47.121.181.148
C2 Infrastructure CobaltStrike Indicator 47.121.181.148 Type ip Category C2 Infrastructure Family CobaltStrike Hosting Aliyun Computing Co., LTD Confidence high VT Score 8/94 Source shodan First Seen 2026-07-01 00:00:55 UTC Last Seen 2026-07-08 08:00:43 UTC Shodan View on Shodan ↗
Raw JSON
{
"cobalt_strike_beacon": {
"x86": {
"beacon_type": "HTTPS",
"jitter": 7,
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; yie9)",
"http-post.client": [
"user=",
"%%",
"User",
"data=",
"%%"
],
"maxgetsize": 2097167,
"post-ex.spawnto_x86": "c:\\windows\\syswow64\\rundll32.exe",
"port": 443,
"sleeptime": 3000,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"CreateThread",
"SetThreadContext",
"CreateRemoteThread",
"RtlCreateUserThread"
],
"process-inject.startrwx": 64,
"post-ex.spawnto_x64": "c:\\windows\\system32\\rundll32.exe",
"process-inject.stub": "04e0a11be59147a8d73d2b3e9fea832c",
"http-get.uri": "47.121.181.148,/www/handle/doc",
"watermark": 666666,
"dns-beacon.strategy_fail_seconds": -1,
"server.publickey_md5": "a77a5d6b5abdd0540f935339feeb1b14",
"dns-beacon.strategy_fail_x": -1,
"http-post.verb": "POST",
"http-post.uri": "/IMXo",
"process-inject.userwx": 64,
"http-get.verb": "GET",
"http-get.client": [
"SESSIONID=",
"Cookie"
]
},
"x64": {
"beacon_type": "HTTPS",
"jitter": 7,
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)",
"http-post.client": [
"user=",
"%%",
"User",
"data=",
"%%"
],
"maxgetsize": 2097167,
"post-ex.spawnto_x86": "c:\\windows\\syswow64\\rundll32.exe",
"port": 443,
"sleeptime": 3000,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"CreateThread",
"SetThreadContext",
"CreateRemoteThread",
"RtlCreateUserThread"
],
"process-inject.startrwx": 64,
"post-ex.spawnto_x64": "c:\\windows\\system32\\rundll32.exe",
"process-inject.stub": "04e0a11be59147a8d73d2b3e9fea832c",
"http-get.uri": "47.121.181.148,/www/handle/doc",
"watermark": 666666,
"dns-beacon.strategy_fail_seconds": -1,
"server.publickey_md5": "a77a5d6b5abdd0540f935339feeb1b14",
"dns-beacon.strategy_fail_x": -1,
"http-post.verb": "POST",
"http-post.uri": "/IMXo",
"process-inject.userwx": 64,
"http-get.verb": "GET",
"http-get.client": [
"SESSIONID=",
"Cookie"
]
}
},
"ip": 796505492,
"http": {
"status": 404,
"robots_hash": null,
"redirects": [],
"title_hash": null,
"securitytxt": null,
"title": null,
"sitemap_hash": null,
"robots": null,
"dom_hash": 0,
"headers_hash": 2129120964,
"host": "47.121.181.148",
"html": "",
"server_hash": null,
"location": "/",
"components": {},
"securitytxt_hash": null,
"server": null,
"sitemap": null,
"html_hash": 0
},
"port": 443,
"transport": "tcp",
"location": {
"city": "Heyuan",
"region_code": "GD",
"area_code": null,
"longitude": 114.68333,
"latitude": 23.73333,
"country_code": "CN",
"country_name": "China"
},
