47.239.222.85
C2 Infrastructure CobaltStrike Indicator 47.239.222.85 Type ip Category C2 Infrastructure Family CobaltStrike Hosting Alibaba Cloud LLC Confidence high VT Score 11/94 Source shodan First Seen 2026-05-02 16:00:01 UTC Last Seen 2026-05-16 16:00:50 UTC Shodan View on Shodan ↗
Raw JSON
{
"cobalt_strike_beacon": {
"x86": {
"beacon_type": "HTTPS",
"jitter": 56,
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36",
"http-post.client": [
"Accept: */*",
"Accept-Encoding: gzip, deflate, br",
"Accept-Language: en-US,en;q=0.9",
"Cache-Control: no-cache",
"Connection: keep-alive",
"Content-Type: application/json; charset=utf-8",
"id"
],
"maxgetsize": 1048576,
"post-ex.spawnto_x86": "%windir%\\syswow64\\rundll32.exe",
"port": 443,
"sleeptime": 5000,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"CreateThread",
"SetThreadContext",
"CreateRemoteThread",
"RtlCreateUserThread"
],
"process-inject.startrwx": 64,
"post-ex.spawnto_x64": "%windir%\\sysnative\\rundll32.exe",
"process-inject.stub": "e43a1b63f09794f74d90a9889f7acb77",
"http-get.uri": "cdn.project-eagle-2025.xyz,/_next/static/chunks/main.js",
"watermark": 987654321,
"dns-beacon.strategy_fail_seconds": -1,
"server.publickey_md5": "8553472c8cc18d32dca70fb23a7f46e2",
"dns-beacon.strategy_fail_x": -1,
"http-post.verb": "POST",
"http-post.uri": "/api/v1/submit",
"process-inject.userwx": 64,
"http-get.verb": "GET",
"http-get.client": [
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8",
"Accept-Encoding: gzip, deflate, br",
"Accept-Language: en-US,en;q=0.9",
"Cache-Control: no-cache",
"Connection: keep-alive",
"Cookie"
]
},
"x64": {
"beacon_type": "HTTPS",
"jitter": 56,
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36",
"http-post.client": [
"Accept: */*",
"Accept-Encoding: gzip, deflate, br",
"Accept-Language: en-US,en;q=0.9",
"Cache-Control: no-cache",
"Connection: keep-alive",
"Content-Type: application/json; charset=utf-8",
"id"
],
"maxgetsize": 1048576,
"post-ex.spawnto_x86": "%windir%\\syswow64\\rundll32.exe",
"port": 443,
"sleeptime": 5000,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"CreateThread",
"SetThreadContext",
"CreateRemoteThread",
"RtlCreateUserThread"
],
"process-inject.startrwx": 64,
"post-ex.spawnto_x64": "%windir%\\sysnative\\rundll32.exe",
"process-inject.stub": "e43a1b63f09794f74d90a9889f7acb77",
"http-get.uri": "cdn.project-eagle-2025.xyz,/ws",
"watermark": 987654321,
"dns-beacon.strategy_fail_seconds": -1,
"server.publickey_md5": "8553472c8cc18d32dca70fb23a7f46e2",
"dns-beacon.strategy_fail_x": -1,
"http-post.verb": "POST",
"http-post.uri": "/api/v1/data",
"process-inject.userwx": 64,
"http-get.verb": "GET",
"http-get.client": [
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8",
"Accept-Encoding: gzip, deflate, br",
"Accept-Language: en-US,en;q=0.9",
"Cache-Control: no-cache",
"Connection: keep-alive",
"Cookie"
]
}
},
"ip": 804249173,
"http": {
"status": 404,
