52.220.247.175
C2 Infrastructure CobaltStrike Indicator 52.220.247.175 Type ip Category C2 Infrastructure Family CobaltStrike Hosting AWS Confidence high VT Score 11/94 Source shodan First Seen 2026-04-18 05:03:23 UTC Last Seen 2026-04-18 05:03:23 UTC Shodan View on Shodan ↗
Raw JSON
{
"cobalt_strike_beacon": {
"x86": {
"beacon_type": "HTTPS",
"jitter": 50,
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko",
"http-post.client": [
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Referer: http://code.jquery.com/",
"Accept-Encoding: gzip, deflate",
"__cfduid"
],
"maxgetsize": 1403644,
"process-inject.min_alloc": 17500,
"post-ex.spawnto_x86": "%windir%\\syswow64\\WerFault.exe",
"port": 443,
"sleeptime": 1000,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"ntdll:RtlUserThreadStart",
"CreateThread",
"NtQueueApcThread-s",
"CreateRemoteThread",
"RtlCreateUserThread"
],
"process-inject.startrwx": 4,
"post-ex.spawnto_x64": "%windir%\\sysnative\\WerFault.exe",
"process-inject.stub": "40ed048138df0b3e23a0ef24dc5efa1a",
"http-get.uri": "52.220.247.175,/jquery-3.3.1.min.js",
"watermark": 666666666,
"dns-beacon.strategy_fail_seconds": -1,
"process-inject.userwx": 32,
"dns-beacon.strategy_fail_x": -1,
"stage.cleanup": 1,
"http-post.verb": "POST",
"http-post.uri": "/jquery-3.3.2.min.js",
"server.publickey_md5": "e50403e779135fcd44388052edc4cd61",
"process-inject.allocator": 1,
"http-get.verb": "GET",
"http-get.client": [
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Referer: http://code.jquery.com/",
"Accept-Encoding: gzip, deflate",
"__cfduid=",
"Cookie"
]
},
"x64": {
"beacon_type": "HTTPS",
"jitter": 50,
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko",
"http-post.client": [
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Referer: http://code.jquery.com/",
"Accept-Encoding: gzip, deflate",
"__cfduid"
],
"maxgetsize": 1403644,
"process-inject.min_alloc": 17500,
"post-ex.spawnto_x86": "%windir%\\syswow64\\WerFault.exe",
"port": 443,
"sleeptime": 1000,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"ntdll:RtlUserThreadStart",
"CreateThread",
"NtQueueApcThread-s",
"CreateRemoteThread",
"RtlCreateUserThread"
],
"process-inject.startrwx": 4,
"post-ex.spawnto_x64": "%windir%\\sysnative\\WerFault.exe",
"process-inject.stub": "40ed048138df0b3e23a0ef24dc5efa1a",
"http-get.uri": "52.220.247.175,/jquery-3.3.1.min.js",
"watermark": 666666666,
"dns-beacon.strategy_fail_seconds": -1,
"process-inject.userwx": 32,
"dns-beacon.strategy_fail_x": -1,
"stage.cleanup": 1,
"http-post.verb": "POST",
"http-post.uri": "/jquery-3.3.2.min.js",
"server.publickey_md5": "e50403e779135fcd44388052edc4cd61",
"process-inject.allocator": 1,
