207.57.134.202
C2 Infrastructure CobaltStrike Indicator 207.57.134.202 Type ip Category C2 Infrastructure Family CobaltStrike Hosting NTT America, Inc. Confidence high VT Score 10/94 Source shodan First Seen 2026-08-28 00:00:24 UTC Last Seen 2026-09-04 00:00:58 UTC Shodan View on Shodan ↗
Raw JSON
{
"cobalt_strike_beacon": {
"x86": {
"beacon_type": "HTTPS",
"jitter": 37,
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit/531.2+ (KHTML, like Gecko) Version/5.0 Safari/531.2+",
"http-post.client": [
"Accept: text/html,application/xhtml+xml,application/xml;",
"Host: getbootstrap.com",
"Accept-Encoding: gzip, deflate",
"Accept-Language: zh-CN,zh;q=0.9",
"serve"
],
"maxgetsize": 1403086,
"process-inject.min_alloc": 16700,
"post-ex.spawnto_x86": "%windir%\\syswow64\\svchost.exe -k netsvcs",
"port": 443,
"sleeptime": 10000,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"ntdll:RtlUserThreadStart",
"CreateThread",
"NtQueueApcThread",
"CreateRemoteThread",
"RtlCreateUserThread"
],
"process-inject.startrwx": 64,
"post-ex.spawnto_x64": "%windir%\\sysnative\\svchost.exe -k netsvcs",
"process-inject.stub": "41e6db3cfcfa84be7cac6e42f21a22a8",
"http-get.uri": "207.57.134.202,/dist/css/bootstrap.min.css",
"watermark": 391144938,
"dns-beacon.strategy_fail_seconds": -1,
"process-inject.userwx": 32,
"dns-beacon.strategy_fail_x": -1,
"stage.cleanup": 1,
"http-post.verb": "POST",
"http-post.uri": "/dist/js/bootstrap.bundle.min.js",
"server.publickey_md5": "2dd4d7ebffeb1b682e7ee07bdbce6879",
"process-inject.allocator": 1,
"cfg_caution": 1,
"http-get.verb": "POST",
"http-get.client": [
"Accept: text/html,application/xhtml+xml,application/xml;",
"Host: getbootstrap.com",
"Accept-Encoding: gzip, deflate",
"Accept-Language: zh-CN,zh;q=0.9",
"__cfduid=",
"Cookie"
]
},
"x64": {
"beacon_type": "HTTPS",
"jitter": 37,
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit/531.2+ (KHTML, like Gecko) Version/5.0 Safari/531.2+",
"http-post.client": [
"Accept: text/html,application/xhtml+xml,application/xml;",
"Host: getbootstrap.com",
"Accept-Encoding: gzip, deflate",
"Accept-Language: zh-CN,zh;q=0.9",
"serve"
],
"maxgetsize": 1403086,
"process-inject.min_alloc": 16700,
"post-ex.spawnto_x86": "%windir%\\syswow64\\svchost.exe -k netsvcs",
"port": 443,
"sleeptime": 10000,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"ntdll:RtlUserThreadStart",
"CreateThread",
"NtQueueApcThread",
"CreateRemoteThread",
"RtlCreateUserThread"
],
"process-inject.startrwx": 64,
"post-ex.spawnto_x64": "%windir%\\sysnative\\svchost.exe -k netsvcs",
"process-inject.stub": "41e6db3cfcfa84be7cac6e42f21a22a8",
"http-get.uri": "207.57.134.202,/dist/css/bootstrap.min.css",
"watermark": 391144938,
"dns-beacon.strategy_fail_seconds": -1,
"process-inject.userwx": 32,
