Indicator 34.214.106.56 Type ip Category C2 Infrastructure Family CobaltStrike Hosting AWS Confidence high VT Score 8/94 Source shodan First Seen 2026-04-25 08:00:05 UTC Last Seen 2026-05-02 16:00:01 UTC Shodan View on Shodan ↗
Raw JSON
{
  "ip": 584477240,
  "http": {
    "status": 404,
    "robots_hash": null,
    "redirects": [],
    "title_hash": null,
    "securitytxt": null,
    "title": null,
    "sitemap_hash": null,
    "robots": null,
    "dom_hash": 0,
    "headers_hash": 2129120964,
    "host": "34.214.106.56",
    "html": "",
    "server_hash": null,
    "location": "/",
    "components": {},
    "securitytxt_hash": null,
    "server": null,
    "sitemap": null,
    "html_hash": 0
  },
  "port": 443,
  "transport": "tcp",
  "cloud": {
    "region": "us-west-2",
    "service": "EC2",
    "provider": "Amazon"
  },
  "location": {
    "city": "Boardman",
    "region_code": "OR",
    "area_code": null,
    "longitude": -119.70058,
    "latitude": 45.83986,
    "country_code": "US",
    "country_name": "United States"
  },
  "product": "Cobalt Strike Beacon",
  "hash": 1505744668,
  "tags": [
    "cloud",
    "self-signed"
  ],
  "timestamp": "2026-04-24T09:35:39.621507",
  "ssl": {
    "chain_sha256": [
      "2c98a49852113e6b3b133772dee1ac3c2569dd0caa292dbdc4f0529202435d7e"
    ],
    "jarm": "2ad2ad16d2ad2ad00042d42d00042ddb04deffa1705e2edc44cae1ed24a4da",
    "tlsext": [
      {
        "id": 43,
        "name": "supported_versions"
      },
      {
        "id": 51,
        "name": "key_share"
      },
      {
        "id": 10,
        "name": "supported_groups"
      }
    ],
    "chain": [
      "-----BEGIN CERTIFICATE-----\nMIIDVDCCAjygAwIBAgIJANlGbFNrJA/8MA0GCSqGSIb3DQEBCwUAMFgxCzAJBgNV\nBAYTAlVTMQkwBwYDVQQIEwAxCTAHBgNVBAcTADERMA8GA1UEChMISW5mcmEtaXEx\nCTAHBgNVBAsTADEVMBMGA1UEAxMMaW5mcmEtaXEuY29tMB4XDTI2MDMzMTAxNDU1\nNVoXDTI3MDMzMTAxNDU1NVowWDELMAkGA1UEBhMCVVMxCTAHBgNVBAgTADEJMAcG\nA1UEBxMAMREwDwYDVQQKEwhJbmZyYS1pcTEJMAcGA1UECxMAMRUwEwYDVQQDEwxp\nbmZyYS1pcS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDJy+nb\nkvIxd80DXzmUUgIN2XvAfIlqOuIkhT+tliZiV5KEZNlX3ZbDOVnuOlujWcv9bzkM\nKvPyN3m8R4n7pqOpK/KGqA5TQo1bf/9pG7cwFEKfEbgiqLhlxHX5EZtzkKWoKsMv\nZSgJzecm22H0WnvKvSyMeWKN2lqC+rkef+Dr69AcBMKY0hZNyu2ojdPVm1xtVb97\nURCShKTK6IngpgJ5lI9p35p1AxzYKm9eQ3jSUDLRqIQOrnOtxki/QWqDn5ClSZ8r\nAz0jIVNAW3RAA5BEeccQv5AZNphTTuZWNvBakvnm1b3OSgu14Kh4SCCcXgtXS3n5\n8+8Rp5ZaVIGzU0n/AgMBAAGjITAfMB0GA1UdDgQWBBQ97rd2c1i6UIBUcJulR5sw\nAEY3bjANBgkqhkiG9w0BAQsFAAOCAQEATgP5ghandkXVv0iDrulqwA3RfMImYC9F\nLx1GGGsfA/gCCpi+S0hDodal75k4m+l5qKMFYy3tvAr7FbLK+BE4H0te6TDHM4d8\nhg4uqc9D95DJHpbWpGjqq3oXz7pmS38swtVkxKA6sXPIPVbaRT4KPWKPEcrHmOEI\nF9DCE5FVMHUf8jx+HC35/UhO9K/6VBH4yngm3EPhYgg0GR/Q80mXPwyR3TYm9OXO\nA9Yiv8lpygPqO5fVL6Noe6wk/LYa+dJZrMQJos9QNy2q70N96HYIG8GT2ou3+KWC\nSWf2/G3GAvWnXj/yQg6RErALQ73jC+efxVIIsAc1/02SviORJ10X7w==\n-----END CERTIFICATE-----\n"