"http-get.verb": "GET",
"http-get.client": [
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Referer: http://code.jquery.com/",
"Accept-Encoding: gzip, deflate",
"__cfduid=",
"Cookie"
]
}
},
"ip": 886896559,
"http": {
"status": 404,
"robots_hash": null,
"redirects": [],
"title_hash": null,
"securitytxt": null,
"title": null,
"sitemap_hash": null,
"robots": null,
"dom_hash": 0,
"headers_hash": -1392026739,
"host": "52.220.247.175",
"html": "",
"server_hash": 869690771,
"location": "/",
"components": {
"Apache HTTP Server": {
"categories": [
"Web servers"
]
}
},
"securitytxt_hash": null,
"server": "Apache",
"sitemap": null,
"html_hash": 0
},
"port": 443,
"transport": "tcp",
"cloud": {
"region": "ap-southeast-1",
"service": "EC2",
"provider": "Amazon"
},
"location": {
"city": "Singapore",
"region_code": "01",
"area_code": null,
"longitude": 103.85007,
"latitude": 1.28967,
"country_code": "SG",
"country_name": "Singapore"
},
"product": "Cobalt Strike Beacon",
"hash": 628679449,
"tags": [
"cloud"
],
"timestamp": "2026-04-17T13:58:20.794476",
"ssl": {
"chain_sha256": [
"2f555c082ead52e2ebdb6a27d77377f0d1be2d66ac59e358521cf9d7f77c8ad7",
"83624fd338c8d9b023c18a67cb7a9c0519da43d11775b4c6cbdad45c3d997c52"
],
"jarm": "28d28d28d00028d00042d42d00042de0d120da90d5910c5de2af43b74a6bd8",
"tlsext": [
{
"id": 43,
"name": "supported_versions"
},
{
"id": 51,
"name": "key_share"
},
{
"id": 10,
"name": "supported_groups"
}
],
"chain": [
"-----BEGIN CERTIFICATE-----\nMIIDijCCAxGgAwIBAgISBrRvxrtsPojNBAgz2p0o6IelMAoGCCqGSM49BAMDMDIx\nCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF\nODAeFw0yNjAzMjIxNzE5MDhaFw0yNjA2MjAxNzE5MDdaMBQxEjAQBgNVBAMTCXN3\nY2h4LmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABAmmQzcGr8dPxqdqWU9L\nQ4dpXn07jd1qZzrjLwfiCROnqKIeZODHs+Cta/unHA4qzRLpI4VD55D3vKHb+mHl\nI9mjggIjMIICHzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwEw\nDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUzIyadLriWAgl5WJZfWD+8DfzO5kwHwYD\nVR0jBBgwFoAUjw0TovYuftFQbDMYOF1ZjiNykcowMgYIKwYBBQUHAQEEJjAkMCIG\nCCsGAQUFBzAChhZodHRwOi8vZTguaS5sZW5jci5vcmcvMCMGA1UdEQQcMBqCCXN3\nY2h4LmNvbYINd3d3LnN3Y2h4LmNvbTATBgNVHSAEDDAKMAgGBmeBDAECATAtBgNV\nHR8EJjAkMCKgIKAehhxodHRwOi8vZTguYy5sZW5jci5vcmcvMzguY3JsMIIBCwYK\nKwYBBAHWeQIEAgSB/ASB+QD3AH0AqCbL4wrGNRJGUz/gZfFPGdluGQgTxB3ZbXkA\nsxI8VScAAAGdFsRTwQAIAAAFAAPshRAEAwBGMEQCIHPR3HkteMghAddXttOODjHn\nE1zmMA86uFHJss/gr9yTAiAprnIhtbHMi5GVTmGYrGOHd7eS1Cih/SG+kWPKx8sc\nZgB2AEmcm2neHXzs/DbezYdkprhbrwqHgBnRVVL76esp3fjDAAABnRbEWucAAAQD\nAEcwRQIgeuWxFb0xrQh8OhYhcTNXoPwbgK+95/7A/nE13dw0shgCIQC9altFZKuf\nT19eE8G+vWj8wpocyhv2r1sXweN0zrorZzAKBggqhkjOPQQDAwNnADBkAjBcu/d3\n8XlzhItFu5qRW64L3RnuZvS+4himyb32gYV0vcZ/hL3FdaV/rPU9mjZAx7MCMGMR\nNPqT8lj/aUIIysKCbxexZiD3CEGXdf+hV5KIvdtWv7hxwNwWXYI1If+4pFkTKA==\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMIIEVjCCAj6gAwIBAgIQY5WTY8JOcIJxWRi/w9ftVjANBgkqhkiG9w0BAQsFADBP\nMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy\nY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNDAzMTMwMDAwMDBa\nFw0yNzAzMTIyMzU5NTlaMDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBF\nbmNyeXB0MQswCQYDVQQDEwJFODB2MBAGByqGSM49AgEGBSuBBAAiA2IABNFl8l7c\nS7QMApzSsvru6WyrOq44ofTUOTIzxULUzDMMNMchIJBwXOhiLxxxs0LXeb5GDcHb\nR6EToMffgSZjO9SNHfY9gjMy9vQr5/WWOrQTZxh7az6NSNnq3u2ubT6HTKOB+DCB\n9TAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMB\nMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFI8NE6L2Ln7RUGwzGDhdWY4j\ncpHKMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEB\nBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAE\nDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5j\nci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQBnE0hGINKsCYWi0Xx1ygxD5qihEjZ0\nRI3tTZz1wuATH3ZwYPIp97kWEayanD1j0cDhIYzy4CkDo2jB8D5t0a6zZWzlr98d\nAQFNh8uKJkIHdLShy+nUyeZxc5bNeMp1Lu0gSzE4McqfmNMvIpeiwWSYO9w82Ob8\notvXcO2JUYi3svHIWRm3+707DUbL51XMcY2iZdlCq4Wa9nbuk3WTU4gr6LY8MzVA\naDQG2+4U3eJ6qUF10bBnR1uuVyDYs9RhrwucRVnfuDj29CMLTsplM5f5wSV5hUpm\nUwp/vV7M4w4aGunt74koX71n4EdagCsL/Yk5+mAQU0+tue0JOfAV/R6t1k+Xk9s2\nHMQFeoxppfzAVC04FdG9M+AC2JWxmFSt6BCuh3CEey3fE52Qrj9YM75rtvIjsm/1\nHl+u//Wqxnu1ZQ4jpa+VpuZiGOlWrqSP9eogdOhCGisnyewWJwRQOqK16wiGyZeR\nxs/Bekw65vwSIaVkBruPiTfMOo0Zh4gVa8/qJgMbJbyrwwG97z/PRgmLKCDl8z3d\ntA0Z7qq7fta0Gl24uyuB05dqI5J1LvAzKuWdIjT1tP8qCoxSE/xpix8hX2dt3h+/\njujUgFPFZ0EVZ0xSyBNRF3MboGZnYXFUxpNjTWPKpagDHJQmqrAcDmWJnMsFY3jS\nu1igv3OefnWjSQ==\n-----END CERTIFICATE-----\n"
],
"versions": [
"-TLSv1",
"-SSLv2",
"-SSLv3",
"-TLSv1.1",
"TLSv1.2",
"TLSv1.3"
],
"acceptable_cas": [],
"alpn": [],
"cert": {
"sig_alg": "ecdsa-with-SHA384",
"issued": "20260322171908Z",
"expires": "20260620171907Z",
"pubkey": {
"bits": 256,
"type": "dsa"
},
"version": 2,
"extensions": [
{
"critical": true,
"data": "\\x03\\x02\\x07\\x80",
"name": "keyUsage"
},
{
"data": "0\\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01",
"name": "extendedKeyUsage"
},
{
"critical": true,
"data": "0\\x00",
"name": "basicConstraints"
},
{
"data": "\\x04\\x14\\xcc\\x8c\\x9at\\xba\\xe2X\\x08%\\xe5bY}`\\xfe\\xf07\\xf3;\\x99",
"name": "subjectKeyIdentifier"
},
{
"data": "0\\x16\\x80\\x14\\x8f\\r\\x13\\xa2\\xf6.~\\xd1Pl3\\x188]Y\\x8e#r\\x91\\xca",
"name": "authorityKeyIdentifier"
},
{
"data": "0$0\"\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86\\x16http://e8.i.lencr.org/",
"name": "authorityInfoAccess"