"dns-beacon.strategy_fail_x": -1,
"stage.cleanup": 1,
"http-post.verb": "POST",
"http-post.uri": "/dist/js/bootstrap.bundle.min.js",
"server.publickey_md5": "2dd4d7ebffeb1b682e7ee07bdbce6879",
"process-inject.allocator": 1,
"cfg_caution": 1,
"http-get.verb": "POST",
"http-get.client": [
"Accept: text/html,application/xhtml+xml,application/xml;",
"Host: getbootstrap.com",
"Accept-Encoding: gzip, deflate",
"Accept-Language: zh-CN,zh;q=0.9",
"__cfduid=",
"Cookie"
]
}
},
"ip": 3476653770,
"http": {
"redirects": [],
"title_hash": null,
"html_hash": 0,
"securitytxt": null,
"title": null,
"sitemap_hash": null,
"waf": "Cloudflare (Cloudflare Inc.)",
"headers_hash": 91730385,
"html": "",
"location": "/",
"server_hash": 958142897,
"status": 404,
"robots_hash": null,
"robots": null,
"dom_hash": 0,
"components_hash": -2130033940,
"host": "207.57.134.202",
"securitytxt_hash": null,
"server": "cloudflare",
"headers": {
"content-length": "0",
"server": "cloudflare",
"connection": "close",
"cache-control": "max-age=2",
"date": "Wed, 26 Aug 2026 04:29:49 GMT",
"content-type": "text/plain"
},
"components": {
"Cloudflare": {
"categories": [
"CDN"
]
}
},
"sitemap": null
},
"port": 443,
"transport": "tcp",
"cpe23_hash": -872801067,
"location": {
"city": "Englewood",
"region_code": "CO",
"area_code": null,
"longitude": -104.8799,
"latitude": 39.6123,
"country_code": "US",
"country_name": "United States"
},
"product": "Cobalt Strike Beacon",
"hash": -733239584,
"tags": [
"self-signed"
],
"timestamp": "2026-08-26T04:29:49.537771",
"ssl": {
"chain_sha256": [
"8848f4cc93d21742dd71884c06aaa159bf143b186ab5e9ed1f822fdcd8f0d489"
],
"jarm": "2ad2ad16d2ad2ad00042d42d00042ddb04deffa1705e2edc44cae1ed24a4da",
"tlsext": [
{
"id": 43,
"name": "supported_versions"
},
{
"id": 51,
"name": "key_share"
},
{
"id": 10,
"name": "supported_groups"
}
],
"chain": [
"-----BEGIN CERTIFICATE-----\nMIIDxzCCAq+gAwIBAgIEKkbXQTANBgkqhkiG9w0BAQsFADCBkzEPMA0GA1UEBhMG\nTXVtYmFpMRQwEgYDVQQIEwtOYXZpIE11bWJhaTEOMAwGA1UEBxMFVmFzaGkxHjAc\nBgNVBAoTFUluZm93b3JsZCBDb3Jwb3JhdGlvbjEeMBwGA1UECxMVSW5mb3dvcmxk\nIENvcnBvcmF0aW9uMRowGAYDVQQDExF3d3cuaW5mb3dvcmxkLmNvbTAeFw0yMzAy\nMTQwNzM4NTRaFw0yMzA1MTUwNzM4NTRaMIGTMQ8wDQYDVQQGEwZNdW1iYWkxFDAS\nBgNVBAgTC05hdmkgTXVtYmFpMQ4wDAYDVQQHEwVWYXNoaTEeMBwGA1UEChMVSW5m\nb3dvcmxkIENvcnBvcmF0aW9uMR4wHAYDVQQLExVJbmZvd29ybGQgQ29ycG9yYXRp\nb24xGjAYBgNVBAMTEXd3dy5pbmZvd29ybGQuY29tMIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEAk1Ashp7ZkKZSH9cXL3U6BwCfU5e4tjQQs5PI0Dkm0Tkj\nVG1H8MZp+xKdnaQXG2axk+mICYHEY63AQp656jl7xQMzKAJ7UqTysmqplUJZJMep\ne0Vploj50089aJwkwFbkJxRDOE0KEFRS4Qn7m6sbe4wdrEmEx2NRlr1ToR91JCMR\nogRrIRjx8mnCdFg9rUK0w39sAi7GSS+4RonuRZUhI8LGbcU1xbwdfjsKJBySR+qT\nncfIoiZI6ZNoiuxW/I7Nx3OMuaQ2l6L3Gg9OuHzw2ehGfzVmVkvXLEekpz