Search for a command to run...
We empower businesses with cutting-edge software and expert services to navigate the complexities of today's cyber landscape. Secure your network with cutting-edge software and services that ensure your safety and peace of mind!
No comments yet. Be the first to comment.
The design and architecture of the verbosus fingerprint (vfp) in HTTP-Basma allows for deeper inspection of every field of every probe. The reversibility property of the fingerprint coupled with the d
While working on HTTP-Basma, I had the idea of trying to construct "weird" (obfuscated looking) yet functional HTTP server response headers, that are still interpreted by the browser as valid server r
Following the first release of HTTP-Basma on May 20, 2026, on Netomize's official GitHub repository, including the research paper, source code, datasets, and 64-bit release versions for Windows and Li
Netomize is happy to announce the release of a new HTTP fingerprinting algorithm called HTTP-Basma to identify HTTP servers using a reversible fingerprint codenamed verbosus. In the realm of cybersecu
On August 5, 2026, the Microsoft Security Research Team (MSRT) blogged about a new macOS ClickFix campaign titled From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide.
What's unique about this campaign is the use of TDS and fingerprinting gates to decide whether to serve the malicious page to the target user, luring the user into downloading the infostealers MacSync and Atomic Stealer (AMOS). This campaign uses groups of domain names with similar naming conventions.
The MSRT team shared 17 of those domains, listed here for reference:
applefilevault[.]com
apricotfilepoint[.]com
bananafastfile[.]com
cloudfilebridge[.]com
filecedarwallet[.]online
filecopperbasket[.]sbs
filecrimsonsignal[.]online
filemarblegarden[.]sbs
fileoceanhammer[.]sbs
filerubyfolder[.]sbs
filevelvettractor[.]sbs
lemonfilewave[.]com
limefilescope[.]com
mangocloudfile[.]com
orangesmartfile[.]com
syncdatavault[.]com
cloudsendhub[.]com
This campaign serves as a good case study for using HTTP-Basma for HTTP server fingerprinting and the clustering of those fingerprints.
We've already submitted those domains to https://httpbasma.netomize.ca/ for fingerprinting, and as a result, we get 3 (actually 2) unique clusters:
Cluster A - [15] Verbosus fingerprint: 01140a85e40014514bd522142494d672140a85e4721420958a220c0c140a85e4720000001609
Cluster B - [1] Verbosus fingerprint: 01140a85e40014514bd522142494d672140a85e4721420958a22000c140a85e4720000001609
Cluster C - [1] Verbosus fingerprint: 0100000000000000000000000000000000000000000000000000000000000000000000000000
As shown above, cluster C indicates a dead domain. Cluster A contains the majority of the domains (15), and cluster B consists of 1 domain. Now, you might be asking yourself, what's the difference between cluster A and cluster B verbosus fingerprints? They look very similar, but it is not possible to tell the actual difference at the probe or field level just by comparing them one byte at a time; For that, we use the Compare function available under https://httpbasma.netomize.ca/#compare to compare the two fingerprints, placing them next to each other, ':' separated.
The following screenshot shows the actual difference at the probe and field level, and, as shown, it is probe P6F (GET Request — Accept-Encoding, Full); Meaning, for cluster A, the server returned an actual value for this probe, which maps to the fingerprint 0c, whereas for cluster B, the server returned no value, indicated by the fingerprint 00.
In JSON format:
[
{
"fp1": "01140a85e40014514bd522142494d672140a85e4721420958a220c0c140a85e4720000001609",
"fp2": "01140a85e40014514bd522142494d672140a85e4721420958a22000c140a85e4720000001609",
"result": "not_equal",
"p6f": {
"content_encoding": {
"fp1": "0c",
"fp2": "00"
}
}
}
]
In case you're curious about what the FP 0c decodes to, you could use the Demangle feature https://httpbasma.netomize.ca/#demangle, using the newly implemented graph feature to visualize it as a graph:
Therefore, the fingerprint 0c demangles to the content-encoding type zstd returned by the server for the probe p6f.
Now that we have all the fingerprints clustered, the next step would be to check for potential false positives in the Majestic Million HTTP-Basma database for servers that share a given fingerprint, which you could access via https://httpbasma.netomize.ca/#dbmatch. Searching for Cluster A and Cluster B verbosus fingerprints yields no matches.
In this blog post, we used the HTTP-Basma platform for fingerprinting newly disclosed macOS ClickFix campaign webpages. Additionally, we highlighted some of the platform's capabilities to cluster those fingerprints, compare them and demangle them.
Mohamad Mokbel
August 06, 2026