43.156.218.130
C2 Infrastructure CobaltStrike Indicator 43.156.218.130 Type ip Category C2 Infrastructure Family CobaltStrike Hosting Asia Pacific Network Information Center, Pty. Ltd. Confidence high VT Score 5/94 Source shodan First Seen 2026-07-15 16:00:15 UTC Last Seen 2026-07-15 16:00:15 UTC Shodan View on Shodan ↗
Raw JSON
{
"cobalt_strike_beacon": {
"x86": {
"beacon_type": "HTTPS",
"jitter": 50,
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0",
"http-post.client": [
"Accept: */*",
"JSESSION=",
"Cookie"
],
"maxgetsize": 1403639,
"process-inject.min_alloc": 9583,
"post-ex.spawnto_x86": "%windir%\\syswow64\\gpresult.exe",
"port": 443,
"sleeptime": 5000,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"ntdll.dll:RtlUserThreadStart",
"NtQueueApcThread-s",
"SetThreadContext",
"CreateRemoteThread",
"kernel32.dll:LoadLibraryA",
"RtlCreateUserThread"
],
"process-inject.startrwx": 4,
"post-ex.spawnto_x64": "%windir%\\sysnative\\gpresult.exe",
"process-inject.stub": "ae5afcfee8026674dc8f3b4f2da46c7f",
"http-get.uri": "iptest.ip-ddns.com,/app.sdk.js",
"watermark": 987654321,
"dns-beacon.strategy_fail_seconds": -1,
"process-inject.userwx": 32,
"dns-beacon.strategy_fail_x": -1,
"stage.cleanup": 1,
"http-post.verb": "POST",
"http-post.uri": "/token",
"server.publickey_md5": "19569a65d269ab1eb5179137a4b4fc9c",
"process-inject.allocator": 1,
"http-get.verb": "GET",
"http-get.client": [
"Accept: */*",
"SESSION=",
"Cookie"
]
},
"x64": {
"beacon_type": "HTTPS",
"jitter": 50,
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0",
"http-post.client": [
"Accept: */*",
"JSESSION=",
"Cookie"
],
"maxgetsize": 1403639,
"process-inject.min_alloc": 9583,
"post-ex.spawnto_x86": "%windir%\\syswow64\\gpresult.exe",
"port": 443,
"sleeptime": 5000,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"ntdll.dll:RtlUserThreadStart",
"NtQueueApcThread-s",
"SetThreadContext",
"CreateRemoteThread",
"kernel32.dll:LoadLibraryA",
"RtlCreateUserThread"
],
"process-inject.startrwx": 4,
"post-ex.spawnto_x64": "%windir%\\sysnative\\gpresult.exe",
"process-inject.stub": "ae5afcfee8026674dc8f3b4f2da46c7f",
"http-get.uri": "iptest.ip-ddns.com,/home.876567.js",
"watermark": 987654321,
"dns-beacon.strategy_fail_seconds": -1,
"process-inject.userwx": 32,
"dns-beacon.strategy_fail_x": -1,
"stage.cleanup": 1,
"http-post.verb": "POST",
"http-post.uri": "/op-app-log",
"server.publickey_md5": "19569a65d269ab1eb5179137a4b4fc9c",
"process-inject.allocator": 1,
"http-get.verb": "GET",
"http-get.client": [
"Accept: */*",
"SESSION=",
"Cookie"
]
}
},
"ip": 731699842,
"http": {
"status": 404,
"robots_hash": null,
"redirects": [],
"title_hash": null,
"securitytxt": null,
"title": null,
"sitemap_hash": null,
"robots": null,
"dom_hash": 0,
"headers_hash": 2129120964,
"host": "43.156.218.130",
"html": "",
"server_hash": null,
"location": "/",
"components": {},
"securitytxt_hash": null,
"server": null,
"sitemap": null,
"html_hash": 0
},
"port": 8000,
"transport": "tcp",
"location": {
"city": "Singapore",
"region_code": "01",
"area_code": null,
"longitude": 103.85007,
"latitude": 1.28967,
"country_code": "SG",
