Tool
JA4+
- First Reported
- Dec 23, 2024
- Latest Reported
- Oct 13, 2026
Reported Context (4)
- This first example will combine the power of John Althouse's JA4+ fingerprinting suite, specifically JA4X ( https://github.com/FoxIO-LLC/ja4 ), with Hunt's ability to search across subject and issuer information from Hunt Introduces Advanced Search for Threat Hunting
- JA4+ fingerprinting uncovered Keitaro admin consoles and over 100 IPs linked to malware distribution, notably an AS (AS214351 / FEMO IT SOLUTIONS LIMITED) hosting DonutLoader and other payloads. Infoblox Details How Cybercriminals Abuse Keitaro to Scale Malicious Campaigns
- If you're unfamiliar with JA4X, it's part of the JA4+ fingerprinting suite and an extension of the JA3 TLS fingerprinting method], designed to create more precise fingerprints by including additional metadata. This TLS Certificate and JA4X Clues Link New Servers to Suspected GhostWolf Infrastructure
- What is JA4+ and Why Does It Matter? JA4 Primer Explains TLS Fingerprinting for Threat Analysis
Malware (8)
People (1)
Threat Actors (6)
MITRE ATT&CK (5)
Vendors (6)
Products (8)
Tools (8)
Industries (4)
Countries (5)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.