устройства до момента когда ТСПУ принимает решение. Пошагово, с числами, без абстракций.

https://habr.com/ru/articles/1009560/

#DPI #ТСПУ #TLS #JA3 #JA4 #packet_inspection #Xray #обход_блокировок #TCP #fingerprint

Как ТСПУ ловит VLESS в 2026 и почему XHTTP — следующий шаг

Разбор методов детекции, которые работают прямо сейчас. JA3/JA4-отпечатки, поведенческий анализ, академическая работа СПбПУ по детекции Reality — и архитектура XHTTP, которая закрывает именно эти дыры Если твой VLESS+Reality сервер лёг в последние месяцы — ты не один. В сообществах фиксируют волны блокировок, которые раньше не достигали хорошо настроенных Reality-серверов. Что конкретно изменилось, как это устроено на уровне алгоритмов — и почему XHTTP сейчас выглядит как правильный следующий шаг.

https://habr.com/ru/articles/1009542/

#VLESS #XHTTP #ТСПУ #DPI #Xraycore #Reality #JA3 #JA4 #обход_блокировок #TLS_fingerprint

RE: https://infosec.exchange/@geraldcombs/116133603929246605

#Wireshark 4.6.4 resolves 3 denial of service vulnerabilities in the following protocol dissectors:

• USB HID CVE-2026-3201
• NTS-KE CVE-2026-3202
• RF4CE Profile CVE-2026-3203

The new release also includes a bug fix for #JA4 fingerprints of TLS handshakes with odd ALPN values as well as an important update of the #SOCKS parser, which now enables more reliable extraction of data from within SOCKS tunnels.

Masz VPN, zmieniony user-agent, prywatną przeglądarkę – a mimo to serwer wie, kim jesteś?
Bo dziś identyfikacja to coś więcej niż ciasteczka. W grze są JA3, JA4, PeetPrint, fingerprinting HTTP/2 od Akamai, kolejność nagłówków, ALPN, WebGL, fonty, język systemu…
Prywatność nie kończy się na adresie IP.
#Fingerprinting #PrivacyMatters #JA3 #JA4 #PeetPrint #Akamai #CyberSecurity #DigitalIdentity #VPN #Infosec

PolarProxy 1.0.1 Released
🆔 More #JA4
🔂 Fail-open on #TLS errors
⏩ Better performance
https://netresec.com/?b=2523c96

實作更多功能的 curl-impersonate fork

從「Curl-Impersonate (github.com/lexiforest)」這邊看到的消息。

前情提要可以在「修正 Curl 的 TLS handshake，避開 bot 偵測機制」這邊看到，當時介紹了 curl-impersonate 這個專案，可以修改 TLS 的行為 (尤其是 handshake 階段)，讓

https://blog.gslin.org/archives/2024/12/31/12168/%e5%af%a6%e4%bd%9c%e6%9b%b4%e5%a4%9a%e5%8a%9f%e8%83%bd%e7%9a%84-curl-impersonate-fork/

#Browser #Computer #GoogleChrome #Murmuring #Network #Privacy #Security #Software #WWW #curl #fingerprint #fork #impersonate #ja3 #ja4 #tls

Erik and @jonasl’s Network Fingerprinting talk is now online. It covers #JA4 and #JARM by John Althouse, @lcamtuf’s #p0f and Eric Kollmann’s Satori.
https://www.youtube.com/watch?v=1_VbYp4Zyno&t=19s

VirusTotal adds JA4 support!

https://blog.virustotal.com/2024/10/unveiling-hidden-connections-ja4-client.html
#VirusTotal #JA4

CloudFront 宣布支援 JA4 (更多的 fingerprint)

在「Amazon CloudFront launches support for JA4 fingerprinting」這邊看到的，Amazon CloudFront 宣佈支援 JA4。

JA3 是一套取得 TLS client fingerprint 的方式，

https://blog.gslin.org/archives/2024/10/13/12025/cloudfront-%e5%ae%a3%e5%b8%83%e6%94%af%e6%8f%b4-ja4-%e6%9b%b4%e5%a4%9a%e7%9a%84-fingerprint/

#AWS #CDN #Cloud #Computer #Murmuring #Network #Privacy #Security #Service #amazon #aws #cdn #cloud #cloudfront #fingerprint #ja4 #network #service #ssl #tls

FWIW the #ja4 ja4t is 8192_2-1-3-1-1-4_1260_2 from past IP's:

183.134.104.146
183.134.104.147
183.134.104.173
202.107.226.4
218.75.38.210
218.75.38.211
60.190.226.186
60.190.226.187

NetworkMiner 2.9 Released!

• @mikrotik #TZSP support
• #StealC extractor
• Improved #Modbus parser
• #JA4 support
• #GTP decapsulation

https://netresec.com/?b=245092b

JA4T and JA4TS are the latest additions to the suite of JA4+ network fingerprints.

JA4T can identify intermediary proxies, VPNs, load balancers, tunneling, and fingerprint client/server OS, devices, applications and hosting/provider characteristics. When paired with additional JA4 hashes, this allows WAF tuning to focus on a set of hashes to limit false positives versus a constantly changing list of IPs. This will make a great addition to infrastructure hunting and DDoS attribution.
https://medium.com/foxio/ja4t-tcp-fingerprinting-12fb7ce9cb5a

#DDos #WAF #JA4 #Greynoise #Infosec

CapLoader has been updated to version 1.9.6.1 to fix a bug in the #JA4 fingerprint generator. The “Select similar flows” has also been improved to support UDP flows and services, which helps users to identify clusters of proprietary protocols even when CapLoader doesn’t recognize the application layer protocol.
https://www.netresec.com/?page=CapLoader

CapLoader 1.9.6 Released!
👾 More malware protocols detected
🔎 #JA4 fingerprints
🦊 Submit to @abuse_ch's ThreatFox
⚠️ Better alerts
https://netresec.com/?b=23B6bcd