"robots_hash": null,
"redirects": [],
"title_hash": null,
"securitytxt": null,
"title": null,
"sitemap_hash": null,
"robots": null,
"dom_hash": 0,
"headers_hash": 2129120964,
"host": "47.239.222.85",
"html": "",
"server_hash": null,
"location": "/",
"components": {},
"securitytxt_hash": null,
"server": null,
"sitemap": null,
"html_hash": 0
},
"port": 443,
"transport": "tcp",
"cloud": {
"region": null,
"service": null,
"provider": "Alibaba Cloud"
},
"location": {
"city": "Hong Kong",
"region_code": "",
"area_code": null,
"longitude": 114.17469,
"latitude": 22.27832,
"country_code": "HK",
"country_name": "Hong Kong"
},
"product": "Cobalt Strike Beacon",
"hash": 389893696,
"tags": [
"cloud"
],
"timestamp": "2026-05-02T08:06:03.709109",
"ssl": {
"chain_sha256": [
"6c0289f7793de854b4a4f630c0dd1f8e701cc8976718a452f98fe89a386f283c",
"b1ac8cfb181b9c9354e1775fcbdfcfe7898c5cc9a17d76315b57c112eee55234"
],
"jarm": "2ad2ad16d2ad2ad00042d42d00042ddb04deffa1705e2edc44cae1ed24a4da",
"tlsext": [
{
"id": 43,
"name": "supported_versions"
},
{
"id": 51,
"name": "key_share"
},
{
"id": 10,
"name": "supported_groups"
}
],
"chain": [
"-----BEGIN CERTIFICATE-----\nMIIGLjCCBRagAwIBAgIQD+i6Cj2QEpI8DkduObsq/zANBgkqhkiG9w0BAQsFADBu\nMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3\nd3cuZGlnaWNlcnQuY29tMS0wKwYDVQQDEyRFbmNyeXB0aW9uIEV2ZXJ5d2hlcmUg\nRFYgVExTIENBIC0gRzIwHhcNMjYwNTAxMDAwMDAwWhcNMjYwNzI5MjM1OTU5WjAl\nMSMwIQYDVQQDExpjZG4ucHJvamVjdC1lYWdsZS0yMDI1Lnh5ejCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBAJZ5WPVFBhIFRg8jOPGgRW49DA5yknPQAFNJ\noxtghY4jwgjBAF6HPoJf+KQL/+Mr/8QUSouEUDaMjKTwQp5KJwifvmEfq0yr4P8E\nSrCyStz+CX8mZxxm4VsoLLaUqhEraKVd9UV+zRPouHKOl3RR23cPFZhMi1fDbmTn\npfzPM2g3x9Gn+Hnw/0svtvupTVjdosL7LB7lsnq1LM0rtXBjg9Yy7HCjOet7LfaL\n/XhC+4uvH6UW7Uo6+IJoKDcSxKcBLRTiqub9dWiSs9UgvYLh16whRZQorJQqq1zQ\nI5LOV45F1l9+BdXT/eu1WvEk6frY8wugKZosDiM1d8cemJVQPWkCAwEAAaOCAw8w\nggMLMB8GA1UdIwQYMBaAFHjfkZBf7t6s9sV169VMVVPvJEq2MB0GA1UdDgQWBBRn\nhlm2E34LXoYn0fy8OI3fmwMprzBFBgNVHREEPjA8ghpjZG4ucHJvamVjdC1lYWds\nZS0yMDI1Lnh5eoIed3d3LmNkbi5wcm9qZWN0LWVhZ2xlLTIwMjUueHl6MD4GA1Ud\nIAQ3MDUwMwYGZ4EMAQIBMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNl\ncnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEG\nCCsGAQUFBwMCMIGABggrBgEFBQcBAQR0MHIwJAYIKwYBBQUHMAGGGGh0dHA6Ly9v\nY3NwLmRpZ2ljZXJ0LmNvbTBKBggrBgEFBQcwAoY+aHR0cDovL2NhY2VydHMuZGln\naWNlcnQuY29tL0VuY3J5cHRpb25FdmVyeXdoZXJlRFZUTFNDQS1HMi5jcnQwDAYD\nVR0TAQH/BAIwADCCAYAGCisGAQQB1nkCBAIEggFwBIIBbAFqAHcAwjF+V0UZo0Xu\nfzjespBB68fCIVoiv3/Vta12mtkOUs0AAAGd5AEDLwAABAMASDBGAiEA3xa3wdms\nfGerF5WVXDBsZxFJHQ/iudGMhiFRlSzdGroCIQDxHBbb6rAsaL/Frz2EjUStlkZV\n+Bj+2SG4V08g4uI2fgB3ANdtfRDRp/V3wsfpX9cAv/mCyTNaZeHQswFzF8DIxWl3\nAAABneQBAyEAAAQDAEgwRgIhAO0ZzIk8rIYXiw6fMhZeWGlKi411H2lYTk/23QqA\nFQxTAiEApmEmMVo0zFqzHr8/++6ZvKz3s75sCof1YprhQ1aszCMAdgCUTkOH+uzB\n74HzGSQmqBhlAcfTXzgCAT9yZ31VNy4Z2AAAAZ3kAQM+AAAEAwBHMEUCIQCNQqn1\nEoTZjn4wAZytI1Xl/jINTy+jUhdMX2zhva1fSQIgH4ak1ve5rFOqs7