51.222.87.16
C2 Infrastructure CobaltStrike Indicator 51.222.87.16 Type ip Category C2 Infrastructure Family CobaltStrike Hosting OVH Confidence high VT Score 14/94 Source shodan First Seen 2026-08-06 16:00:26 UTC Last Seen 2026-08-20 16:00:45 UTC Shodan View on Shodan ↗
Raw JSON
{
"cobalt_strike_beacon": {
"x86": {
"beacon_type": "HTTP",
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)",
"http-post.client": [
"Content-Type: application/octet-stream",
"id"
],
"maxgetsize": 1048576,
"post-ex.spawnto_x86": "%windir%\\syswow64\\rundll32.exe",
"port": 433,
"sleeptime": 60000,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"CreateThread",
"SetThreadContext",
"CreateRemoteThread",
"RtlCreateUserThread"
],
"process-inject.startrwx": 64,
"post-ex.spawnto_x64": "%windir%\\sysnative\\rundll32.exe",
"process-inject.stub": "a49f5445f01a9f3240eea9e46ee66c81",
"http-get.uri": "cdn.sys-update.online,/dpixel",
"watermark": 426352781,
"dns-beacon.strategy_fail_seconds": -1,
"host_header": "Host: cdn.sys-update.online\r\n",
"server.publickey_md5": "4ba5c65fc1b69422f8b27e7e43101e15",
"dns-beacon.strategy_fail_x": -1,
"http-post.verb": "POST",
"http-post.uri": "/submit.php",
"process-inject.userwx": 64,
"http-get.verb": "GET",
"http-get.client": [
"Cookie"
]
},
"x64": {
"beacon_type": "HTTP",
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSSEM)",
"http-post.client": [
"Content-Type: application/octet-stream",
"id"
],
"maxgetsize": 1048576,
"post-ex.spawnto_x86": "%windir%\\syswow64\\rundll32.exe",
"port": 433,
"sleeptime": 60000,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"CreateThread",
"SetThreadContext",
"CreateRemoteThread",
"RtlCreateUserThread"
],
"process-inject.startrwx": 64,
"post-ex.spawnto_x64": "%windir%\\sysnative\\rundll32.exe",
"process-inject.stub": "a49f5445f01a9f3240eea9e46ee66c81",
"http-get.uri": "cdn.sys-update.online,/IE9CompatViewList.xml",
"watermark": 426352781,
"dns-beacon.strategy_fail_seconds": -1,
"host_header": "Host: cdn.sys-update.online\r\n",
"server.publickey_md5": "4ba5c65fc1b69422f8b27e7e43101e15",
"dns-beacon.strategy_fail_x": -1,
"http-post.verb": "POST",
"http-post.uri": "/submit.php",
"process-inject.userwx": 64,
"http-get.verb": "GET",
"http-get.client": [
"Cookie"
]
}
},
"ip": 870209296,
"http": {
"status": 404,
"robots_hash": null,
"redirects": [],
"title_hash": null,
"securitytxt": null,
"title": null,
"sitemap_hash": null,
"robots": null,
"dom_hash": 0,
"components_hash": 1840820445,
"headers_hash": -1692967738,
"host": "51.222.87.16",
"html": "",
"server_hash": -1340961475,
"location": "/",
"components": {
"Nginx": {
"categories": [
"Web servers",
"Reverse proxies"
]
}
},
"securitytxt_hash": null,
"headers": {
"date": "Thu, 06 Aug 2026 15:13:46 GMT",
"content-length": "0",
"content-type": "text/plain",
"connection": "keep-alive",
"server": "nginx"
},
"server": "nginx",
"sitemap": null,
"html_hash": 0
},
"port": 443,
"transport": "tcp",
"cpe23_hash": 876207692,
"location": {
"city": "Beauharnois",
"region_code": "QC",
"area_code": null,
"longitude": -73.8725,
"latitude": 45.31341,
"country_code": "CA",
"country_name": "Canada"
},
"product": "Cobalt Strike Beacon",
