213.111.157.231
C2 Infrastructure CobaltStrike Indicator 213.111.157.231 Type ip Category C2 Infrastructure Family CobaltStrike Hosting SOLLUTIUM EU Sp z.o.o. Confidence high VT Score 7/94 Source shodan First Seen 2026-08-20 16:00:45 UTC Last Seen 2026-08-20 16:00:45 UTC Shodan View on Shodan ↗
Raw JSON
{
"ip": 3580861927,
"http": {
"status": 404,
"robots_hash": null,
"redirects": [],
"title_hash": null,
"securitytxt": null,
"title": null,
"sitemap_hash": null,
"robots": null,
"dom_hash": 0,
"components_hash": -594756367,
"headers_hash": 1931294570,
"host": "213.111.157.231",
"html": "",
"server_hash": -43448623,
"location": "/",
"components": {
"Java": {
"categories": [
"Programming languages"
]
},
"Apache Tomcat": {
"categories": [
"Web servers"
]
}
},
"securitytxt_hash": null,
"headers": {
"date": "Mon, 17 Aug 2026 07:35:43 GMT",
"connection": "close",
"content-type": "text/html;charset=UTF-8",
"content-length": "0",
"server": "Apache-Coyote/1.1"
},
"server": "Apache-Coyote/1.1",
"sitemap": null,
"html_hash": 0
},
"port": 22222,
"transport": "tcp",
"cpe23_hash": 765376364,
"location": {
"city": "Kyiv",
"region_code": "30",
"area_code": null,
"longitude": 30.5238,
"latitude": 50.45466,
"country_code": "UA",
"country_name": "Ukraine"
},
"product": "Cobalt Strike Beacon",
"hash": -766168196,
"tags": [
"self-signed"
],
"timestamp": "2026-08-17T07:35:43.177048",
"ssl": {
"chain_sha256": [
"fef551443ecb8caa540379475a938a965165198738426e90b293cd6dcd15f87b"
],
"jarm": "2ad2ad16d2ad2ad00042d42d00042ddb04deffa1705e2edc44cae1ed24a4da",
"tlsext": [
{
"id": 43,
"name": "supported_versions"
},
{
"id": 51,
"name": "key_share"
},
{
"id": 10,
"name": "supported_groups"
}
],
"chain": [
"-----BEGIN CERTIFICATE-----\nMIIDvDCCAqSgAwIBAgIJAObZMguSUbx5MA0GCSqGSIb3DQEBCwUAMIGLMQ4wDAYD\nVQQGEwVFYXJ0aDETMBEGA1UECBMKQ3liZXJzcGFjZTESMBAGA1UEBxMJU29tZXdo\nZXJlMRUwEwYDVQQKEwxjb2JhbHRzdHJpa2UxGzAZBgNVBAsTEkFkdmFuY2VkUGVu\nVGVzdGluZzEcMBoGA1UEAxMTTWFqb3IgQ29iYWx0IFN0cmlrZTAeFw0yNjAxMjIw\nNjU0MTVaFw0yNjA0MjIwNjU0MTVaMIGLMQ4wDAYDVQQGEwVFYXJ0aDETMBEGA1UE\nCBMKQ3liZXJzcGFjZTESMBAGA1UEBxMJU29tZXdoZXJlMRUwEwYDVQQKEwxjb2Jh\nbHRzdHJpa2UxGzAZBgNVBAsTEkFkdmFuY2VkUGVuVGVzdGluZzEcMBoGA1UEAxMT\nTWFqb3IgQ29iYWx0IFN0cmlrZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\nggEBAMNbh0D5C5vKDDjFi/kqS157o+HVq3+ZXtTBEWnAqvD2VEiAmKqfUvOez8pH\npT7ShFAgp2Xv3CUK/d63pOUXcXcP2RlyKb5xYczADOlSwBxLoEVZ3WRYC0M/mEHc\n+s/7cN59yW6fOVn7k7v0Sane3tMwPOE1gGx55QBNOv5SI7DOm7CXXLygfwQfGQg7\nTEPVWn7WUvAsO1LL8XVW+ud7p3UPjN4eiOqC6eX8xtObNKPoN6iyQBB8vO1AIU2d\np+3gP2RscFwZhkfedra25BTHLiPU063kg6xvAUkgQqAWmwKv5mqrLRaLqkhjKKhW\nvSoOD2GLn11