107JVZ\nBJukhH0142NhowDJBgfWBYN2Hy16+A4XzmvbrLmurQIDAQABoyEwHzAdBgNVHQ4E\nFgQUCv4w2j7rEp37kRBMLLvUrRVg+KkwDQYJKoZIhvcNAQELBQADggEBAI1/pIzS\nqojPY8KAC9WH7Yt8EtiVuErdUVk4OTOPbt+HMUn8iigK1h/MPaw042Xg70cXxCe9\nWFUsLA4jTdZ6/iKHKN2zrtQb1YJ/CneW7Y82fEwgCKF1sLRZAOdHn1mSL1hgwfSe\nSsJ8EvC+XoO1ba3OxuyRglEHtb680dM4lA3Ycbq3BxX6zMKtSImy0Mhl07GM1wc0\nIJQY1TRpI74yXTVNb2Ue9Y7/rYzN+98ohOZ4KH1ha3CCRSb5q8mmho8lOkzD2r+E\nm+DUiwRaVAcxJVBUjxtm2MDeMn6dpazBlrljDvfdGpwDeuAcEqCmwJkjUUXuuJiM\n13iuX7q/m+9EapI=\n-----END CERTIFICATE-----\n"
],
"versions": [
"-TLSv1",
"-SSLv2",
"-SSLv3",
"-TLSv1.1",
"TLSv1.2",
"TLSv1.3"
],
"acceptable_cas": [],
"alpn": [],
"cert": {
"sig_alg": "sha256WithRSAEncryption",
"issued": "20230214073854Z",
"expires": "20230515073854Z",
"pubkey": {
"bits": 2048,
"type": "rsa"
},
"version": 2,
"extensions": [
{
"data": "\\x04\\x14\\n\\xfe0\\xda>\\xeb\\x12\\x9d\\xfb\\x91\\x10L,\\xbb\\xd4\\xad\\x15`\\xf8\\xa9",
"name": "subjectKeyIdentifier"
}
],
"fingerprint": {
"sha256": "8848f4cc93d21742dd71884c06aaa159bf143b186ab5e9ed1f822fdcd8f0d489",
"sha1": "6a0b02ecfc4731f24fcf80ad84c779bb0ea56fbe"
},
"serial": 709285697,
"issuer": {
"C": "Mumbai",
"CN": "www.infoworld.com",
"L": "Vashi",
"O": "Infoworld Corporation",
"ST": "Navi Mumbai",
"OU": "Infoworld Corporation"
},
"expired": true,
"subject": {
"C": "Mumbai",
"CN": "www.infoworld.com",
"L": "Vashi",
"O": "Infoworld Corporation",
"ST": "Navi Mumbai",
"OU": "Infoworld Corporation"
}
},
"cipher": {
"version": "TLSv1.3",
"bits": 256,
"name": "TLS_AES_256_GCM_SHA384"
},
"trust": {
"revoked": false,
"browser": null
},
"handshake_states": [
"before SSL initialization",
"SSLv3/TLS write client hello",
"SSLv3/TLS read server hello",
"TLSv1.3 read encrypted extensions",
"SSLv3/TLS read server certificate",
"TLSv1.3 read server certificate verify",
"SSLv3/TLS read finished",
"SSLv3/TLS write change cipher spec",
"SSLv3/TLS write finished",
"SSL negotiation finished successfully"
],
"ja3s": "f03a69cfa3944d6d51bc52febd87a1a8",
"ocsp": {}
},
"hostnames": [],
"org": "NTT America, Inc.",
"data": "HTTP/1.1 404 Not Found\r\nDate: Wed, 26 Aug 2026 04:29:49 GMT\r\nContent-Type: text/plain\r\nServer: cloudflare\r\nCache-Control: max-age=2\r\nConnection: close\r\nContent-Length: 0\r\n\r\n\nCobalt Strike Beacon:\n x86:\n beacon_type: HTTPS\n cfg_caution: 1\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n Accept: text/html,application/xhtml+xml,application/xml;\n Host: getbootstrap.com\n Accept-Encoding: gzip, deflate\n Accept-Language: zh-CN,zh;q=0.9\n __cfduid=\n Cookie\n http-get.uri: 207.57.134.202,/dist/css/bootstrap.min.css\n http-get.verb: POST\n http-post.client:\n Accept: text/html,application/xhtml+xml,application/xml;\n Host: getbootstrap.com\n Accept-Encoding: gzip, deflate\n