"hash": -1002988130,
"timestamp": "2026-08-06T15:13:46.892968",
"ssl": {
"chain_sha256": [
"726a2763706e9c91b70fb18d7e5298812f489c3bb3b453e26fefe69f73e0af09"
],
"jarm": "3fd3fd0003fd3fd21c42d42d000000bdfc58c9a46434368cf60aa440385763",
"tlsext": [
{
"id": 43,
"name": "supported_versions"
},
{
"id": 51,
"name": "key_share"
},
{
"id": 0,
"name": "server_name"
}
],
"chain": [
"-----BEGIN CERTIFICATE-----\nMIIEFTCCAv2gAwIBAgIUffzwcz0yi9+JVi/PX2S4jWE0GtowDQYJKoZIhvcNAQEL\nBQAwgagxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH\nEw1TYW4gRnJhbmNpc2NvMRkwFwYDVQQKExBDbG91ZGZsYXJlLCBJbmMuMRswGQYD\nVQQLExJ3d3cuY2xvdWRmbGFyZS5jb20xNDAyBgNVBAMTK01hbmFnZWQgQ0EgNmZm\nZGIwMmZkZGZlOGUxNTlmOGMzYmRiZDcxYjYzYWMwHhcNMjYwMzA1MTQyODAwWhcN\nMzYwMzAyMTQyODAwWjAiMQswCQYDVQQGEwJVUzETMBEGA1UEAxMKQ2xvdWRmbGFy\nZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKFVx8tfGeeKCLrqaaqm\nlUuj5vxlGCUtuGgNusi5t722V7LtgbUm+I5Ql55OWPjeVHnl6MyT0pIEZoM+oJEL\na/ecziQaarEuqqYlAqr2tq8IIWvkgNiaTW5TpMyvjj77UM4S0g/fU1PfmAh8elsE\nzOahbs0xs3ialGoQNTYj4VY25/txup9MO7kGi4I4+qNUUwD/yVI4CHzcDYzmgOq6\n/viSf0SqACOAstXAL95yMh8L+wNRDhvlKXjG91BBsmvlmPQeIwYhQ0HUBYyNpkhq\nh3PjE4vJF4uvhmfWvFkzGrxCOLk5mUUfs3afhIclfLlK0ksQ8mxFTr53qlkT/D+h\nQesCAwEAAaOBuzCBuDATBgNVHSUEDDAKBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAA\nMB0GA1UdDgQWBBSafxkQ1N9P1J0PirQSAHgCMQw5HDAfBgNVHSMEGDAWgBRyeGxC\n4ZNPwseJaas5rB/h3pMONjBTBgNVHR8ETDBKMEigRqBEhkJodHRwOi8vY3JsLmNs\nb3VkZmxhcmUuY29tL2UxYzQwZThlLWU2MDItNDAyZi05NjQ2LWQ2YTI0YjIyNmUx\nMC5jcmwwDQYJKoZIhvcNAQELBQADggEBABoNI4OfuvhYzWHfGElQxQ84OaU5776j\nl17ZFdeDuE+CcT5p3EU/v69+8PWeRzdLY8i4yzRmoA1qh/cZ9L2BZDKrhtoq/Ja1\n2COVuxN/Rbwy4zwQxCY19o8cjEEi+CeQsH+strAt1WUKne7UGuzfQQp1mxlmqb5O\nH9wU6maWBwPhnhn+15LGbrnu7psqO1JJFfrTwhnFFdVv3LweenfSFIZqIT1BENjt\nYh6razM3n9yLcNiN6mXAuXvkyJZhwJVXxdry9tGgo34psDoMpw7v3R8tWT6agcfG\nV3m9QhdAhQ+FMPExB91G5IndQarKZ4QBHOUdx/qMWiv9q0RHMCQpJc8=\n-----END CERTIFICATE-----\n"
],
"versions": [
"-TLSv1",
"-SSLv2",
"-SSLv3",
"TLSv1.1",
"TLSv1.2",
"TLSv1.3"
],
"acceptable_cas": [],
"alpn": [],
"cert": {
"sig_alg": "sha256WithRSAEncryption",
"issued": "20260305142800Z",
"expires": "20360302142800Z",
"pubkey": {
"bits": 2048,
"type": "rsa"
},
"version": 2,
"extensions": [
{
"data": "0\\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02",
"name": "extendedKeyUsage"
},
{
"critical": true,
"data": "0\\x00",
"name": "basicConstraints"
},
{
"data": "\\x04\\x14\\x9a\\x7f\\x19\\x10\\xd4\\xdfO\\xd4\\x9d\\x0f\\x8a\\xb4\\x12\\x00x\\x021\\x0c9\\x1c",
"name": "subjectKeyIdentifier"
},
{
"data": "0\\x16\\x80\\x14rxlB\\xe1\\x93O\\xc2\\xc7\\x89i\\xab9\\xac\\x1f\\xe1\\xde\\x93\\x0e6",
"name": "authorityKeyIdentifier"
},
{
"data": "0J0H\\xa0F\\xa0D\\x86Bhttp://crl.cloudflare.com/e1c40e8e-e602-402f-9646-d6a24b226e10.crl",
"name": "crlDistributionPoints"
}
],
"fingerprint": {
"sha256": "726a2763706e9c91b70fb18d7e5298812f489c3bb3b453e26fefe69f73e0af09",
"sha1": "7c6748130262526fd1f7c9b0771b05c20cc0adea"
},
"serial": 7.192645803054508e+47,
"issuer": {
"C": "US",
"CN": "Managed CA 6ffdb02fddfe8e159f8c3bdbd71b63ac",
"L": "San Francisco",
"O": "Cloudflare, Inc.",
"ST": "California",
"OU": "www.cloudflare.com"
},
"expired": false,
"subject": {
