23.227.196.108
C2 Infrastructure CobaltStrike Indicator 23.227.196.108 Type ip Category C2 Infrastructure Family CobaltStrike Hosting HIVELOCITY, Inc. Confidence high VT Score 9/94 Source shodan First Seen 2026-09-11 08:00:43 UTC Last Seen 2026-09-18 16:00:09 UTC Shodan View on Shodan ↗
Raw JSON
{
"cobalt_strike_beacon": {
"x86": {
"beacon_type": "HTTPS",
"jitter": 39,
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (Linux; Android 7.0; Pixel C Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0",
"http-post.client": [
"Host: networkness.com",
"Connection: close",
"Content-Type: text/plain",
"__session__id=",
"Cookie"
],
"maxgetsize": 3728872,
"process-inject.min_alloc": 14163,
"post-ex.spawnto_x86": "%windir%\\syswow64\\regsvr32.exe",
"port": 8443,
"sleeptime": 22209,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"CreateThread",
"RtlCreateUserThread",
"CreateRemoteThread"
],
"process-inject.startrwx": 4,
"post-ex.spawnto_x64": "%windir%\\sysnative\\regsvr32.exe",
"process-inject.stub": "c3238d46406c6fd2acc5bcb01a0e3ed1",
"http-get.uri": "networkness.com,/fam_newspaper,sso.networkness.com,/fam_newspaper,login.networkness.com,/fam_newspaper",
"watermark": 1473793097,
"dns-beacon.strategy_fail_seconds": -1,
"server.publickey_md5": "a7e566fc9415da436bba3a2112dc0971",
"dns-beacon.strategy_fail_x": -1,
"stage.cleanup": 1,
"http-post.verb": "POST",
"http-post.uri": "/nv",
"process-inject.userwx": 32,
"http-get.verb": "GET",
"http-get.client": [
"Host: networkness.com",
"Connection: close",
"Accept: */*",
"Accept-Encoding: br",
"lu=",
"Cookie",
"Type=false"
]
},
"x64": {
"beacon_type": "HTTPS",
"jitter": 39,
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (Linux; Android 7.0; Pixel C Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0",
"http-post.client": [
"Host: networkness.com",
"Connection: close",
"Content-Type: text/plain",
"__session__id=",
"Cookie"
],
"maxgetsize": 3728872,
"process-inject.min_alloc": 14163,
"post-ex.spawnto_x86": "%windir%\\syswow64\\regsvr32.exe",
"port": 8443,
"sleeptime": 22209,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"CreateThread",
"RtlCreateUserThread",
"CreateRemoteThread"
],
"process-inject.startrwx": 4,
"post-ex.spawnto_x64": "%windir%\\sysnative\\regsvr32.exe",
"process-inject.stub": "c3238d46406c6fd2acc5bcb01a0e3ed1",
"http-get.uri": "networkness.com,/ny,sso.networkness.com,/ny,login.networkness.com,/fam_newspaper",
"watermark": 1473793097,
"dns-beacon.strategy_fail_seconds": -1,
"server.publickey_md5": "a7e566fc9415da436bba3a2112dc0971",
"dns-beacon.strategy_fail_x": -1,
"stage.cleanup": 1,
"http-post.verb": "POST",
