Post #3563009
2026-07-03 18:33 UTC
@james_inthe_box@infosec.exchange @da_667@infosec.exchange FlowCarp classifies 104.249.10.71:2555 as #PureRAT inside of TLS
Feel free to verify with:
curl -s --data-binary @4bd07f35-3a29-477a-8e2b-7e4d31182cd7.pcap https://demo.flowcarp.com | jq -s -c 'map(select(.event_type=="alert")|[(.dest_ip + ":" + (.dest_port|tostring)), .alert.signature])|unique[]'
Replies (1)
-
@da_667@infosec.exchange 2026-07-03 18:39
@netresec@infosec.exchange @james_inthe_box@infosec.exchange nice work, y'all.