    ],
    "versions": [
      "-TLSv1",
      "-SSLv2",
      "-SSLv3",
      "-TLSv1.1",
      "TLSv1.2",
      "TLSv1.3"
    ],
    "acceptable_cas": [],
    "alpn": [],
    "cert": {
      "sig_alg": "sha256WithRSAEncryption",
      "issued": "20260331014555Z",
      "expires": "20270331014555Z",
      "pubkey": {
        "bits": 2048,
        "type": "rsa"
      },
      "version": 2,
      "extensions": [
        {
          "data": "\\x04\\x14=\\xee\\xb7vsX\\xbaP\\x80Tp\\x9b\\xa5G\\x9b0\\x00F7n",
          "name": "subjectKeyIdentifier"
        }
      ],
      "fingerprint": {
        "sha256": "2c98a49852113e6b3b133772dee1ac3c2569dd0caa292dbdc4f0529202435d7e",
        "sha1": "34d21283a1d008e2622d9f145fb69e71b4154aa5"
      },
      "serial": 15656320260135719000,
      "issuer": {
        "C": "US",
        "CN": "infra-iq.com",
        "L": "",
        "O": "Infra-iq",
        "ST": "",
        "OU": ""
      },
      "expired": false,
      "subject": {
        "C": "US",
        "CN": "infra-iq.com",
        "L": "",
        "O": "Infra-iq",
        "ST": "",
        "OU": ""
      }
    },
    "cipher": {
      "version": "TLSv1.3",
      "bits": 256,
      "name": "TLS_AES_256_GCM_SHA384"
    },
    "trust": {
      "revoked": false,
      "browser": null
    },
    "handshake_states": [
      "before SSL initialization",
      "SSLv3/TLS write client hello",
      "SSLv3/TLS read server hello",
      "TLSv1.3 read encrypted extensions",
      "SSLv3/TLS read server certificate",
      "TLSv1.3 read server certificate verify",
      "SSLv3/TLS read finished",
      "SSLv3/TLS write change cipher spec",
      "SSLv3/TLS write finished",
      "SSL negotiation finished successfully"
    ],
    "ja3s": "f03a69cfa3944d6d51bc52febd87a1a8",
    "ocsp": {}
  },
  "hostnames": [
    "ec2-34-214-106-56.us-west-2.compute.amazonaws.com"
  ],
  "org": "Amazon Technologies Inc.",
  "data": "HTTP/1.1 404 Not Found\r\nDate: Fri, 24 Apr 2026 09:41:33 GMT\r\nContent-Type: text/plain\r\nContent-Length: 0\r\n\r\n",
  "asn": "AS16509",
  "cpe23": [
    "cpe:2.3:a:helpsystems:cobalt_strike"
  ],
  "isp": "Amazon.com, Inc.",
  "cpe": [
    "cpe:/a:helpsystems:cobalt_strike"
  ],
  "domains": [
    "amazonaws.com"
  ],
  "ip_str": "34.214.106.56",
  "os": null,
  "_shodan": {
    "region": "na",
    "crawler": "1ad7dd0071d724b916894d677e734fae1da92142",
    "options": {},
    "module": "https",
    "id": "b725b925-5533-415a-8ab6-6cfa6d8d416d"
  }
}