191.93.118.254 — intel.lukealbertson.com

Indicator 191.93.118.254 Type ip Category C2 Infrastructure Family AsyncRAT Hosting Colombia Móvil Confidence high VT Score 18/94 Source shodan First Seen 2026-04-18 05:03:23 UTC Last Seen 2026-09-25 16:00:10 UTC Shodan View on Shodan ↗
Raw JSON
{
  "product": "AsyncRAT",
  "hash": 0,
  "os": null,
  "asn": "AS27831",
  "tags": [
    "c2",
    "self-signed"
  ],
  "timestamp": "2026-04-17T23:26:50.559285",
  "isp": "Colombia Móvil",
  "transport": "tcp",
  "_shodan": {
    "region": "na",
    "module": "https-simple-new",
    "ptr": true,
    "options": {},
    "id": "4c0c7447-df80-4422-87b2-cbf0f27ed022",
    "crawler": "fce091bb56e19f2cc04e7cd0f9c8a1c1805d961a"
  },
  "ssl": {
    "chain_sha256": [
      "136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"
    ],
    "jarm": "22b22b00022b22b22b22b22b22b22bd3b67dd3674d9af9dd91c1955a35d0e9",
    "tlsext": [
      {
        "id": 23,
        "name": "extended_master_secret"
      },
      {
        "id": 65281,
        "name": "renegotiation_info"
      }
    ],
    "chain": [
      "-----BEGIN CERTIFICATE-----\nMIIE8jCCAtqgAwIBAgIQAPeWQ4YJ3MvReCGwLzn7rTANBgkqhkiG9w0BAQ0FADAa\nMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwNDI1MDA0MTA5WhgPOTk5\nOTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJ\nKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKT9nYYTjYTZhY+g1tekZ8/F29gsEIDg\nf/8odvCbCmYKGGZZi2yND9NjtBXEMANM9PAXCyMapGvapDPbWgjYkLiMw/Vwa3kZ\nRg7kLpXMpzInLQufe7Q587viilcsGDoVXmnf51/SwsKPjSysZUpyayezUlJ1j6aX\nkZGnasiqJ7iKANdSneQducOn6IwaEuJBmpXKWxhhq8R9JMfiWeOXL/hXoE/wCzwz\nvU/CrzPXd3uMsLfFMDHZJ+OQ9OXKU/CHZNCgSPs4VSgCgM4eK0YTbu1mLsWSo5th\n3/ingNFaTyYmGsmLIE2Jq5AR1A+xA+FEdC8zKL1bAwYQcRgIJs7QdedtAIufepPZ\n9D5HiOiy3ITYVonqwTiiIm20en7UICt+J8iDb4M2Q2iLWA7Yi9PN2cr0Xrs8A4/R\nL29Qe5Ly2k35i74RiBTiT7Jbl2r7PcYlUGcjTCbdB9PWt3dYaTysuamoq2Zuo2HV\nRhhoZpwnajS9vNcjuZCYVoQvUQBUnHTeRZrtHXU5JV59ZBlu7flZneMZnbrWXTxo\nb6Bdt8+hrGoSDMWBFcO4jRzhT3hEFUpu4lSFeb9T3Vx4KWkHJhHtMvHuYgDTXERd\nEcI00sOUbVxgd/62LhGXNNommQKCyiAGj0V5uLD73Fyw8vJpm3jXf3NgNt/Cjnla\nMc40DJ+HlXE5AgMBAAGjMjAwMB0GA1UdDgQWBBQsT2WvtxGUK29SWs4sHz1xYye0\nfzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQCK5sVfnYyT5Mqn\nCg3uHV2ojf12fIVFCY02Cc7gy3DVoE6/xZCPjr22V/xZunZ7DG1nt0kOJKDwdQYn\nGoMc5UPh8jbNRoc1ojLOCaluaIYQyl8AGkmUSRA3Ltk0XetDescffrWT/nKuRvIE\nYU4Ra+B39f8ouGMCa7VXaxnGJ0z0BkUie8KsDLgNmJ7/kVfIYuRxl+YefoCsUTCo\ngqf0fu3DuRHBpUVaSQQOf9YCbvFWH7Nupc3UIwpH5D8kSdpKusEfbRp8nfWN/Fm+\nlzF3THeHU6vNJ+5UoAWHYFW8wfJCbzQ/0L8QZeOv4uy74oQP2Ed0RdrWCwUL6SSs\nDPZdDEOy4K4vVYkDTl1nL5tleATguELAEbbT42oLce85z4C7sKvpEfa4DPbU55xB\nLwvHniILFfjB7VVsrgVckUL/lEf4Y92uJVKvLGruQt/mtKSqIuJjD8T9y7RIsk6g\n9624egV5UtLtv+36kLKhgIJlqC7Xx/PVwMc2yw8BiQlvxQZgqSd1k7QmV1AhV/3z\n2wqnYmb09ibTMYaMFjtamFegeFqc4jRLABhVQFEFv8z5E6G9vgKn5mQDWS/JykAR\nBv9o2BjL/PTADfwAtc1b4nWo0l+CI8IjjYXu/mJOuwR+kFJ19INtwbffQvT9U12t\n4smpcZV+OK0opk4Yr9r1tZYm92ghXA==\n-----END CERTIFICATE-----\n"
    ],
    "versions": [],
    "acceptable_cas": [],
    "alpn": [],
    "cert": {
      "sig_alg": "sha512WithRSAEncryption",
      "issued": "20220425004109Z",
      "expires": "99991231235959Z",
      "pubkey": {
        "bits": 4096,
        "type": "rsa"
      },
      "version": 2,
      "extensions": [
        {
          "data": "\\x04\\x14,Oe\\xaf\\xb7\\x11\\x94+oRZ\\xce,\\x1f=qc\\'\\xb4\\x7f",
          "name": "subjectKeyIdentifier"
        },
        {
          "critical": true,
          "data": "0\\x03\\x01\\x01\\xff",
          "name": "basicConstraints"
        }
      ],
      "fingerprint": {
        "sha256": "136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe",
        "sha1": "c0742fcfac0826954d1fb66f1eab22b391b17590"
      },
      "serial": 1.2855450352684529e+36,
      "issuer": {
        "CN": "AsyncRAT Server"
      },
      "expired": false,
      "subject": {
        "CN": "AsyncRAT Server"
      }
    },
    "cipher": {
      "version": "TLSv1.0",
      "bits": 256,
      "name": "ECDHE-RSA-AES256-SHA"
    },
    "trust": {
      "revoked": false,
      "browser": null
    },
    "handshake_states": [
      "before SSL initialization",
      "SSLv3/TLS write client hello",
      "SSLv3/TLS read server hello",
      "SSLv3/TLS read server certificate",
      "SSLv3/TLS read server key exchange",
      "SSLv3/TLS read server done",
      "SSLv3/TLS write client key exchange",
      "SSLv3/TLS write change cipher spec",
      "SSLv3/TLS write finished",
      "SSLv3/TLS read change cipher spec",
      "SSLv3/TLS read finished",
      "SSL negotiation finished successfully"
    ],
    "ja3s": "b74704234e6128f33bff9865696e31b3",
    "ocsp": {}
  },
  "hostnames": [
    "Dinamic-Tigo-191-93-118-254.tigo.com.co"
  ],
  "location": {
    "city": "Barranquilla",
    "region_code": "ATL",
    "area_code": null,
    "longitude": -74.78132,
    "latitude": 10.96854,
    "country_code": "CO",
    "country_name": "Colombia"
  },
  "ip": 3210573566,
  "domains": [
    "tigo.com.co"
  ],
  "org": "Colombia Móvil",
  "data": "",
  "port": 9000,
  "ip_str": "191.93.118.254"
}