When a Proxy Network Dies but Its IPs Survive
A proxy takedown can erase a brand without removing all of its former exit addresses. Here is what post-takedown IP overlap proves, what it cannot prove, and the sourcing evidence buyers should demand.
Before JA3: How TLS Handshakes Became Fingerprints
JA3 made TLS fingerprints easy to log and share, but the technical ideas behind it had already been tested in SSL Labs experiments, a p0f patch and FingerprinTLS.
What an Open Network Fingerprint Database Should Publish
A useful open fingerprint database needs provenance, competing labels, raw evidence, format versions and licences—not another unexplained hash list.
Does TLS Fingerprint Canonicalisation Hide Attacker Variation? How to Test It
Sorting makes TLS fingerprints more stable, but it also removes ordering evidence. Here is how to test whether the discarded variation matters.
One ClientHello, Three Fingerprints: JA3, JA4 and Mercury
A reproducible lab runs JA3, JA4 and Cisco Mercury against the same TLS ClientHello and compares what each fingerprint preserves.