98.80.179.181
C2 Infrastructure CobaltStrike Indicator 98.80.179.181 Type ip Category C2 Infrastructure Family CobaltStrike Hosting AWS Confidence high VT Score 6/94 Source shodan First Seen 2026-08-13 16:00:27 UTC Last Seen 2026-08-28 00:00:24 UTC Shodan View on Shodan ↗
Raw JSON
{
"ip": 1649456053,
"http": {
"status": 404,
"robots_hash": null,
"redirects": [],
"title_hash": null,
"securitytxt": null,
"title": null,
"sitemap_hash": null,
"robots": null,
"dom_hash": 0,
"components_hash": 0,
"headers_hash": 2129120964,
"host": "pr-654-op-2-ip-98-80-179-181.preview.control.xoeye.com",
"html": "",
"server_hash": null,
"location": "/",
"components": {},
"securitytxt_hash": null,
"headers": {
"date": "Thu, 13 Aug 2026 11:06:33 GMT",
"content-length": "0",
"content-type": "text/plain"
},
"server": null,
"sitemap": null,
"html_hash": 0
},
"port": 443,
"transport": "tcp",
"cpe23_hash": -527748401,
"cloud": {
"region": "us-east-1",
"service": "EC2",
"provider": "Amazon"
},
"location": {
"city": "Ashburn",
"region_code": "VA",
"area_code": null,
"longitude": -77.48749,
"latitude": 39.04372,
"country_code": "US",
"country_name": "United States"
},
"product": "Cobalt Strike Beacon",
"hash": 1326189531,
"tags": [
"cloud"
],
"timestamp": "2026-08-13T11:06:33.822718",
"ssl": {
"chain_sha256": [
"463fbacaae73739e6d3a84241ef5be0078744f6ed0a3812c5d25b202d4054805",
"97658de8c68dfa98ace1e5028a63d54a1aae911b3e21471076c6850cd08cbab4",
"0fc0901cca2bae9e9fdbb02d50d02f1094f7b36672086991b9e897626dc485f0",
"ee5f7abd6981bb0255632cd8f49283451b4b18844d12040b44ee00f07b8fe2c6"
],
"jarm": "28d28d28d00028d00042d42d00042de0d120da90d5910c5de2af43b74a6bd8",
"tlsext": [
{
"id": 43,
"name": "supported_versions"
},
{
"id": 51,
"name": "key_share"
},
{
"id": 10,
"name": "supported_groups"
}
],
"chain": [
"-----BEGIN CERTIFICATE-----\nMIIDrjCCAzOgAwIBAgISBu0mvW4/dXjAQ0YZMfg5kC5qMAoGCCqGSM49BAMDMDMx\nCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZ\nRTIwHhcNMjYwODEwMDgwNTU4WhcNMjYxMTA4MDgwNTU3WjAaMRgwFgYDVQQDEw9t\ndGhtbGxwLXZwbi5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASobiiCnl9q\nn+tdVZJRg0sgBOYxOgPEFiWu8iGUVEP1/eQTiPbYz3qHmmdTBep3bF043IHzjGpg\nojT8mGLtJtleo4ICPjCCAjowDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsG\nAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFBr/LUPlJh9S7r/8ho2kEfi9\nQO/3MB8GA1UdIwQYMBaAFLlZ8o7PIvCG0zdI/3YUGLqC2FWHMDMGCCsGAQUFBwEB\nBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3llMi5pLmxlbmNyLm9yZy8wOQYDVR0R\nBDIwMIIdZDExanpmemoyejJ1ZTkuY2xvdWRmcm9udC5uZXSCD210aG1sbHAtdnBu\nLmNvbTATBgNVHSAEDDAKMAgGBmeBDAECATAvBgNVHR8EKDAmMCSgIqAghh5odHRw\nOi8veWUyLmMubGVuY3Iub3JnLzEwNy5jcmwwggENBgorBgEEAdZ5AgQCBIH+BIH7\nAPkAdgDXbX0Q0af1d8LH