"http-post.uri": "/nv",
"process-inject.userwx": 32,
"http-get.verb": "GET",
"http-get.client": [
"Host: networkness.com",
"Connection: close",
"Accept: */*",
"Accept-Encoding: br",
"lu=",
"Cookie",
"Type=false"
]
}
},
"ip": 400802924,
"http": {
"status": 404,
"robots_hash": null,
"redirects": [],
"title_hash": null,
"securitytxt": null,
"title": null,
"sitemap_hash": null,
"robots": null,
"dom_hash": 0,
"components_hash": 0,
"headers_hash": 11853219,
"host": "23.227.196.108",
"html": "",
"server_hash": -610147488,
"location": "/",
"components": {},
"securitytxt_hash": null,
"headers": {
"date": "Thu, 10 Sep 2026 20:57:13 GMT",
"content-length": "0",
"content-type": "text/plain",
"server": "golfe2"
},
"server": "golfe2",
"sitemap": null,
"html_hash": 0
},
"port": 58443,
"transport": "tcp",
"cpe23_hash": -527748401,
"location": {
"city": "Chicago",
"region_code": "IL",
"area_code": null,
"longitude": -87.6306,
"latitude": 41.8426,
"country_code": "US",
"country_name": "United States"
},
"product": "Cobalt Strike Beacon",
"hash": 535679798,
"timestamp": "2026-09-10T20:54:20.034585",
"ssl": {
"chain_sha256": [
"56a9c634d83399ce77c0e544847146a571cef4addbe3269a0e88c56a006b9899",
"83624fd338c8d9b023c18a67cb7a9c0519da43d11775b4c6cbdad45c3d997c52"
],
"jarm": "28d28d28d00028d00042d42d00042de0d120da90d5910c5de2af43b74a6bd8",
"tlsext": [
{
"id": 43,
"name": "supported_versions"
},
{
"id": 51,
"name": "key_share"
},
{
"id": 10,
"name": "supported_groups"
}
],
"chain": [
"-----BEGIN CERTIFICATE-----\nMIIDuTCCAz+gAwIBAgISBsy4jlXZ8bNUiBTZ6zLyvinpMAoGCCqGSM49BAMDMDIx\nCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF\nODAeFw0yNjA1MTUwNjM5NDdaFw0yNjA4MTMwNjM5NDZaMBoxGDAWBgNVBAMTD25l\ndHdvcmtuZXNzLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCB6yfgL3/q4\ngUAEJ7B/nlDc4RLtIV+vD2F/CwStnEzzYfD2vTY6fJwKHcLAnI8+Dgp77e0G/YzZ\nRMyqM/Y4ODyjggJLMIICRzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYB\nBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUN9ei6bDeafg6Wl5UgpC7qUZE\ngVcwHwYDVR0jBBgwFoAUjw0TovYuftFQbDMYOF1ZjiNykcowMgYIKwYBBQUHAQEE\nJjAkMCIGCCsGAQUFBzAChhZodHRwOi8vZTguaS5sZW5jci5vcmcvMEgGA1UdEQRB\nMD+CD25ldHdvcmtuZXNzLmNvbYIXcHJvZmlsZS5uZXR3b3JrbmVzcy5jb22CE3Nz\nby5uZXR3b3JrbmVzcy5jb20wEwYDVR0gBAwwCjAIBgZngQwBAgEwLgYDVR0fBCcw\nJTAjoCGgH4YdaHR0cDovL2U4LmMubGVuY3Iub3JnLzEwNi5jcmwwggENBgorBgEE\nAdZ5AgQCBIH+BIH7APkAdwDCMX5XRRmjRe5/ON6ykEHrx8IhWiK/f9W1rXaa2Q5S\nzQAAAZ4qkmZSAAAEAwBIMEYCIQCmXp3aIXQ92Gtf4PcJ5mivcQokQL5qPIYfUg+Q\nsd1A1AIhAMPzlFM/y/D/4RmTbZEc+E4cSN3RPp31/QXneP+c1/1nAH4AbP5QGUOo\nXqkWvFLRM+TcyR7xQRx9JYQg0XOAnhgY6zoAAAGeKpJmpwAIAAAFAAuY5/QEAwBH\nMEUCIA4K9ocgubBRzw5bDWcVgJB2gqVqmIGwBzyOFc2qoulOAiEA/8jH7pAsBv6A\nNC1Ko+bAC2yLRkrHjyX/CYNNyHl0m0QwCgYIKoZIzj0EAwMDaAAwZQIxANXfU/yF\n7knQUW4Pvc8Yv1HHs6p3W524CHj3yAJjEdCNoM/Sj3bICneguZwoxEMPLgIwKJ/F\n46wwKzUPChdP36QOu6axsFrNUOdmM1aB9ijnEwAfLAuk4QjpcsFPtf+2O9gZ\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMIIEVjCCAj6gAwIBAgIQY5WTY8JOcIJxWRi/w9ftVjANBgkqhkiG9w0BAQsFADBP\nMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy\nY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNDAzMTMwMDAwMDBa\nFw0yNzAzMTIyMzU5NTlaMDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBF\nbmNyeXB0MQswCQYDVQQDEwJFODB2MBAGByqGSM49AgEGBSuBBAAiA2IABNFl8l7c\nS7QMApzSsvru6WyrOq44ofTUOTIzxULUzDMMNMchIJBwXOhiLxxxs0LXeb5GDcHb\nR6EToMffgSZjO9SNHfY9gjMy9vQr5/WWOrQTZxh7az6NSNnq3u2ubT6HTKOB+DCB\n9TAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMB\nMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFI8NE6L2Ln7RUGwzGDhdWY4j\ncpHKMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEB\nBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAE\nDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5j\nci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQBnE0hGINKsCYWi0Xx1ygxD5qihEjZ0\nRI3tTZz1wuATH3ZwYPIp97kWEayanD1j0cDhIYzy4CkDo2jB8D5t0a6zZWzlr98d\nAQFNh8uKJkIHdLShy+nUyeZxc5bNeMp1Lu0gSzE4McqfmNMvIpeiwWSYO9w82Ob8\notvXcO2JUYi3svHIWRm3+707DUbL51XMcY2iZdlCq4Wa9nbuk3WTU4gr6LY8MzVA\naDQG2+4U3eJ6qUF10bBnR1uuVyDYs9RhrwucRVnfuDj29CMLTsplM5f5wSV5hUpm\nUwp/vV7M4w4aGunt74koX71n4EdagCsL/Yk5+mAQU0+tue0JOfAV/R6t1k+Xk9s2\nHMQFeoxppfzAVC04FdG9M+AC2JWxmFSt6BCuh3CEey3fE52Qrj9YM75rtvIjsm/1\nHl+u//Wqxnu1ZQ4jpa+VpuZiGOlWrqSP9eogdOhCGisnyewWJwRQOqK16wiGyZeR\nxs/Bekw65vwSIaVkBruPiTfMOo0Zh4gVa8/qJgMbJbyrwwG97z/PRgmLKCDl8z3d\ntA0Z7qq7fta0Gl24uyuB05dqI5J1LvAzKuWdIjT1tP8qCoxSE/xpix8hX2dt3h+/\njujUgFPFZ0EVZ0xSyBNRF3MboGZnYXFUxpNjTWPKpagDHJQmqrAcDmWJnMsFY3jS\nu1igv3OefnWjSQ==\n-----END CERTIFICATE-----\n"
],
"versions": [],
"acceptable_cas": [],
"alpn": [],
"cert": {
"sig_alg": "ecdsa-with-SHA384",
"issued": "20260515063947Z",
"expires": "20260813063946Z",
"pubkey": {
"bits": 256,
"type": "dsa"
},
"version": 2,
"extensions": [
{
"critical": true,
"data": "\\x03\\x02\\x07\\x80",
"name": "keyUsage"
},
{
"data": "0\\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01",
"name": "extendedKeyUsage"
},
{
"critical": true,
"data": "0\\x00",
"name": "basicConstraints"
},
{
"data": "\\x04\\x147\\xd7\\xa2\\xe9\\xb0\\xdei\\xf8:Z^T\\x82\\x90\\xbb\\xa9FD\\x81W",
"name": "subjectKeyIdentifier"
},
{
"data": "0\\x16\\x80\\x14\\x8f\\r\\x13\\xa2\\xf6.~\\xd1Pl3\\x188]Y\\x8e#r\\x91\\xca",
"name": "authorityKeyIdentifier"
},
{
"data": "0$0\"\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86\\x16http://e8.i.lencr.org/",
