Indicator 213.111.157.231 Type ip Category C2 Infrastructure Family CobaltStrike Hosting SOLLUTIUM EU Sp z.o.o. Confidence high VT Score 7/94 Source shodan First Seen 2026-08-20 16:00:45 UTC Last Seen 2026-08-20 16:00:45 UTC Shodan View on Shodan ↗
Raw JSON
{
  "ip": 3580861927,
  "http": {
    "status": 404,
    "robots_hash": null,
    "redirects": [],
    "title_hash": null,
    "securitytxt": null,
    "title": null,
    "sitemap_hash": null,
    "robots": null,
    "dom_hash": 0,
    "components_hash": -594756367,
    "headers_hash": 1931294570,
    "host": "213.111.157.231",
    "html": "",
    "server_hash": -43448623,
    "location": "/",
    "components": {
      "Java": {
        "categories": [
          "Programming languages"
        ]
      },
      "Apache Tomcat": {
        "categories": [
          "Web servers"
        ]
      }
    },
    "securitytxt_hash": null,
    "headers": {
      "date": "Mon, 17 Aug 2026 07:35:43 GMT",
      "connection": "close",
      "content-type": "text/html;charset=UTF-8",
      "content-length": "0",
      "server": "Apache-Coyote/1.1"
    },
    "server": "Apache-Coyote/1.1",
    "sitemap": null,
    "html_hash": 0
  },
  "port": 22222,
  "transport": "tcp",
  "cpe23_hash": 765376364,
  "location": {
    "city": "Kyiv",
    "region_code": "30",
    "area_code": null,
    "longitude": 30.5238,
    "latitude": 50.45466,
    "country_code": "UA",
    "country_name": "Ukraine"
  },
  "product": "Cobalt Strike Beacon",
  "hash": -766168196,
  "tags": [
    "self-signed"
  ],
  "timestamp": "2026-08-17T07:35:43.177048",
  "ssl": {
    "chain_sha256": [
      "fef551443ecb8caa540379475a938a965165198738426e90b293cd6dcd15f87b"
    ],
    "jarm": "2ad2ad16d2ad2ad00042d42d00042ddb04deffa1705e2edc44cae1ed24a4da",
    "tlsext": [
      {
        "id": 43,
        "name": "supported_versions"
      },
      {
        "id": 51,
        "name": "key_share"
      },
      {
        "id": 10,
        "name": "supported_groups"
      }
    ],
    "chain": [
      "-----BEGIN CERTIFICATE-----\nMIIDvDCCAqSgAwIBAgIJAObZMguSUbx5MA0GCSqGSIb3DQEBCwUAMIGLMQ4wDAYD\nVQQGEwVFYXJ0aDETMBEGA1UECBMKQ3liZXJzcGFjZTESMBAGA1UEBxMJU29tZXdo\nZXJlMRUwEwYDVQQKEwxjb2JhbHRzdHJpa2UxGzAZBgNVBAsTEkFkdmFuY2VkUGVu\nVGVzdGluZzEcMBoGA1UEAxMTTWFqb3IgQ29iYWx0IFN0cmlrZTAeFw0yNjAxMjIw\nNjU0MTVaFw0yNjA0MjIwNjU0MTVaMIGLMQ4wDAYDVQQGEwVFYXJ0aDETMBEGA1UE\nCBMKQ3liZXJzcGFjZTESMBAGA1UEBxMJU29tZXdoZXJlMRUwEwYDVQQKEwxjb2Jh\nbHRzdHJpa2UxGzAZBgNVBAsTEkFkdmFuY2VkUGVuVGVzdGluZzEcMBoGA1UEAxMT\nTWFqb3IgQ29iYWx0IFN0cmlrZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\nggEBAMNbh0D5C5vKDDjFi/kqS157o+HVq3+ZXtTBEWnAqvD2VEiAmKqfUvOez8pH\npT7ShFAgp2Xv3CUK/d63pOUXcXcP2RlyKb5xYczADOlSwBxLoEVZ3WRYC0M/mEHc\n+s/7cN59yW6fOVn7k7v0Sane3tMwPOE1gGx55QBNOv5SI7DOm7CXXLygfwQfGQg7\nTEPVWn7WUvAsO1LL8XVW+ud7p3UPjN4eiOqC6eX8xtObNKPoN6iyQBB8vO1AIU2d\np+3gP2RscFwZhkfedra25BTHLiPU063kg6xvAUkgQqAWmwKv5mqrLRaLqkhjKKhW\nvSoOD2GLn11W/Kr+vPDsJSyfVI0CAwEAAaMhMB8wHQYDVR0OBBYEFKtkouAU6lOd\nFgTqXFB+3yHCMWQ4MA0GCSqGSIb3DQEBCwUAA4IBAQBkAMbFFjdihGbsY5n2v94W\nE2MyNUt+A8iE8peKNX6yDFb7R/Xbqi68atO2ewKKisMNf76q/0B/QaG9vyhpTjuj\nQB+WbL303YAvzRUQFLo0IKxCr/Z7MOQy7cuK1h2uzDjbyRmd9L73LiIErM0y/iJA\n6upjTKJDV47OafrMwJ7TbMB+fU38nlccmj8SLdREhWxJMW3JqijO+n/5/NQr/R0f\n+x+Kn47GrgUPCkPfB34Y2wGpdFxrmvRP9i0eSzr52ZX8zDVPRHWaeBcXAcf4zeFO\nQ558OKbt3Dz0pO87/WBQbsS+YV81ab3XfHh18+ZaG2ey4YqcqeJ1Enjf99795Vrx\n-----END CERTIFICATE-----\n"