},
{
"data": "0\\x1a\\x82\\tswchx.com\\x82\\rwww.swchx.com",
"name": "subjectAltName"
},
{
"data": "0\\n0\\x08\\x06\\x06g\\x81\\x0c\\x01\\x02\\x01",
"name": "certificatePolicies"
},
{
"data": "0$0\"\\xa0 \\xa0\\x1e\\x86\\x1chttp://e8.c.lencr.org/38.crl",
"name": "crlDistributionPoints"
},
{
"data": "\\x04\\x81\\xf9\\x00\\xf7\\x00}\\x00\\xa8&\\xcb\\xe3\\n\\xc65\\x12FS?\\xe0e\\xf1O\\x19\\xd9n\\x19\\x08\\x13\\xc4\\x1d\\xd9my\\x00\\xb3\\x12<U\\'\\x00\\x00\\x01\\x9d\\x16\\xc4S\\xc1\\x00\\x08\\x00\\x00\\x05\\x00\\x03\\xec\\x85\\x10\\x04\\x03\\x00F0D\\x02 s\\xd1\\xdcy-x\\xc8!\\x01\\xd7W\\xb6\\xd3\\x8e\\x0e1\\xe7\\x13\\\\\\xe60\\x0f:\\xb8Q\\xc9\\xb2\\xcf\\xe0\\xaf\\xdc\\x93\\x02 )\\xaer!\\xb5\\xb1\\xcc\\x8b\\x91\\x95Na\\x98\\xacc\\x87w\\xb7\\x92\\xd4(\\xa1\\xfd!\\xbe\\x91c\\xca\\xc7\\xcb\\x1cf\\x00v\\x00I\\x9c\\x9bi\\xde\\x1d|\\xec\\xfc6\\xde\\xcd\\x87d\\xa6\\xb8[\\xaf\\n\\x87\\x80\\x19\\xd1UR\\xfb\\xe9\\xeb)\\xdd\\xf8\\xc3\\x00\\x00\\x01\\x9d\\x16\\xc4Z\\xe7\\x00\\x00\\x04\\x03\\x00G0E\\x02 z\\xe5\\xb1\\x15\\xbd1\\xad\\x08|:\\x16!q3W\\xa0\\xfc\\x1b\\x80\\xaf\\xbd\\xe7\\xfe\\xc0\\xfeq5\\xdd\\xdc4\\xb2\\x18\\x02!\\x00\\xbdj[Ed\\xab\\x9fO_^\\x13\\xc1\\xbe\\xbdh\\xfc\\xc2\\x9a\\x1c\\xca\\x1b\\xf6\\xaf[\\x17\\xc1\\xe3t\\xce\\xba+g",
"name": "ct_precert_scts"
}
],
"fingerprint": {
"sha256": "2f555c082ead52e2ebdb6a27d77377f0d1be2d66ac59e358521cf9d7f77c8ad7",
"sha1": "6b9710d5bb761d4f36d1f99ee108052dee0a6b86"
},
"serial": 5.840731178200271e+41,
"issuer": {
"C": "US",
"CN": "E8",
"O": "Let's Encrypt"
},
"expired": false,
"subject": {
"CN": "swchx.com"
}
},
"cipher": {
"version": "TLSv1.3",
"bits": 256,
"name": "TLS_AES_256_GCM_SHA384"
},
"trust": {
"revoked": false,
"browser": null
},
"handshake_states": [
"before SSL initialization",
"SSLv3/TLS write client hello",
"SSLv3/TLS read server hello",
"TLSv1.3 read encrypted extensions",
"SSLv3/TLS read server certificate",
"TLSv1.3 read server certificate verify",
"SSLv3/TLS read finished",
"SSLv3/TLS write change cipher spec",
"SSLv3/TLS write finished",
"SSL negotiation finished successfully"
],
"ja3s": "f03a69cfa3944d6d51bc52febd87a1a8",
"ocsp": {}
},
"hostnames": [
"ec2-52-220-247-175.ap-southeast-1.compute.amazonaws.com",
"www.swchx.com",
"swchx.com"
],
"org": "Amazon Data Services Singapore",