liK7D2kcDF\nX5tXV07+K3vS6YZ/A0IwDQYJKoZIhvcNAQELBQADggEBACRwjTd8LBnQUkysJ9no\n3mk7YEtCU05TEJ47rQLx3xCA0Pb62JeiPMk16JIxSiUBVVbNUQcx/dbtmyVLWIas\nVMH5htLwJHJAcVv9XW0/ezBXT3w8mvemdiOnYUl9tlhn5eh1vKX+eVNtaN5nMVSX\nVLT/Uu6BfBZ3LCcMFXyt2M3VgLutnyGBPnMWHkWSOxtW0f1nuB9U9ZRRBZYPwERX\nBkmx5hcYyMKWlrcxZ0kthHcYtvxwcc7vOF2rTn9t0NEudFYhWOHwNSVkhFUkMAyI\n7fY9dHhfwXKXKpDCWvj14WZB6rAKmsrHz+Wf15JHDhR8DoF3f068GjZSeW/S3tQ3\nMx4=\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMIIEqjCCA5KgAwIBAgIQDeD/te5iy2EQn2CMnO1e0zANBgkqhkiG9w0BAQsFADBh\nMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3\nd3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBH\nMjAeFw0xNzExMjcxMjQ2NDBaFw0yNzExMjcxMjQ2NDBaMG4xCzAJBgNVBAYTAlVT\nMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j\nb20xLTArBgNVBAMTJEVuY3J5cHRpb24gRXZlcnl3aGVyZSBEViBUTFMgQ0EgLSBH\nMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAO8Uf46i/nr7pkgTDqnE\neSIfCFqvPnUq3aF1tMJ5hh9MnO6Lmt5UdHfBGwC9Si+XjK12cjZgxObsL6Rg1njv\nNhAMJ4JunN0JGGRJGSevbJsA3sc68nbPQzuKp5Jc8vpryp2mts38pSCXorPR+sch\nQisKA7OSQ1MjcFN0d7tbrceWFNbzgL2csJVQeogOBGSe/KZEIZw6gXLKeFe7mupn\nNYJROi2iC11+HuF79iAttMc32Cv6UOxixY/3ZV+LzpLnklFq98XORgwkIJL1HuvP\nha8yvb+W6JislZJL+HLFtidoxmI7Qm3ZyIV66W533DsGFimFJkz3y0GeHWuSVMbI\nlfsCAwEAAaOCAU8wggFLMB0GA1UdDgQWBBR435GQX+7erPbFdevVTFVT7yRKtjAf\nBgNVHSMEGDAWgBROIlQgGJXm427mD/r6uRLtBhePOTAOBgNVHQ8BAf8EBAMCAYYw\nHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBIGA1UdEwEB/wQIMAYBAf8C\nAQAwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp\nY2VydC5jb20wQgYDVR0fBDswOTA3oDWgM4YxaHR0cDovL2NybDMuZGlnaWNlcnQu\nY29tL0RpZ2lDZXJ0R2xvYmFsUm9vdEcyLmNybDBMBgNVHSAERTBDMDcGCWCGSAGG\n/WwBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BT\nMAgGBmeBDAECATANBgkqhkiG9w0BAQsFAAOCAQEAoBs1eCLKakLtVRPFRjBIJ9LJ\nL0s8ZWum8U8/1TMVkQMBn+CPb5xnCD0GSA6L/V0ZFrMNqBirrr5B241OesECvxIi\n98bZ90h9+q/X5eMyOD35f8YTaEMpdnQCnawIwiHx06/0BfiTj+b/XQih+mqt3ZXe\nxNCJqKexdiB2IWGSKcgahPacWkk/BAQFisKIFYEqHzV974S3FAz/8LIfD58xnsEN\nGfzyIDkH3JrwYZ8caPTf6ZX9M1GrISN8HnWTtdNCH2xEajRa/h9ZBXjUyFKQrGk2\nn2hcLrfZSbynEC/pSw/ET7H5nWwckjmAJ1l9fcnbqkU/pf6uMQmnfl0JQjJNSg==\n-----END CERTIFICATE-----\n"
],
"versions": [
"-TLSv1",
"-SSLv2",
"-SSLv3",
"-TLSv1.1",
"TLSv1.2",
"TLSv1.3"
],
"acceptable_cas": [],
"alpn": [],
"cert": {
"sig_alg": "sha256WithRSAEncryption",
"issued": "20260501000000Z",
"expires": "20260729235959Z",
"pubkey": {
"bits": 2048,
"type": "rsa"
},
"version": 2,
"extensions": [
{
"data": "0\\x16\\x80\\x14x\\xdf\\x91\\x90_\\xee\\xde\\xac\\xf6\\xc5u\\xeb\\xd5LUS\\xef$J\\xb6",
"name": "authorityKeyIdentifier"
},
{
"data": "\\x04\\x14g\\x86Y\\xb6\\x13~\\x0b^\\x86\\'\\xd1\\xfc\\xbc8\\x8d\\xdf\\x9b\\x03)\\xaf",
"name": "subjectKeyIdentifier"
},
{
"data": "0<\\x82\\x1acdn.project-eagle-2025.xyz\\x82\\x1ewww.cdn.project-eagle-2025.xyz",
"name": "subjectAltName"
},
{
"data": "0503\\x06\\x06g\\x81\\x0c\\x01\\x02\\x010)0\\'\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x01\\x16\\x1bhttp://www.digicert.com/CPS",
