@prefix skos: <http://www.w3.org/2004/02/skos/core#> .
@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
@prefix foaf: <http://xmlns.com/foaf/0.1/> .
@prefix mcr: <https://registry.apicrafter.io/vocab#> .
@prefix dt: <https://registry.apicrafter.io/datatype/> .
@prefix cat: <https://registry.apicrafter.io/category/> .
@prefix country: <https://registry.apicrafter.io/country/> .
@prefix tool: <https://registry.apicrafter.io/tool/> .

dt:jarm_fingerprint a skos:Concept ;
    skos:inScheme <https://registry.apicrafter.io/> ;
    skos:topConceptOf <https://registry.apicrafter.io/> ;
    skos:notation "jarm_fingerprint" ;
    skos:prefLabel "JARM TLS server fingerprint"@en ;
    skos:definition "Fingerprint of a TLS server, created at Salesforce in 2020 and computed by actively sending it ten crafted ClientHello messages. It is 62 lowercase hexadecimal digits: the first 30 encode the cipher (two digits) and TLS version (one digit, 0 or a-f) that the server chose for each of the ten handshakes, with 000 for a refused handshake, and the last 32 are a truncated SHA-256 hash of the extensions and ALPN values it returned. A server that answers none of them gets 62 zeros. Shodan, Censys and VirusTotal (jarm attribute of domains and IP addresses) report it, and it is used to find malware command-and-control servers. Servers with the same software and configuration share a JARM."@en ;
    skos:example "27d40d40d29d40d1dc42d43d00041d4689ee210389f4f6b4b5b1b93f92252d" ;
    skos:example "2ad2ad0002ad2ad00042d42d00000069d641f34fe76acdc05c40262f8815e5" ;
    skos:example "07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1" ;
    mcr:status "draft" ;
    mcr:isPII false ;
    mcr:classification "identifier" ;
    mcr:regexp "^(?:[0-9a-f]{2}[0a-f]){10}[0-9a-f]{32}$" ;
    rdfs:seeAlso <https://github.com/salesforce/jarm> ;
    rdfs:seeAlso <https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a> ;
    rdfs:seeAlso <https://virustotal.readme.io/reference/domains-object> .