"data": "HTTP/1.1 404 Not Found\r\nDate: Fri, 17 Apr 2026 13:58:20 GMT\r\nServer: Apache\r\nContent-Length: 0\r\nKeep-Alive: timeout=10, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/plain\r\n\r\n\nCobalt Strike Beacon:\n x86:\n beacon_type: HTTPS\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\n Referer: http://code.jquery.com/\n Accept-Encoding: gzip, deflate\n __cfduid=\n Cookie\n http-get.uri: 52.220.247.175,/jquery-3.3.1.min.js\n http-get.verb: GET\n http-post.client:\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\n Referer: http://code.jquery.com/\n Accept-Encoding: gzip, deflate\n __cfduid\n http-post.uri: /jquery-3.3.2.min.js\n http-post.verb: POST\n jitter: 50\n maxgetsize: 1403644\n port: 443\n post-ex.spawnto_x64: %windir%\\sysnative\\WerFault.exe\n post-ex.spawnto_x86: %windir%\\syswow64\\WerFault.exe\n process-inject.allocator: 1\n process-inject.execute:\n ntdll:RtlUserThreadStart\n CreateThread\n NtQueueApcThread-s\n CreateRemoteThread\n RtlCreateUserThread\n process-inject.min_alloc: 17500\n process-inject.startrwx: 4\n process-inject.stub: 40ed048138df0b3e23a0ef24dc5efa1a\n process-inject.userwx: 32\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: e50403e779135fcd44388052edc4cd61\n sleeptime: 1000\n stage.cleanup: 1\n useragent_header: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\n uses_cookies: 1\n watermark: 666666666\n x64:\n beacon_type: HTTPS\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\n Referer: http://code.jquery.com/\n Accept-Encoding: gzip, deflate\n __cfduid=\n Cookie\n http-get.uri: 52.220.247.175,/jquery-3.3.1.min.js\n http-get.verb: GET\n http-post.client:\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\n Referer: http://code.jquery.com/\n Accept-Encoding: gzip, deflate\n __cfduid\n http-post.uri: /jquery-3.3.2.min.js\n http-post.verb: POST\n jitter: 50\n maxgetsize: 1403644\n port: 443\n post-ex.spawnto_x64: %windir%\\sysnative\\WerFault.exe\n post-ex.spawnto_x86: %windir%\\syswow64\\WerFault.exe\n process-inject.allocator: 1\n process-inject.execute:\n ntdll:RtlUserThreadStart\n CreateThread\n NtQueueApcThread-s\n CreateRemoteThread\n RtlCreateUserThread\n process-inject.min_alloc: 17500\n process-inject.startrwx: 4\n process-inject.stub: 40ed048138df0b3e23a0ef24dc5efa1a\n process-inject.userwx: 32\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: e50403e779135fcd44388052edc4cd61\n sleeptime: 1000\n stage.cleanup: 1\n useragent_header: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\n uses_cookies: 1\n watermark: 666666666\n",
"asn": "AS16509",
"cpe23": [
"cpe:2.3:a:apache:http_server",
"cpe:2.3:a:helpsystems:cobalt_strike"
],
"isp": "Amazon.com, Inc.",
"cpe": [
"cpe:/a:apache:http_server",
"cpe:/a:helpsystems:cobalt_strike"
],
"domains": [
"amazonaws.com",
"swchx.com"
],
"ip_str": "52.220.247.175",
"os": null,
"_shodan": {
"region": "na",
"module": "https",
"ptr": true,
"options": {
"scan": "ggFJDtRn4re8Jln0"
},
"id": "65fef2cb-e70f-40e8-9c10-aa3e06b44e26",
"crawler": "1e4769fde0b9dbe1f84ba3a427cb5b0e415246c1"
}
}