6V/XAL/5gskzWmXh0LMBcxfAyMVpdwAAAZ/q6pE5AAAE\nAwBHMEUCIQCg4u1Aep4IQDHAWT5mCwfyjSZ/qV80Ed9xbqQQe6c/owIgUPTMaCBO\nkD+0hcTh0Mog3xzv9eBKPpcpfidu/5mA6RMAfwAai51rD/6/gbR5OcbSMQqG1tEC\n1PBG4hgsneNfXiYl7wAAAZ/q6pUiAAgAAAUAM0PIsAQDAEgwRgIhAN/Nxhs0z8O2\nKmTY75u6OcSiwisOws40I0Qq90GlJenUAiEAjtNwLIqO3BlKKeui/o7hQ1efiy4U\n3rdZ84yJEy7gf6owCgYIKoZIzj0EAwMDaQAwZgIxAL41NKixavn0T0j568Coq6fQ\nI1u4RUa6xeF9EOx+c5RKUVjgf9er+U9+VP85Mys4mwIxAIa7ZhUMWB/Gvm7rb+7x\nyyIzin/dmMBGCjqy/Wm2pHq5rzrUaVRlNst5G0aUWCUE7g==\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMIICjDCCAhGgAwIBAgIQTfOxXdbAeExQfNN7WObxFTAKBggqhkjOPQQDAzAuMQsw\nCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTAeFw0y\nNTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYD\nVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTIwdjAQBgcqhkjOPQIBBgUr\ngQQAIgNiAARxmrQzkdbEEL3MqXt3dJQttYc47axkdDTHud5TPqM2z5uSD5cmk0Wr\nHlWXvnlvqBLqiB34kluxIbmMyAiq3/YD6e80/vV259K8XQIdjFXloYOa0mIU71f7\nHQ09PvYDlw+jge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUF\nBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFLlZ8o7PIvCG0zdI/3YU\nGLqC2FWHMB8GA1UdIwQYMBaAFKPIJlqOoUzQNWP8myPIOq5W809WMDIGCCsGAQUF\nBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3llLmkubGVuY3Iub3JnLzATBgNV\nHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veWUuYy5s\nZW5jci5vcmcvMAoGCCqGSM49BAMDA2kAMGYCMQDIcnw5dcZLN9ffynXnnkLD/itS\nJEycJPb3sRkzeqBowup7vOsAwaqoCnNn/jh9wycCMQCJM6CPlaOC4pQYYbJtVPYb\nDKrIb2EKk5NpOpE6/XttQYZV/3gilB9l+Cc/DOVwmyg=\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMIICpjCCAiugAwIBAgIRAIchZfw0tuX7qK3Vs3BftTowCgYIKoZIzj0EAwMwTzEL\nMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNo\nIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDIwHhcNMjYwNTEzMDAwMDAwWhcN\nMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4G\nA1UEAxMHUm9vdCBZRTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDwS/6vhrcVqcbBo\n+wgdI3fwn9x7DNJJOY/lTOti0vkwuRN87RhEhTH17E7XyFjWsPYhIPt/wzOqxTd2\nb+4ZJNy9ID04YywF9U5zasDVyGSNErVNtz8uSGh5izW87j77GaOB6zCB6DAOBgNV\nHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB\n/zAdBgNVHQ4EFgQUo8gmWo6hTNA1Y/ybI8g6rlbzT1YwHwYDVR0jBBgwFoAUfEKW\nrt5LSDv6kviejM9ti6lyN5UwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZo\ndHRwOi8veDIuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1Ud\nHwQgMB4wHKAaoBiGFmh0dHA6Ly94Mi5jLmxlbmNyLm9yZy8wCgYIKoZIzj0EAwMD\naQAwZgIxAMU19WCtmxVND8UHBZRoma49Z7jPs64Dma0eTu1OChVbB/2J7GV3nvYK\nAx54uk1G9QIxAO0miLVJu8PLNiXXXkiE/gsK3CTRTF/aeo4bMX42Zw40csRU6AC2\n6hSW1/IWaas6dg==\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMIIEcDCCAligAwIBAgIQbI8dxyfHEX97r4U6yYD5zTANBgkqhkiG9w0BAQsFADBP\nMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy\nY