"name": "authorityInfoAccess"
},
{
"data": "0?\\x82\\x0fnetworkness.com\\x82\\x17profile.networkness.com\\x82\\x13sso.networkness.com",
"name": "subjectAltName"
},
{
"data": "0\\n0\\x08\\x06\\x06g\\x81\\x0c\\x01\\x02\\x01",
"name": "certificatePolicies"
},
{
"data": "0%0#\\xa0!\\xa0\\x1f\\x86\\x1dhttp://e8.c.lencr.org/106.crl",
"name": "crlDistributionPoints"
},
{
"data": "\\x04\\x81\\xfb\\x00\\xf9\\x00w\\x00\\xc21~WE\\x19\\xa3E\\xee\\x7f8\\xde\\xb2\\x90A\\xeb\\xc7\\xc2!Z\"\\xbf\\x7f\\xd5\\xb5\\xadv\\x9a\\xd9\\x0eR\\xcd\\x00\\x00\\x01\\x9e*\\x92fR\\x00\\x00\\x04\\x03\\x00H0F\\x02!\\x00\\xa6^\\x9d\\xda!t=\\xd8k_\\xe0\\xf7\\t\\xe6h\\xafq\\n$@\\xbej<\\x86\\x1fR\\x0f\\x90\\xb1\\xdd@\\xd4\\x02!\\x00\\xc3\\xf3\\x94S?\\xcb\\xf0\\xff\\xe1\\x19\\x93m\\x91\\x1c\\xf8N\\x1cH\\xdd\\xd1>\\x9d\\xf5\\xfd\\x05\\xe7x\\xff\\x9c\\xd7\\xfdg\\x00~\\x00l\\xfeP\\x19C\\xa8^\\xa9\\x16\\xbcR\\xd13\\xe4\\xdc\\xc9\\x1e\\xf1A\\x1c}%\\x84 \\xd1s\\x80\\x9e\\x18\\x18\\xeb:\\x00\\x00\\x01\\x9e*\\x92f\\xa7\\x00\\x08\\x00\\x00\\x05\\x00\\x0b\\x98\\xe7\\xf4\\x04\\x03\\x00G0E\\x02 \\x0e\\n\\xf6\\x87 \\xb9\\xb0Q\\xcf\\x0e[\\rg\\x15\\x80\\x90v\\x82\\xa5j\\x98\\x81\\xb0\\x07<\\x8e\\x15\\xcd\\xaa\\xa2\\xe9N\\x02!\\x00\\xff\\xc8\\xc7\\xee\\x90,\\x06\\xfe\\x804-J\\xa3\\xe6\\xc0\\x0bl\\x8bFJ\\xc7\\x8f%\\xff\\t\\x83M\\xc8yt\\x9bD",
"name": "ct_precert_scts"
}
],
"fingerprint": {
"sha256": "56a9c634d83399ce77c0e544847146a571cef4addbe3269a0e88c56a006b9899",
"sha1": "5a6e0b7715dc069ae39034ab645a5e755e343de5"
},
"serial": 5.923366354410834e+41,
"issuer": {
"C": "US",
"CN": "E8",
"O": "Let's Encrypt"
},
"expired": true,
"subject": {
"CN": "networkness.com"
}
},
"cipher": {
"version": "TLSv1.3",
"bits": 256,
"name": "TLS_AES_256_GCM_SHA384"
},
"trust": {
"revoked": false,
"browser": null
},
"handshake_states": [
"before SSL initialization",
"SSLv3/TLS write client hello",
"SSLv3/TLS read server hello",
"TLSv1.3 read encrypted extensions",
"SSLv3/TLS read server certificate",
"TLSv1.3 read server certificate verify",
"SSLv3/TLS read finished",
"SSLv3/TLS write change cipher spec",
"SSLv3/TLS write finished",
"SSL negotiation finished successfully"
],
"ja3s": "f03a69cfa3944d6d51bc52febd87a1a8",
"ocsp": {}
},
"hostnames": [
"profile.networkness.com",
"networkness.com",
"sso.networkness.com",
"23-227-196-108.static.hvvc.us"
],
"org": "HIVELOCITY, Inc.",