"product": "Cobalt Strike Beacon",
"hash": -33879892,
"tags": [
"self-signed"
],
"timestamp": "2026-06-30T20:06:15.711205",
"ssl": {
"chain_sha256": [
"963087eb71975e462d5d215131db26f8884b64f50ec83d2c1a353190acad3992"
],
"jarm": "07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1",
"tlsext": [
{
"id": 43,
"name": "supported_versions"
},
{
"id": 44,
"name": "unknown"
},
{
"id": 51,
"name": "key_share"
},
{
"id": 43,
"name": "supported_versions"
},
{
"id": 51,
"name": "key_share"
},
{
"id": 10,
"name": "supported_groups"
}
],
"chain": [
"-----BEGIN CERTIFICATE-----\nMIIDYTCCAkmgAwIBAgIETfh14TANBgkqhkiG9w0BAQsFADBhMQswCQYDVQQGEwJL\nWjELMAkGA1UECBMCS1oxCTAHBgNVBAcTADEUMBIGA1UEChMLTk4gRmVybiBTdWIx\nEDAOBgNVBAsTB05OIEZlcm4xEjAQBgNVBAMTCWZvcmVuLnppazAeFw0yNjA2MjIx\nMjI4MDhaFw0yNzA2MjIxMjI4MDhaMGExCzAJBgNVBAYTAktaMQswCQYDVQQIEwJL\nWjEJMAcGA1UEBxMAMRQwEgYDVQQKEwtOTiBGZXJuIFN1YjEQMA4GA1UECxMHTk4g\nRmVybjESMBAGA1UEAxMJZm9yZW4uemlrMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\nMIIBCgKCAQEAjj87XisYrp6GEuacighcBEbeLNVw/t6kGPWaEOHjTbevPQl2Y0Zz\nqYcDnR74GBXgZhIy1PmQJLQV+8Bzk895VCZOEn+IkXCYkuGDdy1orx0QzNtOkHrk\nNNUOMaU4tWv6ZfNtRfgLGpNgtZIZrtSrp8vDFOhYobnk2cMolCZ1JFYwpVL7m4Vl\nJ+ZSoMM7mZKmnCQmQ/oyfCCylaXKqXMTLFoVaszUl1aaawCExvzk67WJ636G8wWV\nEGJE2Ueqc4T1A8gOniKZRWZUi30loKotyKZPczOXVcQcZEEQb/3qxaF3Vi+bQ72D\n6ZIN2+Kdgz7HvIz5k7LuQML8gWLq5hWcYQIDAQABoyEwHzAdBgNVHQ4EFgQUwfPP\nMprxT0bNi2sXB/5ZOMveiZcwDQYJKoZIhvcNAQELBQADggEBABgr0Zr2gwWbrw/v\nYFwixCM7orsLpATBnFyfwNn/f8tUbx0UhPF8xucQ4qNmNR4Qh4fjEQiRcYaPRdV9\nlONIQP+KElP2BLybPbRDEmYVKU9qFXUrEZmzvj83d3Ci8bU78sMXcs+rYD0HCbt6\nK9hRoROiESuPAlcpgiQBh0pY6k5jGQSneRyRvMW474i8cHDi7IiTaN8EQ2xwjK+G\nX8/7/ypnxvyPwTnyMc8hEpHXex/D7M0Ka+eahckWuMgyTqBTfElFsF9UZA/hiETW\n6TW81Qcw/Cj530lxIiYZEHRpxcYRJmNW03zqcekQzP5T5jKneHraNnyGiGBlAXpT\nWKD3N5A=\n-----END CERTIFICATE-----\n"
],
"versions": [
"TLSv1",
"-SSLv2",
"-SSLv3",
"TLSv1.1",
"TLSv1.2",
"TLSv1.3"
],
"acceptable_cas": [],
"alpn": [],
"cert": {
"sig_alg": "sha256WithRSAEncryption",
"issued": "20260622122808Z",
"expires": "20270622122808Z",
"pubkey": {
"bits": 2048,
"type": "rsa"
},
"version": 2,
"extensions": [
{
"data": "\\x04\\x14\\xc1\\xf3\\xcf2\\x9a\\xf1OF\\xcd\\x8bk\\x17\\x07\\xfeY8\\xcb\\xde\\x89\\x97",
"name": "subjectKeyIdentifier"
}
],
"fingerprint": {
"sha256": "963087eb71975e462d5d215131db26f8884b64f50ec83d2c1a353190acad3992",
"sha1": "9a38d8305cc5cccf4d982346734f70bf9d1ac8e0"
},
"serial": 1308128737,
"issuer": {
"C": "KZ",
"CN": "foren.zik",
"L": "",
"O": "NN Fern Sub",
"ST": "KZ",
"OU": "NN Fern"
},
"expired": false,
"subject": {
"C": "KZ",
"CN": "foren.zik",
"L": "",
"O": "NN Fern Sub",
"ST": "KZ",
"OU": "NN Fern"
}
},
"cipher": {
"version": "TLSv1.3",
"bits": 256,
"name": "TLS_AES_256_GCM_SHA384"
},
"trust": {
"revoked": false,
"browser": null
},
"handshake_states": [