W/Kr+vPDsJSyfVI0CAwEAAaMhMB8wHQYDVR0OBBYEFKtkouAU6lOd\nFgTqXFB+3yHCMWQ4MA0GCSqGSIb3DQEBCwUAA4IBAQBkAMbFFjdihGbsY5n2v94W\nE2MyNUt+A8iE8peKNX6yDFb7R/Xbqi68atO2ewKKisMNf76q/0B/QaG9vyhpTjuj\nQB+WbL303YAvzRUQFLo0IKxCr/Z7MOQy7cuK1h2uzDjbyRmd9L73LiIErM0y/iJA\n6upjTKJDV47OafrMwJ7TbMB+fU38nlccmj8SLdREhWxJMW3JqijO+n/5/NQr/R0f\n+x+Kn47GrgUPCkPfB34Y2wGpdFxrmvRP9i0eSzr52ZX8zDVPRHWaeBcXAcf4zeFO\nQ558OKbt3Dz0pO87/WBQbsS+YV81ab3XfHh18+ZaG2ey4YqcqeJ1Enjf99795Vrx\n-----END CERTIFICATE-----\n"
],
"versions": [],
"acceptable_cas": [],
"alpn": [],
"cert": {
"sig_alg": "sha256WithRSAEncryption",
"issued": "20260122065415Z",
"expires": "20260422065415Z",
"pubkey": {
"bits": 2048,
"type": "rsa"
},
"version": 2,
"extensions": [
{
"data": "\\x04\\x14\\xabd\\xa2\\xe0\\x14\\xeaS\\x9d\\x16\\x04\\xea\\\\P~\\xdf!\\xc21d8",
"name": "subjectKeyIdentifier"
}
],
"fingerprint": {
"sha256": "fef551443ecb8caa540379475a938a965165198738426e90b293cd6dcd15f87b",
"sha1": "4fb969af5aaa99fd872ff69d028d236cd2a608d5"
},
"serial": 16634381723950498000,
"issuer": {
"C": "Earth",
"CN": "Major Cobalt Strike",
"L": "Somewhere",
"O": "cobaltstrike",
"ST": "Cyberspace",
"OU": "AdvancedPenTesting"
},
"expired": true,
"subject": {
"C": "Earth",
"CN": "Major Cobalt Strike",
"L": "Somewhere",
"O": "cobaltstrike",
"ST": "Cyberspace",
"OU": "AdvancedPenTesting"
}
},
"cipher": {
"version": "TLSv1.3",
"bits": 256,
"name": "TLS_AES_256_GCM_SHA384"
},
"trust": {
"revoked": false,
"browser": null
},
"handshake_states": [
"before SSL initialization",
"SSLv3/TLS write client hello",
"SSLv3/TLS read server hello",
"TLSv1.3 read encrypted extensions",
"SSLv3/TLS read server certificate",
"TLSv1.3 read server certificate verify",
"SSLv3/TLS read finished",
"SSLv3/TLS write change cipher spec",
"SSLv3/TLS write finished",
"SSL negotiation finished successfully"
],
"ja3s": "f03a69cfa3944d6d51bc52febd87a1a8",
"ocsp": {}
},
"hostnames": [
"dedicated.sollutium.com"
],
"org": "SOLLUTIUM EU Sp z.o.o.",
"data": "HTTP/1.1 404 Not Found\r\nDate: Mon, 17 Aug 2026 07:35:43 GMT\r\nServer: Apache-Coyote/1.1\r\nContent-Type: text/html;charset=UTF-8\r\nConnection: close\r\nContent-Length: 0\r\n\r\n",
"cpe23": [
"cpe:2.3:a:apache:tomcat",
"cpe:2.3:a:helpsystems:cobalt_strike",
"cpe:2.3:a:oracle:jre"
],
"isp": null,
"cpe": [
"cpe:/a:apache:tomcat",
"cpe:/a:helpsystems:cobalt_strike",
"cpe:/a:oracle:jre"
],
"domains": [
"sollutium.com"
],
"ip_str": "213.111.157.231",
"os": null,
"_shodan": {
"region": "na",
"module": "auto",
"ptr": true,
"options": {},
"id": "60d8770b-c34e-403f-8233-2acaaf4aa761",
"crawler": "d318189f77c4138f161f82de2a4e98ce07cf8f45"
}
}