"country_name": "Singapore"
},
"product": "Cobalt Strike Beacon",
"hash": 90650645,
"timestamp": "2026-06-22T05:32:04.424612",
"ssl": {
"chain_sha256": [
"15870d0296d2758cf924c864385d63b665069bdb82aca94b0fd22fd14fe9a60d"
],
"jarm": "28d28d28d00028d00042d42d00042de0d120da90d5910c5de2af43b74a6bd8",
"tlsext": [
{
"id": 43,
"name": "supported_versions"
},
{
"id": 51,
"name": "key_share"
},
{
"id": 10,
"name": "supported_groups"
}
],
"chain": [
"-----BEGIN CERTIFICATE-----\nMIIDSjCCAjKgAwIBAgIUdgchbiJmez178UUIJo+Cf5Kn6GkwDQYJKoZIhvcNAQEL\nBQAwgagxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH\nEw1TYW4gRnJhbmNpc2NvMRkwFwYDVQQKExBDbG91ZGZsYXJlLCBJbmMuMRswGQYD\nVQQLExJ3d3cuY2xvdWRmbGFyZS5jb20xNDAyBgNVBAMTK01hbmFnZWQgQ0EgMDkz\nNDNiMTk2NzllZDNjZGQ2YThmOTAzZDg1MGIzZWIwHhcNMjQxMjI2MDYyOTAwWhcN\nMzQxMjI0MDYyOTAwWjAiMQswCQYDVQQGEwJVUzETMBEGA1UEAxMKQ2xvdWRmbGFy\nZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABHf1Uctc2o0g0m19EL5MKtNiiQr8\nlh/yDNiKUtbWHliCNXplmo0r1LAfJvBn9FhlnFjfBPFqn7TieCPjh9yxY7yjgbsw\ngbgwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQU\nizmtE7pTp4JJ25ExSv+31NUMMZwwHwYDVR0jBBgwFoAUeethWdabTgjs8+2GyayL\nI9BdUGMwUwYDVR0fBEwwSjBIoEagRIZCaHR0cDovL2NybC5jbG91ZGZsYXJlLmNv\nbS8xNGI2ZjQwMS0zNDA1LTRmNzYtYTQ5Mi1hZjM0OTllZjRlODguY3JsMA0GCSqG\nSIb3DQEBCwUAA4IBAQAqt26V/Ex61N+/xKs5up0jULlfHDt7GV/LoMDXLuxE8EE8\naMpBs4g49M7TuQX0ah2ZSJ/ASiweXQZqr526+stDLx9j1Veq3kQKUnKnSau80YQL\nwQw/mxlKmA7uoZHt9EhNQX17e7mikhSCN/OYRz5m0IvVOKD/iIX+ZV6W/Ss8eRh1\n/B/I4HpHsIIFErFOKNbbQxldeWHqyYueR+1fTmooAtc6C0j6Ni8tQTvh35G/4B+p\nec+Jc6tvZQarrFv+zkhBLz7U2IZRRnoYYFFKwtbjv3rEkn0Q5Dt9r4pdcDsAtluN\nYzxfadCWLLJoZLK/FU9oWwW0/fWouJoAPKKarnJm\n-----END CERTIFICATE-----\n"
],
"versions": [],
"acceptable_cas": [],
"alpn": [],
"cert": {
"sig_alg": "sha256WithRSAEncryption",
"issued": "20241226062900Z",
"expires": "20341224062900Z",
"pubkey": {
"bits": 256,
"type": "dsa"
},
"version": 2,
"extensions": [
{
"data": "0\\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02",
"name": "extendedKeyUsage"
},
{
"critical": true,
"data": "0\\x00",
"name": "basicConstraints"
},
{
"data": "\\x04\\x14\\x8b9\\xad\\x13\\xbaS\\xa7\\x82I\\xdb\\x911J\\xff\\xb7\\xd4\\xd5\\x0c1\\x9c",
"name": "subjectKeyIdentifier"
},
{
"data": "0\\x16\\x80\\x14y\\xebaY\\xd6\\x9bN\\x08\\xec\\xf3\\xed\\x86\\xc9\\xac\\x8b#\\xd0]Pc",
"name": "authorityKeyIdentifier"
},
{
"data": "0J0H\\xa0F\\xa0D\\x86Bhttp://crl.cloudflare.com/14b6f401-3405-4f76-a492-af3499ef4e88.crl",
"name": "crlDistributionPoints"
}
],
"fingerprint": {
"sha256": "15870d0296d2758cf924c864385d63b665069bdb82aca94b0fd22fd14fe9a60d",
"sha1": "12099cab026cab05ae5bd684f95de65252396857"
},
"serial": 6.738199283558248e+47,
"issuer": {
"C": "US",
"CN": "Managed CA 09343b19679ed3cdd6a8f903d850b3eb",
"L": "San Francisco",
"O": "Cloudflare, Inc.",
"ST": "California",
"OU": "www.cloudflare.com"
},
"expired": false,
"subject": {
"C": "US",
"CN": "Cloudflare"
}
},
"cipher": {
"version": "TLSv1.3",
"bits": 256,
"name": "TLS_AES_256_GCM_SHA384"
},
"trust": {
"revoked": false,
"browser": null
},
"handshake_states": [
"before SSL initialization",