"before SSL initialization",
"SSLv3/TLS write client hello",
"SSLv3/TLS read server hello",
"SSLv3/TLS write change cipher spec",
"SSLv3/TLS write client hello",
"SSLv3/TLS read server hello",
"TLSv1.3 read encrypted extensions",
"SSLv3/TLS read server certificate",
"TLSv1.3 read server certificate verify",
"SSLv3/TLS read finished",
"SSLv3/TLS write finished",
"SSL negotiation finished successfully"
],
"ja3s": "fef5599f0a3662839aeb1f3c854eba06",
"ocsp": {}
},
"hostnames": [],
"org": "Aliyun Computing Co., LTD",
"data": "HTTP/1.1 404 Not Found\r\nDate: Wed, 1 Jul 2026 04:05:43 GMT\r\nContent-Type: text/plain\r\nContent-Length: 0\r\n\r\n\nCobalt Strike Beacon:\n x86:\n beacon_type: HTTPS\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n SESSIONID=\n Cookie\n http-get.uri: 47.121.181.148,/www/handle/doc\n http-get.verb: GET\n http-post.client:\n user=\n %%\n User\n data=\n %%\n http-post.uri: /IMXo\n http-post.verb: POST\n jitter: 7\n maxgetsize: 2097167\n port: 443\n post-ex.spawnto_x64: c:\\windows\\system32\\rundll32.exe\n post-ex.spawnto_x86: c:\\windows\\syswow64\\rundll32.exe\n process-inject.execute:\n CreateThread\n SetThreadContext\n CreateRemoteThread\n RtlCreateUserThread\n process-inject.startrwx: 64\n process-inject.stub: 04e0a11be59147a8d73d2b3e9fea832c\n process-inject.userwx: 64\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: a77a5d6b5abdd0540f935339feeb1b14\n sleeptime: 3000\n useragent_header: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; yie9)\n uses_cookies: 1\n watermark: 666666\n x64:\n beacon_type: HTTPS\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n SESSIONID=\n Cookie\n http-get.uri: 47.121.181.148,/www/handle/doc\n http-get.verb: GET\n http-post.client:\n user=\n %%\n User\n data=\n %%\n http-post.uri: /IMXo\n http-post.verb: POST\n jitter: 7\n maxgetsize: 2097167\n port: 443\n post-ex.spawnto_x64: c:\\windows\\system32\\rundll32.exe\n post-ex.spawnto_x86: c:\\windows\\syswow64\\rundll32.exe\n process-inject.execute:\n CreateThread\n SetThreadContext\n CreateRemoteThread\n RtlCreateUserThread\n process-inject.startrwx: 64\n process-inject.stub: 04e0a11be59147a8d73d2b3e9fea832c\n process-inject.userwx: 64\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: a77a5d6b5abdd0540f935339feeb1b14\n sleeptime: 3000\n useragent_header: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)\n uses_cookies: 1\n watermark: 666666\n",
"asn": "AS37963",
"cpe23": [
"cpe:2.3:a:helpsystems:cobalt_strike"
],
"isp": "Hangzhou Alibaba Advertising Co.,Ltd.",
"cpe": [
"cpe:/a:helpsystems:cobalt_strike"
],
"domains": [],
"ip_str": "47.121.181.148",
"os": null,
"_shodan": {
"region": "na",
"module": "https",
"ptr": true,
"options": {},
"id": "e004ada6-b48d-4caa-8b64-c1c7eb1763fe",
"crawler": "6147588973add935f9bd54061839cfc3159f6dc9"
}
}