TLS-Fingerprint Infrastructure Pivot
Attackers change domains and addresses easily — but their servers often share a telltale fingerprint. Starting from one address, this pivots on that fingerprint to every other server sharing it, enriched with network and location, so you can cluster covert command-and-control infrastructure that would otherwise look unrelated.
How it uses the graph
Traverses the TLS, BGP, GeoIP, threat-intel, DNS layers of the graph, in 6 steps:
Resolving the pivot IP's ASN, prefix, country and threat verdict…
Listing the JA3/JARM fingerprints this IP emits…
Scoring how selective each fingerprint is…
Expanding to every other IP that shares the fingerprint, with ASN, prefix, country and threat verdict…
Surfacing the hostnames that resolve onto the co-fingerprinted IPs…
Authoritative TLS-fingerprint metadata (procedure)…
Why each step runs
- 01Pivot IP — routing, GeoIP & threat verdict. Anchors the cluster on the starting IP: ANNOUNCED_BY→ROUTES gives its origin ASN and prefix, HAS_COUNTRY gives GeoIP, and the IPV4 threatScore/verdictLevel props give its reputation — the baseline every co-fingerprinted sibling is compared against.
- 02TLS fingerprints emitted by the IP. Reads EMITS_TLS_FINGERPRINT to enumerate the TLS hashes (JA3 client / JARM server) the IP presents — these are the pivot keys for the cluster expansion. A shared fingerprint is a same-tooling / same-appliance signal.
- 03Fingerprint selectivity (how many IPs share it). Counts the distinct sibling IPs that share each fingerprint. A low count is a tight, high-confidence cluster (likely the same operator/appliance); a huge count means a commodity stack (e.g. a default nginx/CDN JARM) and should be discounted.
- 04Co-fingerprinted sibling IPs (cluster). The core pivot: reverses EMITS_TLS_FINGERPRINT from the shared hash to every sibling IPV4, then enriches each with ANNOUNCED_BY→ROUTES (ASN/prefix), HAS_COUNTRY (GeoIP) and its threatScore/verdictLevel — the co-located infrastructure flat per-IP lookups cannot follow.
- 05Hostnames resolving onto cluster members. Walks reverse RESOLVES_TO from each sibling IP back to the hostnames hosted on it — names the cluster (shared panel domain, staging hosts, look-alikes) so the same-operator signal becomes an actionable list of domains.
- 06Authoritative TLS-fingerprint metadata (procedure). Gives the analyst the authoritative JA3/JARM metadata for the IP — fingerprint hash, tooling family/vendor, category and how many feed sources attest it — so a cluster hit can be named (e.g. a known C2 appliance) rather than left as an opaque hash.