Accept-Language: zh-CN,zh;q=0.9\n serve\n http-post.uri: /dist/js/bootstrap.bundle.min.js\n http-post.verb: POST\n jitter: 37\n maxgetsize: 1403086\n port: 443\n post-ex.spawnto_x64: %windir%\\sysnative\\svchost.exe -k netsvcs\n post-ex.spawnto_x86: %windir%\\syswow64\\svchost.exe -k netsvcs\n process-inject.allocator: 1\n process-inject.execute:\n ntdll:RtlUserThreadStart\n CreateThread\n NtQueueApcThread\n CreateRemoteThread\n RtlCreateUserThread\n process-inject.min_alloc: 16700\n process-inject.startrwx: 64\n process-inject.stub: 41e6db3cfcfa84be7cac6e42f21a22a8\n process-inject.userwx: 32\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: 2dd4d7ebffeb1b682e7ee07bdbce6879\n sleeptime: 10000\n stage.cleanup: 1\n useragent_header: Mozilla/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit/531.2+ (KHTML, like Gecko) Version/5.0 Safari/531.2+\n uses_cookies: 1\n watermark: 391144938\n x64:\n beacon_type: HTTPS\n cfg_caution: 1\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n Accept: text/html,application/xhtml+xml,application/xml;\n Host: getbootstrap.com\n Accept-Encoding: gzip, deflate\n Accept-Language: zh-CN,zh;q=0.9\n __cfduid=\n Cookie\n http-get.uri: 207.57.134.202,/dist/css/bootstrap.min.css\n http-get.verb: POST\n http-post.client:\n Accept: text/html,application/xhtml+xml,application/xml;\n Host: getbootstrap.com\n Accept-Encoding: gzip, deflate\n Accept-Language: zh-CN,zh;q=0.9\n serve\n http-post.uri: /dist/js/bootstrap.bundle.min.js\n http-post.verb: POST\n jitter: 37\n maxgetsize: 1403086\n port: 443\n post-ex.spawnto_x64: %windir%\\sysnative\\svchost.exe -k netsvcs\n post-ex.spawnto_x86: %windir%\\syswow64\\svchost.exe -k netsvcs\n process-inject.allocator: 1\n process-inject.execute:\n ntdll:RtlUserThreadStart\n CreateThread\n NtQueueApcThread\n CreateRemoteThread\n RtlCreateUserThread\n process-inject.min_alloc: 16700\n process-inject.startrwx: 64\n process-inject.stub: 41e6db3cfcfa84be7cac6e42f21a22a8\n process-inject.userwx: 32\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: 2dd4d7ebffeb1b682e7ee07bdbce6879\n sleeptime: 10000\n stage.cleanup: 1\n useragent_header: Mozilla/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit/531.2+ (KHTML, like Gecko) Version/5.0 Safari/531.2+\n uses_cookies: 1\n watermark: 391144938\n",
"asn": "AS2914",
"cpe23": [
"cpe:2.3:a:cloudflare:cloudflare",
"cpe:2.3:a:helpsystems:cobalt_strike"
],
"isp": "NTT America, Inc.",
"cpe": [
"cpe:/a:cloudflare:cloudflare",
"cpe:/a:helpsystems:cobalt_strike"
],
"domains": [],
"ip_str": "207.57.134.202",
"os": null,
"_shodan": {
"region": "na",
"module": "https",
"ptr": true,
"options": {},
"id": "df522ae1-18f5-4971-a9fe-37705e18233b",
"crawler": "5e070e08e49493a3c52046c387bd5bc87c1052b9"
}
}