"C": "US",
"CN": "Cloudflare"
}
},
"cipher": {
"version": "TLSv1.3",
"bits": 256,
"name": "TLS_AES_256_GCM_SHA384"
},
"trust": {
"revoked": false,
"browser": null
},
"handshake_states": [
"before SSL initialization",
"SSLv3/TLS write client hello",
"SSLv3/TLS read server hello",
"TLSv1.3 read encrypted extensions",
"SSLv3/TLS read server certificate",
"TLSv1.3 read server certificate verify",
"SSLv3/TLS read finished",
"SSLv3/TLS write change cipher spec",
"SSLv3/TLS write finished",
"SSL negotiation finished successfully"
],
"ja3s": "574866101f64002c6421cc329e4d5458",
"ocsp": {}
},
"mac": {
"6F:FD:B0:2F:DD:FE": null
},
"hostnames": [
"vps-a72af7c5.vps.ovh.ca"
],
"org": "OVH Hosting, Inc.",
"data": "HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Thu, 06 Aug 2026 15:13:46 GMT\r\nContent-Type: text/plain\r\nContent-Length: 0\r\nConnection: keep-alive\r\n\r\n\nCobalt Strike Beacon:\n x86:\n beacon_type: HTTP\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n host_header: Host: cdn.sys-update.online\r\n\n http-get.client:\n Cookie\n http-get.uri: cdn.sys-update.online,/dpixel\n http-get.verb: GET\n http-post.client:\n Content-Type: application/octet-stream\n id\n http-post.uri: /submit.php\n http-post.verb: POST\n maxgetsize: 1048576\n port: 433\n post-ex.spawnto_x64: %windir%\\sysnative\\rundll32.exe\n post-ex.spawnto_x86: %windir%\\syswow64\\rundll32.exe\n process-inject.execute:\n CreateThread\n SetThreadContext\n CreateRemoteThread\n RtlCreateUserThread\n process-inject.startrwx: 64\n process-inject.stub: a49f5445f01a9f3240eea9e46ee66c81\n process-inject.userwx: 64\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: 4ba5c65fc1b69422f8b27e7e43101e15\n sleeptime: 60000\n useragent_header: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)\n uses_cookies: 1\n watermark: 426352781\n x64:\n beacon_type: HTTP\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n host_header: Host: cdn.sys-update.online\r\n\n http-get.client:\n Cookie\n http-get.uri: cdn.sys-update.online,/IE9CompatViewList.xml\n http-get.verb: GET\n http-post.client:\n Content-Type: application/octet-stream\n id\n http-post.uri: /submit.php\n http-post.verb: POST\n maxgetsize: 1048576\n port: 433\n post-ex.spawnto_x64: %windir%\\sysnative\\rundll32.exe\n post-ex.spawnto_x86: %windir%\\syswow64\\rundll32.exe\n process-inject.execute:\n CreateThread\n SetThreadContext\n CreateRemoteThread\n RtlCreateUserThread\n process-inject.startrwx: 64\n process-inject.stub: a49f5445f01a9f3240eea9e46ee66c81\n process-inject.userwx: 64\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: 4ba5c65fc1b69422f8b27e7e43101e15\n sleeptime: 60000\n useragent_header: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSSEM)\n uses_cookies: 1\n watermark: 426352781\n",
"asn": "AS16276",
"cpe23": [
"cpe:2.3:a:f5:nginx",
"cpe:2.3:a:helpsystems:cobalt_strike"
],
"isp": "OVH SAS",
"cpe": [
"cpe:/a:f5:nginx",
"cpe:/a:helpsystems:cobalt_strike"
],
"domains": [
"ovh.ca"
],
"ip_str": "51.222.87.16",
"os": null,
"_shodan": {
"region": "na",
"crawler": "667c9d6cc4bbbf0594c20c6f1ba56a8147913fd0",
"options": {},
"module": "https",
"id": "03a71917-a51f-460b-a8c6-dc707deeae85"
}
}