64.227.143.36

{
  "cobalt_strike_beacon": {
    "x86": {
      "beacon_type": "HTTP",
      "sleeptime": 60000,
      "http-post.uri": "/submit.php",
      "dns-beacon.maxdns": 255,
      "proxy.behavior": "2 (Use IE settings)",
      "useragent_header": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; BOIE8;ENUS)",
      "process-inject.startrwx": 64,
      "http-post.client": [
        "Content-Type: application/octet-stream",
        "id"
      ],
      "maxgetsize": 1048576,
      "server.publickey_md5": "55acd3618fe2c08ba9081080846fdbff",
      "crypto_scheme": 1,
      "port": 5555,
      "process-inject.userwx": 64,
      "post-ex.spawnto_x64": "%windir%\\sysnative\\rundll32.exe",
      "http-get.verb": "GET",
      "post-ex.spawnto_x86": "%windir%\\syswow64\\rundll32.exe",
      "http-get.uri": "64.227.143.36,/g.pixel",
      "http-get.client": [
        "Cookie"
      ],
      "http-post.verb": "POST"
    },
    "x64": {
      "beacon_type": "HTTP",
      "sleeptime": 60000,
      "http-post.uri": "/submit.php",
      "dns-beacon.maxdns": 255,
      "proxy.behavior": "2 (Use IE settings)",
      "useragent_header": "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)",
      "process-inject.startrwx": 64,
      "http-post.client": [
        "Content-Type: application/octet-stream",
        "id"
      ],
      "maxgetsize": 1048576,
      "server.publickey_md5": "55acd3618fe2c08ba9081080846fdbff",
      "crypto_scheme": 1,
      "port": 5555,
      "process-inject.userwx": 64,
      "post-ex.spawnto_x64": "%windir%\\sysnative\\rundll32.exe",
      "http-get.verb": "GET",
      "post-ex.spawnto_x86": "%windir%\\syswow64\\rundll32.exe",
      "http-get.uri": "64.227.143.36,/en_US/all.js",
      "http-get.client": [
        "Cookie"
      ],
      "http-post.verb": "POST"
    }
  },
  "ip": 1088655140,
  "http": {
    "status": 404,
    "robots_hash": null,
    "redirects": [],
    "title_hash": null,
    "securitytxt": null,
    "title": null,
    "sitemap_hash": null,
    "robots": null,
    "dom_hash": 0,
    "headers_hash": 2129120964,
    "host": "64.227.143.36",
    "html": "",
    "server_hash": null,
    "location": "/",
    "components": {},
    "securitytxt_hash": null,
    "server": null,
    "sitemap": null,
    "html_hash": 0
  },
  "port": 5555,
  "transport": "tcp",
  "cloud": {
    "region": "in-ka",
    "service": null,
    "provider": "DigitalOcean"
  },
  "location": {
    "city": "Doddaballapura",
    "region_code": "KA",
    "area_code": null,
    "longitude": 77.575,
    "latitude": 13.2257,
    "country_code": "IN",
    "country_name": "India"
  },
  "product": "Cobalt Strike Beacon",
  "hash": -657829880,
  "tags": [
    "cloud"
  ],
  "timestamp": "2026-07-07T07:08:06.500433",
  "hostnames": [],
  "org": "DigitalOcean, LLC",
  "data": "HTTP/1.1 404 Not Found\r\nDate: Tue, 7 Jul 2026 07:09:19 GMT\r\nContent-Type: text/plain\r\nContent-Length: 0\r\n\r\n\nCobalt Strike Beacon:\n  x86:\n    beacon_type: HTTP\n    crypto_scheme: 1\n    dns-beacon.maxdns: 255\n    http-get.client:\n      Cookie\n    http-get.uri: 64.227.143.36,/g.pixel\n    http-get.verb: GET\n    http-post.client:\n      Content-Type: application/octet-stream\n      id\n    http-post.uri: /submit.php\n    http-post.verb: POST\n    maxgetsize: 1048576\n    port: 5555\n    post-ex.spawnto_x64: %windir%\\sysnative\\rundll32.exe\n    post-ex.spawnto_x86: %windir%\\syswow64\\rundll32.exe\n    process-inject.startrwx: 64\n    process-inject.userwx: 64\n    proxy.behavior: 2 (Use IE settings)\n    server.publickey_md5: 55acd3618fe2c08ba9081080846fdbff\n    sleeptime: 60000\n    useragent_header: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; BOIE8;ENUS)\n  x64:\n    beacon_type: HTTP\n    crypto_scheme: 1\n    dns-beacon.maxdns: 255\n    http-get.client:\n      Cookie\n    http-get.uri: 64.227.143.36,/en_US/all.js\n    http-get.verb: GET\n    http-post.client:\n      Content-Type: application/octet-stream\n      id\n    http-post.uri: /submit.php\n    http-post.verb: POST\n    maxgetsize: 1048576\n    port: 5555\n    post-ex.spawnto_x64: %windir%\\sysnative\\rundll32.exe\n    post-ex.spawnto_x86: %windir%\\syswow64\\rundll32.exe\n    process-inject.startrwx: 64\n    process-inject.userwx: 64\n    proxy.behavior: 2 (Use IE settings)\n    server.publickey_md5: 55acd3618fe2c08ba9081080846fdbff\n    sleeptime: 60000\n    useragent_header: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)\n",
  "asn": "AS14061",
  "cpe23": [
    "cpe:2.3:a:helpsystems:cobalt_strike"
  ],
  "isp": "DigitalOcean, LLC",
  "cpe": [
    "cpe:/a:helpsystems:cobalt_strike"
  ],
  "domains": [],
  "ip_str": "64.227.143.36",
  "os": null,
  "_shodan": {
    "region": "na",
    "crawler": "1ad7dd0071d724b916894d677e734fae1da92142",
    "options": {},
    "module": "http-simple-new",
    "id": "541dbf79-10f6-4215-a70f-a25ebc476b37"
  }
}