"SSLv3/TLS write client hello",
"SSLv3/TLS read server hello",
"TLSv1.3 read encrypted extensions",
"SSLv3/TLS read server certificate",
"TLSv1.3 read server certificate verify",
"SSLv3/TLS read finished",
"SSLv3/TLS write change cipher spec",
"SSLv3/TLS write finished",
"SSL negotiation finished successfully"
],
"ja3s": "f03a69cfa3944d6d51bc52febd87a1a8",
"ocsp": {}
},
"mac": {
"09:34:3B:19:67:9E": null
},
"hostnames": [],
"org": "Asia Pacific Network Information Center, Pty. Ltd.",
"data": "HTTP/1.1 404 Not Found\r\nDate: Mon, 22 Jun 2026 05:32:04 GMT\r\nContent-Type: text/plain\r\nContent-Length: 0\r\n\r\n\nCobalt Strike Beacon:\n x86:\n beacon_type: HTTPS\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n Accept: */*\n SESSION=\n Cookie\n http-get.uri: iptest.ip-ddns.com,/app.sdk.js\n http-get.verb: GET\n http-post.client:\n Accept: */*\n JSESSION=\n Cookie\n http-post.uri: /token\n http-post.verb: POST\n jitter: 50\n maxgetsize: 1403639\n port: 443\n post-ex.spawnto_x64: %windir%\\sysnative\\gpresult.exe\n post-ex.spawnto_x86: %windir%\\syswow64\\gpresult.exe\n process-inject.allocator: 1\n process-inject.execute:\n ntdll.dll:RtlUserThreadStart\n NtQueueApcThread-s\n SetThreadContext\n CreateRemoteThread\n kernel32.dll:LoadLibraryA\n RtlCreateUserThread\n process-inject.min_alloc: 9583\n process-inject.startrwx: 4\n process-inject.stub: ae5afcfee8026674dc8f3b4f2da46c7f\n process-inject.userwx: 32\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: 19569a65d269ab1eb5179137a4b4fc9c\n sleeptime: 5000\n stage.cleanup: 1\n useragent_header: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0\n uses_cookies: 1\n watermark: 987654321\n x64:\n beacon_type: HTTPS\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n Accept: */*\n SESSION=\n Cookie\n http-get.uri: iptest.ip-ddns.com,/home.876567.js\n http-get.verb: GET\n http-post.client:\n Accept: */*\n JSESSION=\n Cookie\n http-post.uri: /op-app-log\n http-post.verb: POST\n jitter: 50\n maxgetsize: 1403639\n port: 443\n post-ex.spawnto_x64: %windir%\\sysnative\\gpresult.exe\n post-ex.spawnto_x86: %windir%\\syswow64\\gpresult.exe\n process-inject.allocator: 1\n process-inject.execute:\n ntdll.dll:RtlUserThreadStart\n NtQueueApcThread-s\n SetThreadContext\n CreateRemoteThread\n kernel32.dll:LoadLibraryA\n RtlCreateUserThread\n process-inject.min_alloc: 9583\n process-inject.startrwx: 4\n process-inject.stub: ae5afcfee8026674dc8f3b4f2da46c7f\n process-inject.userwx: 32\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: 19569a65d269ab1eb5179137a4b4fc9c\n sleeptime: 5000\n stage.cleanup: 1\n useragent_header: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0\n uses_cookies: 1\n watermark: 987654321\n",
"asn": "AS132203",
"cpe23": [
"cpe:2.3:a:helpsystems:cobalt_strike"
],
"isp": "Tencent Building, Kejizhongyi Avenue",
"cpe": [
"cpe:/a:helpsystems:cobalt_strike"
],
"domains": [],
"ip_str": "43.156.218.130",
"os": null,
"_shodan": {
"region": "na",
"module": "http-simple-new",
"ptr": true,
"options": {},
"id": "60a420f6-979e-4b56-93c9-476572ada51b",
"crawler": "eb6a3b0c4c23bbec821e9a56c850ef9b7c5c7f4c"
}
}