    ],
    "versions": [],
    "acceptable_cas": [],
    "alpn": [],
    "cert": {
      "sig_alg": "sha256WithRSAEncryption",
      "issued": "20260122065415Z",
      "expires": "20260422065415Z",
      "pubkey": {
        "bits": 2048,
        "type": "rsa"
      },
      "version": 2,
      "extensions": [
        {
          "data": "\\x04\\x14\\xabd\\xa2\\xe0\\x14\\xeaS\\x9d\\x16\\x04\\xea\\\\P~\\xdf!\\xc21d8",
          "name": "subjectKeyIdentifier"
        }
      ],
      "fingerprint": {
        "sha256": "fef551443ecb8caa540379475a938a965165198738426e90b293cd6dcd15f87b",
        "sha1": "4fb969af5aaa99fd872ff69d028d236cd2a608d5"
      },
      "serial": 16634381723950498000,
      "issuer": {
        "C": "Earth",
        "CN": "Major Cobalt Strike",
        "L": "Somewhere",
        "O": "cobaltstrike",
        "ST": "Cyberspace",
        "OU": "AdvancedPenTesting"
      },
      "expired": true,
      "subject": {
        "C": "Earth",
        "CN": "Major Cobalt Strike",
        "L": "Somewhere",
        "O": "cobaltstrike",
        "ST": "Cyberspace",
        "OU": "AdvancedPenTesting"
      }
    },
    "cipher": {
      "version": "TLSv1.3",
      "bits": 256,
      "name": "TLS_AES_256_GCM_SHA384"
    },
    "trust": {
      "revoked": false,
      "browser": null
    },
    "handshake_states": [
      "before SSL initialization",
      "SSLv3/TLS write client hello",
      "SSLv3/TLS read server hello",
      "TLSv1.3 read encrypted extensions",
      "SSLv3/TLS read server certificate",
      "TLSv1.3 read server certificate verify",
      "SSLv3/TLS read finished",
      "SSLv3/TLS write change cipher spec",
      "SSLv3/TLS write finished",
      "SSL negotiation finished successfully"
    ],
    "ja3s": "f03a69cfa3944d6d51bc52febd87a1a8",
    "ocsp": {}
  },
  "hostnames": [
    "dedicated.sollutium.com"
  ],
  "org": "SOLLUTIUM EU Sp z.o.o.",
  "data": "HTTP/1.1 404 Not Found\r\nDate: Mon, 17 Aug 2026 07:35:43 GMT\r\nServer: Apache-Coyote/1.1\r\nContent-Type: text/html;charset=UTF-8\r\nConnection: close\r\nContent-Length: 0\r\n\r\n",
  "cpe23": [
    "cpe:2.3:a:apache:tomcat",
    "cpe:2.3:a:helpsystems:cobalt_strike",
    "cpe:2.3:a:oracle:jre"
  ],
  "isp": null,
  "cpe": [
    "cpe:/a:apache:tomcat",
    "cpe:/a:helpsystems:cobalt_strike",
    "cpe:/a:oracle:jre"
  ],
  "domains": [
    "sollutium.com"
  ],
  "ip_str": "213.111.157.231",
  "os": null,
  "_shodan": {
    "region": "na",
    "module": "auto",
    "ptr": true,
    "options": {},
    "id": "60d8770b-c34e-403f-8233-2acaaf4aa761",
    "crawler": "d318189f77c4138f161f82de2a4e98ce07cf8f45"
  }
}