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNjA1MTMwMDAwMDBa\nFw0zMjA5MDIyMzU5NTlaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5l\ndCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgy\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0H\nttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7\nAlF9ItgKbppbd9/w+kHsOdx1ymgHDB/qo4H1MIHyMA4GA1UdDwEB/wQEAwIBBjAd\nBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAd\nBgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwHwYDVR0jBBgwFoAUebRZ5nu2\n5eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRw\nOi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQg\nMB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcNAQELBQAD\nggIBAD2/e9frmMxNpCV03qUHegg+MV2wz9644YoXdqtH8RyWYcBO7xfjjGEXdU1e\n/o0OkEFiynUCOSIk/vLLo7ttz6CPAeNlWfC0XNkoGeWgK6jjXvozBaGuGH5n0Ufo\nshMeWTuURqNN5G00sSXDTBrpp2+mgvdZQjb8K11TYMA25QA+YHNfbIEL0BniAhKS\n2gsnJjSzrdZLI+EZ7SEyqdR2rkjd1KutLDU+n3TFyxjniZVGur4YlhMP3mY/dV95\nIruAkkjOZier6hGBdEgZXXvaCz9u9iVEadsIE75pAGL8oHV5vxdARDiotRpul1IN\n/UZwzAbrfUFcw1HkAcYD/mlZfnQ2ieCF2MS7j3Vhv7JPDKp45fmykmzYNSrumRW0\nupFFKDBOoF7hsOb7oLyHS+Uft6jOUfOrogj8YUx38hKb2K20r42OgsSdDdxdeYWc\nMS3Sb6mwJeSZEYxJ2gaXnDSPaKhhrNkYwljyVQyr4Nq+MEJytXNTnHqaAcrNwZlV\npcJL1KBnMrMjP7eanvUwL3FYj3cF17jtboLt7gLoi4+2rWZFvn+w54jmd/FIuhhZ\ncEaU/wvU6BUNMtcVquVGHp7itQeDth5j+XL3j4WJ2SABwzUl6OeYdgpIt/ITZa+p\nTT0mQ/r5XyA4MEAiabn7XJjvCERlF2dcn2wqJw+CreTkkQ2R\n-----END CERTIFICATE-----\n"
],
"versions": [
"-TLSv1",
"-SSLv2",
"-SSLv3",
"-TLSv1.1",
"TLSv1.2",
"TLSv1.3"
],
"acceptable_cas": [],
"alpn": [],
"cert": {
"sig_alg": "ecdsa-with-SHA384",
"issued": "20260810080558Z",
"expires": "20261108080557Z",
"pubkey": {
"bits": 256,
"type": "dsa"
},
"version": 2,
"extensions": [
{
"critical": true,
"data": "\\x03\\x02\\x07\\x80",
"name": "keyUsage"
},
{
"data": "0\\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01",
"name": "extendedKeyUsage"
},
{
"critical": true,
"data": "0\\x00",
"name": "basicConstraints"
},
{
"data": "\\x04\\x14\\x1a\\xff-C\\xe5&\\x1fR\\xee\\xbf\\xfc\\x86\\x8d\\xa4\\x11\\xf8\\xbd@\\xef\\xf7",
"name": "subjectKeyIdentifier"
},
{
"data": "0\\x16\\x80\\x14\\xb9Y\\xf2\\x8e\\xcf\"\\xf0\\x86\\xd37H\\xffv\\x14\\x18\\xba\\x82\\xd8U\\x87",
"name": "authorityKeyIdentifier"
},
{
"data": "0%0#\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86\\x17http://ye2.i.lencr.org/",
"name": "authorityInfoAccess"
},
{
"data": "00\\x82\\x1dd11jzfzj2z2ue9.cloudfront.net\\x82\\x0fmthmllp-vpn.com",
"name": "subjectAltName"
},
{
"data": "0\\n0\\x08\\x06\\x06g\\x81\\x0c\\x01\\x02\\x01",
"name": "certificatePolicies"
},
{
"data": "0&0$\\xa0\"\\xa0 \\x86\\x1ehttp://ye2.c.lencr.org/107.crl",
"name": "crlDistributionPoints"
