102.220.160.198 — intel.lukealbertson.com

Indicator 102.220.160.198 Type ip Category C2 Infrastructure Family AsyncRAT Hosting FlashWISP Confidence high VT Score 15/94 Source shodan First Seen 2026-09-11 08:00:43 UTC Last Seen 2026-10-10 00:00:19 UTC Shodan View on Shodan ↗
Raw JSON
{
  "product": "AsyncRAT",
  "hash": 0,
  "os": null,
  "asn": "AS328528",
  "tags": [
    "c2",
    "self-signed"
  ],
  "timestamp": "2026-09-11T01:17:12.513185",
  "isp": "NetIT Solutions LTD",
  "transport": "tcp",
  "_shodan": {
    "region": "na",
    "module": "https-simple-new",
    "ptr": true,
    "options": {},
    "id": "75fa97c4-c06f-420b-b20f-888b2a93893e",
    "crawler": "98848070b62e479cf1076528bad24eba591bfb3d"
  },
  "ssl": {
    "chain_sha256": [
      "65a8ef64e5d7757cf017fd80952c1fdd65c96fd3ca295a460ca98c6d2a3c39a5"
    ],
    "jarm": "22b22b07b22b22b22b22b22b22b22bfd9c9d14e4f4f67f94f0359f8b28f532",
    "tlsext": [
      {
        "id": 23,
        "name": "extended_master_secret"
      },
      {
        "id": 65281,
        "name": "renegotiation_info"
      }
    ],
    "chain": [
      "-----BEGIN CERTIFICATE-----\nMIIE8jCCAtqgAwIBAgIQAMfly/P1VHkxsh4uegKRczANBgkqhkiG9w0BAQ0FADAa\nMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIxMjA3MDA0MjI0WhgPOTk5\nOTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJ\nKoZIhvcNAQEBBQADggIPADCCAgoCggIBALWcHxzRn+IwS+ygH0E0qHSjAk5QnSW4\nJ9K7aRV+hDPCYVQJbX8naMF/seJdK5AQEhO8eq2xPCbaCv7BnE6wkMO4qs7cLRJc\noK+jrBuFV/Jp6+K1EFfi9B3D+o1aGYffsN5qG+mu7qsyTrvh0FEdzcgTMwGmDLYo\nndMglWmutjv3ooHVpBlPG4BKBxIl8ZR5BCcF845eyjShuEy57X0/t/ggVKbvSpcT\nnjH89aAhUKKYSCjIYH/E2q3meZ7hyDZZS468tpOJbFq1F96UIgUR8mtoDJPo3mNZ\nCHYgE/LFkCXbVFiC3BstSV1iCw80Dtt3vtFd4V0u65Tb61hK2d2u2B23Ecw+/t6B\n5hSvubzGYAFbKei/4v4XOMSYyyULXek0CKk4cXRhZ23DQh09JWhc1WZIV2DT49v5\nzqwXgetIxcYD0/eh4U3/s3V2CQW+lp/9TYjc6qGvH6XhTAdt06gQY/6vszzLI144\nY9cohalLFJxFApQNEQLIS/6iVzUbBP8dlQTzTQEUhVVCYOnwZQBFNCjRHeLVW3T/\nMwg0Pha8vM57jykyBMYqQyV86beuMedt/l+vQke5HzSBj1hM06pEkFegL+RYgQdW\nxtG+Jm+Rlz7AdJPQ82jJFUrGkjsZlBmg56qBZtnJFzcDpgHO1hBJeIojmVF/jpzR\nKakDaWJ7UNa3AgMBAAGjMjAwMB0GA1UdDgQWBBRo5L6Hno4FfXnETSuqj2EaKKQi\nWTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAPy9xg7hFLAnFh\nGje634kVcTW8pptehj6dKJCInhSgr2AU72kd4o+Z71bis3uN9zlmij7mprgvJreJ\nqsQ2kNBYIEPv6MBgNnuaZDQfLJbdLpABcSR8Rp24VrCrn2R6tkD7jBM4MWl12fYt\na5jRWVthISRI6wGJbr3dhHLcC+F/56u/V3C4k2U9JIVFvZGOVKEPyXsaSx/MZcS4\nitzulet+oJJOxx7qSu3vp83mi+d+hf/ScbaeHE+iriEEZ+3FO/dYPH8XBw/QFkLR\nrpyDdOVciVCTxdC8Sy9nYkTyn0AX