Having done a fair bit of infra attribution work, the thing I'd want to know is how it handles stale data. Pivoting on certs and WHOIS is easy, knowing a host moved three months ago is the hard part.
Why exactly is an specific model needed for this? Also this is useless without a proper harness.
6,500 instructions is a small training set, so I'd want to see how it performs on unseen indicators