},
{
"data": "\\x04\\x81\\xfb\\x00\\xf9\\x00v\\x00\\xd7m}\\x10\\xd1\\xa7\\xf5w\\xc2\\xc7\\xe9_\\xd7\\x00\\xbf\\xf9\\x82\\xc93Ze\\xe1\\xd0\\xb3\\x01s\\x17\\xc0\\xc8\\xc5iw\\x00\\x00\\x01\\x9f\\xea\\xea\\x919\\x00\\x00\\x04\\x03\\x00G0E\\x02!\\x00\\xa0\\xe2\\xed@z\\x9e\\x08@1\\xc0Y>f\\x0b\\x07\\xf2\\x8d&\\x7f\\xa9_4\\x11\\xdfqn\\xa4\\x10{\\xa7?\\xa3\\x02 P\\xf4\\xcch N\\x90?\\xb4\\x85\\xc4\\xe1\\xd0\\xca \\xdf\\x1c\\xef\\xf5\\xe0J>\\x97)~\\'n\\xff\\x99\\x80\\xe9\\x13\\x00\\x7f\\x00\\x1a\\x8b\\x9dk\\x0f\\xfe\\xbf\\x81\\xb4y9\\xc6\\xd21\\n\\x86\\xd6\\xd1\\x02\\xd4\\xf0F\\xe2\\x18,\\x9d\\xe3_^&%\\xef\\x00\\x00\\x01\\x9f\\xea\\xea\\x95\"\\x00\\x08\\x00\\x00\\x05\\x003C\\xc8\\xb0\\x04\\x03\\x00H0F\\x02!\\x00\\xdf\\xcd\\xc6\\x1b4\\xcf\\xc3\\xb6*d\\xd8\\xef\\x9b\\xba9\\xc4\\xa2\\xc2+\\x0e\\xc2\\xce4#D*\\xf7A\\xa5%\\xe9\\xd4\\x02!\\x00\\x8e\\xd3p,\\x8a\\x8e\\xdc\\x19J)\\xeb\\xa2\\xfe\\x8e\\xe1CW\\x9f\\x8b.\\x14\\xde\\xb7Y\\xf3\\x8c\\x89\\x13.\\xe0\\x7f\\xaa",
"name": "ct_precert_scts"
}
],
"fingerprint": {
"sha256": "463fbacaae73739e6d3a84241ef5be0078744f6ed0a3812c5d25b202d4054805",
"sha1": "7053344159c272d98568a81b63ea3b753c8e61da"
},
"serial": 6.033721307948628e+41,
"issuer": {
"C": "US",
"CN": "YE2",
"O": "Let's Encrypt"
},
"expired": false,
"subject": {
"CN": "mthmllp-vpn.com"
}
},
"cipher": {
"version": "TLSv1.3",
"bits": 256,
"name": "TLS_AES_256_GCM_SHA384"
},
"trust": {
"revoked": false,
"browser": null
},
"handshake_states": [
"before SSL initialization",
"SSLv3/TLS write client hello",
"SSLv3/TLS read server hello",
"TLSv1.3 read encrypted extensions",
"SSLv3/TLS read server certificate",
"TLSv1.3 read server certificate verify",
"SSLv3/TLS read finished",
"SSLv3/TLS write change cipher spec",
"SSLv3/TLS write finished",
"SSL negotiation finished successfully"
],
"ja3s": "f03a69cfa3944d6d51bc52febd87a1a8",
"ocsp": {}
},
"hostnames": [
"mthmllp-vpn.com",
"pr-654-op-2-ip-98-80-179-181.preview.control.xoeye.com",
"ec2-98-80-179-181.compute-1.amazonaws.com",
"d11jzfzj2z2ue9.cloudfront.net"
],
"org": "Amazon Data Services NoVa",
"data": "HTTP/1.1 404 Not Found\r\nDate: Thu, 13 Aug 2026 11:06:33 GMT\r\nContent-Type: text/plain\r\nContent-Length: 0\r\n\r\n",
"asn": "AS14618",
"cpe23": [
"cpe:2.3:a:helpsystems:cobalt_strike"
],
"isp": "Amazon.com, Inc.",
"cpe": [
"cpe:/a:helpsystems:cobalt_strike"
],
"domains": [
"mthmllp-vpn.com",
"xoeye.com",
"amazonaws.com",
"cloudfront.net"
],
"ip_str": "98.80.179.181",
"os": null,
"_shodan": {
"region": "sea",
"crawler": "cd325cb7ad6b62a8a038a33a591780c6fe9a8d6e",
"options": {
"hostname": "pr-654-op-2-ip-98-80-179-181.preview.control.xoeye.com"
},
"module": "https",
"id": "595d1dd4-b03b-408f-a9f5-0c06930dd602"
}
}