160.202.230.103

{
  "hash": -1716118406,
  "cobalt_strike_beacon": {
    "x86": {
      "beacon_type": "HTTP",
      "dns-beacon.strategy_rotate_seconds": -1,
      "useragent_header": "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; BOIE9;ENUS)",
      "http-post.client": [
        "Content-Type: application/octet-stream",
        "id"
      ],
      "maxgetsize": 1048576,
      "post-ex.spawnto_x86": "%windir%\\syswow64\\rundll32.exe",
      "port": 80,
      "sleeptime": 60000,
      "uses_cookies": 1,
      "proxy.behavior": "2 (Use IE settings)",
      "process-inject.execute": [
        "CreateThread",
        "SetThreadContext",
        "CreateRemoteThread",
        "RtlCreateUserThread"
      ],
      "process-inject.startrwx": 64,
      "post-ex.spawnto_x64": "%windir%\\sysnative\\rundll32.exe",
      "process-inject.stub": "40ed048138df0b3e23a0ef24dc5efa1a",
      "http-get.uri": "160.202.230.103,/visit.js",
      "watermark": 666666666,
      "dns-beacon.strategy_fail_seconds": -1,
      "server.publickey_md5": "134bb8ea16a277791b446d60b6a2b49a",
      "dns-beacon.strategy_fail_x": -1,
      "http-post.verb": "POST",
      "http-post.uri": "/submit.php",
      "process-inject.userwx": 64,
      "http-get.verb": "GET",
      "http-get.client": [
        "Cookie"
      ]
    }
  },
  "product": "Cobalt Strike Beacon",
  "http": {
    "status": 404,
    "robots_hash": null,
    "redirects": [],
    "title_hash": null,
    "securitytxt": null,
    "title": null,
    "sitemap_hash": null,
    "robots": null,
    "dom_hash": 0,
    "headers_hash": 2129120964,
    "host": "160.202.230.103",
    "html": "",
    "server_hash": null,
    "location": "/",
    "components": {},
    "securitytxt_hash": null,
    "server": null,
    "sitemap": null,
    "html_hash": 0
  },
  "os": null,
  "transport": "tcp",
  "timestamp": "2026-06-20T14:29:59.330939",
  "isp": "Hubei Feixun Network Co., Ltd",
  "cpe23": [
    "cpe:2.3:a:helpsystems:cobalt_strike"
  ],
  "cpe": [
    "cpe:/a:helpsystems:cobalt_strike"
  ],
  "_shodan": {
    "region": "na",
    "crawler": "882b86ace587f9a0c7e7358585830fb0a6fff519",
    "options": {},
    "module": "http",
    "id": "229ddb00-67b9-4b46-8de7-c8da9363cc0f"
  },
  "asn": "AS146817",
  "hostnames": [],
  "location": {
    "city": "Hubei",
    "region_code": "SX",
    "area_code": null,
    "longitude": 112.01144,
    "latitude": 38.99842,
    "country_code": "CN",
    "country_name": "China"
  },
  "ip": 2697651815,
  "domains": [],
  "org": "Hubei Feixun Network Co., Ltd",
  "data": "HTTP/1.1 404 Not Found\r\nDate: Sat, 20 Jun 2026 14:29:59 GMT\r\nContent-Type: text/plain\r\nContent-Length: 0\r\n\r\n\nCobalt Strike Beacon:\n  x86:\n    beacon_type: HTTP\n    dns-beacon.strategy_fail_seconds: -1\n    dns-beacon.strategy_fail_x: -1\n    dns-beacon.strategy_rotate_seconds: -1\n    http-get.client:\n      Cookie\n    http-get.uri: 160.202.230.103,/visit.js\n    http-get.verb: GET\n    http-post.client:\n      Content-Type: application/octet-stream\n      id\n    http-post.uri: /submit.php\n    http-post.verb: POST\n    maxgetsize: 1048576\n    port: 80\n    post-ex.spawnto_x64: %windir%\\sysnative\\rundll32.exe\n    post-ex.spawnto_x86: %windir%\\syswow64\\rundll32.exe\n    process-inject.execute:\n      CreateThread\n      SetThreadContext\n      CreateRemoteThread\n      RtlCreateUserThread\n    process-inject.startrwx: 64\n    process-inject.stub: 40ed048138df0b3e23a0ef24dc5efa1a\n    process-inject.userwx: 64\n    proxy.behavior: 2 (Use IE settings)\n    server.publickey_md5: 134bb8ea16a277791b446d60b6a2b49a\n    sleeptime: 60000\n    useragent_header: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; BOIE9;ENUS)\n    uses_cookies: 1\n    watermark: 666666666\n",
  "port": 80,
  "ip_str": "160.202.230.103"
}