4BxQuT9bxxSXEyny4un+lT1CYWxh70NutGLd\nRfDXt2b2uomUDzsSNd4L4enKkZrUoMp4U7G0IYPc646q8MlZqj3BJ/bF3YnAzIDK\nSOGAX64d1gk7FSafyKNXt03vKZDwbw+JEaon6BcJUloxXduTdr6JnV7gmV11TBaN\nvTa5tdJy6kgmfCAL38sgpBAzGAhdWrLWy09hsVAG8bUwjVmMipYLWa8h+VF7oiBq\nyqNie/B3a1+X7pwyPKCCYibReycfWvNEUfFrHjY73v9jYURY65AV1vlmFMnzKuDl\nHCTiMyfC/Il3AfaLijAt3vjdDxxOwz+79DQai+TAjvXK2Uk+gFUPVSFAgRWghd4R\ns7sjVoLTNjyBfEkvtoYI9Th8HGX3jw==\n-----END CERTIFICATE-----\n"
    ],
    "versions": [],
    "acceptable_cas": [],
    "alpn": [],
    "cert": {
      "sig_alg": "sha512WithRSAEncryption",
      "issued": "20221207004224Z",
      "expires": "99991231235959Z",
      "pubkey": {
        "bits": 4096,
        "type": "rsa"
      },
      "version": 2,
      "extensions": [
        {
          "data": "\\x04\\x14h\\xe4\\xbe\\x87\\x9e\\x8e\\x05}y\\xc4M+\\xaa\\x8fa\\x1a(\\xa4\"Y",
          "name": "subjectKeyIdentifier"
        },
        {
          "critical": true,
          "data": "0\\x03\\x01\\x01\\xff",
          "name": "basicConstraints"
        }
      ],
      "fingerprint": {
        "sha256": "65a8ef64e5d7757cf017fd80952c1fdd65c96fd3ca295a460ca98c6d2a3c39a5",
        "sha1": "ee882e313d72643dcda040cb6754ccc7ac79d95b"
      },
      "serial": 1.0379279054661004e+36,
      "issuer": {
        "CN": "AsyncRAT Server"
      },
      "expired": false,
      "subject": {
        "CN": "AsyncRAT Server"
      }
    },
    "cipher": {
      "version": "TLSv1.0",
      "bits": 256,
      "name": "ECDHE-RSA-AES256-SHA"
    },
    "trust": {
      "revoked": false,
      "browser": null
    },
    "handshake_states": [
      "before SSL initialization",
      "SSLv3/TLS write client hello",
      "SSLv3/TLS read server hello",
      "SSLv3/TLS read server certificate",
      "SSLv3/TLS read server key exchange",
      "SSLv3/TLS read server done",
      "SSLv3/TLS write client key exchange",
      "SSLv3/TLS write change cipher spec",
      "SSLv3/TLS write finished",
      "SSLv3/TLS read change cipher spec",
      "SSLv3/TLS read finished",
      "SSL negotiation finished successfully"
    ],
    "ja3s": "b74704234e6128f33bff9865696e31b3",
    "ocsp": {}
  },
  "hostnames": [],
  "location": {
    "city": "Osogbo",
    "region_code": "OS",
    "area_code": null,
    "longitude": 4.55698,
    "latitude": 7.77104,
    "country_code": "NG",
    "country_name": "Nigeria"
  },
  "ip": 1725735110,
  "domains": [],
  "org": "FlashWISP",
  "data": "",
  "port": 7001,
  "ip_str": "102.220.160.198"
}