"name": "certificatePolicies"
},
{
"critical": true,
"data": "\\x03\\x02\\x05\\xa0",
"name": "keyUsage"
},
{
"data": "0\\x14\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02",
"name": "extendedKeyUsage"
},
{
"data": "0r0$\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x01\\x86\\x18http://ocsp.digicert.com0J\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86>http://cacerts.digicert.com/EncryptionEverywhereDVTLSCA-G2.crt",
"name": "authorityInfoAccess"
},
{
"critical": true,
"data": "0\\x00",
"name": "basicConstraints"
},
{
"data": "\\x04\\x82\\x01l\\x01j\\x00w\\x00\\xc21~WE\\x19\\xa3E\\xee\\x7f8\\xde\\xb2\\x90A\\xeb\\xc7\\xc2!Z\"\\xbf\\x7f\\xd5\\xb5\\xadv\\x9a\\xd9\\x0eR\\xcd\\x00\\x00\\x01\\x9d\\xe4\\x01\\x03/\\x00\\x00\\x04\\x03\\x00H0F\\x02!\\x00\\xdf\\x16\\xb7\\xc1\\xd9\\xac|g\\xab\\x17\\x95\\x95\\\\0lg\\x11I\\x1d\\x0f\\xe2\\xb9\\xd1\\x8c\\x86!Q\\x95,\\xdd\\x1a\\xba\\x02!\\x00\\xf1\\x1c\\x16\\xdb\\xea\\xb0,h\\xbf\\xc5\\xaf=\\x84\\x8dD\\xad\\x96FU\\xf8\\x18\\xfe\\xd9!\\xb8WO \\xe2\\xe26~\\x00w\\x00\\xd7m}\\x10\\xd1\\xa7\\xf5w\\xc2\\xc7\\xe9_\\xd7\\x00\\xbf\\xf9\\x82\\xc93Ze\\xe1\\xd0\\xb3\\x01s\\x17\\xc0\\xc8\\xc5iw\\x00\\x00\\x01\\x9d\\xe4\\x01\\x03!\\x00\\x00\\x04\\x03\\x00H0F\\x02!\\x00\\xed\\x19\\xcc\\x89<\\xac\\x86\\x17\\x8b\\x0e\\x9f2\\x16^XiJ\\x8b\\x8du\\x1fiXNO\\xf6\\xdd\\n\\x80\\x15\\x0cS\\x02!\\x00\\xa6a&1Z4\\xccZ\\xb3\\x1e\\xbf?\\xfb\\xee\\x99\\xbc\\xac\\xf7\\xb3\\xbel\\n\\x87\\xf5b\\x9a\\xe1CV\\xac\\xcc#\\x00v\\x00\\x94NC\\x87\\xfa\\xec\\xc1\\xef\\x81\\xf3\\x19$&\\xa8\\x18e\\x01\\xc7\\xd3_8\\x02\\x01?rg}U7.\\x19\\xd8\\x00\\x00\\x01\\x9d\\xe4\\x01\\x03>\\x00\\x00\\x04\\x03\\x00G0E\\x02!\\x00\\x8dB\\xa9\\xf5\\x12\\x84\\xd9\\x8e~0\\x01\\x9c\\xad#U\\xe5\\xfe2\\rO/\\xa3R\\x17L_l\\xe1\\xbd\\xad_I\\x02 \\x1f\\x86\\xa4\\xd6\\xf7\\xb9\\xacS\\xaa\\xb3\\xb9b+\\xb0\\xf6\\x91\\xc0\\xc5_\\x9bWWN\\xfe+{\\xd2\\xe9\\x86\\x7f\\x03B",
"name": "ct_precert_scts"
}
],
"fingerprint": {
"sha256": "6c0289f7793de854b4a4f630c0dd1f8e701cc8976718a452f98fe89a386f283c",
"sha1": "39ff5b04780b7a36946af3eca5168bfc342f0654"
},
"serial": 2.114680614747448e+37,
"issuer": {
"C": "US",
"OU": "www.digicert.com",
"O": "DigiCert Inc",
"CN": "Encryption Everywhere DV TLS CA - G2"
},
"expired": false,
"subject": {
"CN": "cdn.project-eagle-2025.xyz"
}
},
"cipher": {
"version": "TLSv1.3",
"bits": 256,
"name": "TLS_AES_256_GCM_SHA384"
},
"trust": {
"revoked": false,
"browser": null
},
"handshake_states": [
"before SSL initialization",
"SSLv3/TLS write client hello",
"SSLv3/TLS read server hello",
"TLSv1.3 read encrypted extensions",
"SSLv3/TLS read server certificate",
"TLSv1.3 read server certificate verify",
"SSLv3/TLS read finished",
"SSLv3/TLS write change cipher spec",
"SSLv3/TLS write finished",
"SSL negotiation finished successfully"
],
"ja3s": "f03a69cfa3944d6d51bc52febd87a1a8",
"ocsp": {}
},
"hostnames": [
"cdn.project-eagle-2025.xyz",