"data": "HTTP/1.1 404 Not Found\r\nDate: Thu, 10 Sep 2026 20:57:13 GMT\r\nContent-Type: text/plain\r\nContent-Length: 0\r\nServer: golfe2\r\n\r\n\nCobalt Strike Beacon:\n x86:\n beacon_type: HTTPS\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n Host: networkness.com\n Connection: close\n Accept: */*\n Accept-Encoding: br\n lu=\n Cookie\n Type=false\n http-get.uri: networkness.com,/fam_newspaper,sso.networkness.com,/fam_newspaper,login.networkness.com,/fam_newspaper\n http-get.verb: GET\n http-post.client:\n Host: networkness.com\n Connection: close\n Content-Type: text/plain\n __session__id=\n Cookie\n http-post.uri: /nv\n http-post.verb: POST\n jitter: 39\n maxgetsize: 3728872\n port: 8443\n post-ex.spawnto_x64: %windir%\\sysnative\\regsvr32.exe\n post-ex.spawnto_x86: %windir%\\syswow64\\regsvr32.exe\n process-inject.execute:\n CreateThread\n RtlCreateUserThread\n CreateRemoteThread\n process-inject.min_alloc: 14163\n process-inject.startrwx: 4\n process-inject.stub: c3238d46406c6fd2acc5bcb01a0e3ed1\n process-inject.userwx: 32\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: a7e566fc9415da436bba3a2112dc0971\n sleeptime: 22209\n stage.cleanup: 1\n useragent_header: Mozilla/5.0 (Linux; Android 7.0; Pixel C Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0\n uses_cookies: 1\n watermark: 1473793097\n x64:\n beacon_type: HTTPS\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n Host: networkness.com\n Connection: close\n Accept: */*\n Accept-Encoding: br\n lu=\n Cookie\n Type=false\n http-get.uri: networkness.com,/ny,sso.networkness.com,/ny,login.networkness.com,/fam_newspaper\n http-get.verb: GET\n http-post.client:\n Host: networkness.com\n Connection: close\n Content-Type: text/plain\n __session__id=\n Cookie\n http-post.uri: /nv\n http-post.verb: POST\n jitter: 39\n maxgetsize: 3728872\n port: 8443\n post-ex.spawnto_x64: %windir%\\sysnative\\regsvr32.exe\n post-ex.spawnto_x86: %windir%\\syswow64\\regsvr32.exe\n process-inject.execute:\n CreateThread\n RtlCreateUserThread\n CreateRemoteThread\n process-inject.min_alloc: 14163\n process-inject.startrwx: 4\n process-inject.stub: c3238d46406c6fd2acc5bcb01a0e3ed1\n process-inject.userwx: 32\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: a7e566fc9415da436bba3a2112dc0971\n sleeptime: 22209\n stage.cleanup: 1\n useragent_header: Mozilla/5.0 (Linux; Android 7.0; Pixel C Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0\n uses_cookies: 1\n watermark: 1473793097\n",
"asn": "AS29802",
"cpe23": [
"cpe:2.3:a:helpsystems:cobalt_strike"
],
"isp": "HIVELOCITY, Inc.",
"cpe": [
"cpe:/a:helpsystems:cobalt_strike"
],
"domains": [
"networkness.com",
"hvvc.us"
],
"ip_str": "23.227.196.108",
"os": null,
"_shodan": {
"region": "na",
"crawler": "3318df79ddd6eb8be712bcb310e94bbf23160760",
"options": {},
"module": "auto",
"id": "f4f155e6-5e8e-4359-b5b6-91388d31cd13"
}
}