"www.cdn.project-eagle-2025.xyz"
],
"org": "Alibaba Cloud LLC",
"data": "HTTP/1.1 404 Not Found\r\nDate: Sat, 2 May 2026 08:06:03 GMT\r\nContent-Type: text/plain\r\nContent-Length: 0\r\n\r\n\nCobalt Strike Beacon:\n x86:\n beacon_type: HTTPS\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\n Accept-Encoding: gzip, deflate, br\n Accept-Language: en-US,en;q=0.9\n Cache-Control: no-cache\n Connection: keep-alive\n Cookie\n http-get.uri: cdn.project-eagle-2025.xyz,/_next/static/chunks/main.js\n http-get.verb: GET\n http-post.client:\n Accept: */*\n Accept-Encoding: gzip, deflate, br\n Accept-Language: en-US,en;q=0.9\n Cache-Control: no-cache\n Connection: keep-alive\n Content-Type: application/json; charset=utf-8\n id\n http-post.uri: /api/v1/submit\n http-post.verb: POST\n jitter: 56\n maxgetsize: 1048576\n port: 443\n post-ex.spawnto_x64: %windir%\\sysnative\\rundll32.exe\n post-ex.spawnto_x86: %windir%\\syswow64\\rundll32.exe\n process-inject.execute:\n CreateThread\n SetThreadContext\n CreateRemoteThread\n RtlCreateUserThread\n process-inject.startrwx: 64\n process-inject.stub: e43a1b63f09794f74d90a9889f7acb77\n process-inject.userwx: 64\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: 8553472c8cc18d32dca70fb23a7f46e2\n sleeptime: 5000\n useragent_header: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\n uses_cookies: 1\n watermark: 987654321\n x64:\n beacon_type: HTTPS\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\n Accept-Encoding: gzip, deflate, br\n Accept-Language: en-US,en;q=0.9\n Cache-Control: no-cache\n Connection: keep-alive\n Cookie\n http-get.uri: cdn.project-eagle-2025.xyz,/ws\n http-get.verb: GET\n http-post.client:\n Accept: */*\n Accept-Encoding: gzip, deflate, br\n Accept-Language: en-US,en;q=0.9\n Cache-Control: no-cache\n Connection: keep-alive\n Content-Type: application/json; charset=utf-8\n id\n http-post.uri: /api/v1/data\n http-post.verb: POST\n jitter: 56\n maxgetsize: 1048576\n port: 443\n post-ex.spawnto_x64: %windir%\\sysnative\\rundll32.exe\n post-ex.spawnto_x86: %windir%\\syswow64\\rundll32.exe\n process-inject.execute:\n CreateThread\n SetThreadContext\n CreateRemoteThread\n RtlCreateUserThread\n process-inject.startrwx: 64\n process-inject.stub: e43a1b63f09794f74d90a9889f7acb77\n process-inject.userwx: 64\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: 8553472c8cc18d32dca70fb23a7f46e2\n sleeptime: 5000\n useragent_header: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\n uses_cookies: 1\n watermark: 987654321\n",
"asn": "AS45102",
"cpe23": [
"cpe:2.3:a:helpsystems:cobalt_strike"
],
"isp": "Alibaba (US) Technology Co., Ltd.",
"cpe": [
"cpe:/a:helpsystems:cobalt_strike"
],
"domains": [
"project-eagle-2025.xyz"
],
"ip_str": "47.239.222.85",
"os": null,
"_shodan": {
"region": "na",
"crawler": "667c9d6cc4bbbf0594c20c6f1ba56a8147913fd0",
"options": {},
"module": "https",
"id": "86afb8b2-0fbe-49d6-a35b-a8d7accf78c8"
}
}