74.0.32.177
C2 Infrastructure CobaltStrike Indicator 74.0.32.177 Type ip Category C2 Infrastructure Family CobaltStrike Hosting Internet Utilities NA LLC Confidence high VT Score 5/94 Source shodan First Seen 2026-10-02 16:00:33 UTC Last Seen 2026-10-10 00:00:19 UTC Shodan View on Shodan ↗
Raw JSON
{
"ip": 1241522353,
"http": {
"status": 404,
"robots_hash": null,
"redirects": [],
"title_hash": null,
"securitytxt": null,
"title": null,
"sitemap_hash": null,
"robots": null,
"dom_hash": 0,
"components_hash": 1723476431,
"headers_hash": -202934289,
"host": "74.0.32.177",
"html": "",
"server_hash": 1186221244,
"location": "/",
"components": {
"Nginx": {
"categories": [
"Web servers",
"Reverse proxies"
],
"versions": [
"1.24.0"
]
},
"Ubuntu": {
"categories": [
"Operating systems"
]
}
},
"securitytxt_hash": null,
"headers": {
"date": "Wed, 30 Sep 2026 07:21:10 GMT",
"content-length": "0",
"content-type": "text/plain",
"keep-alive": "timeout=5, max=100",
"server": "nginx/1.24.0 (Ubuntu)"
},
"server": "nginx/1.24.0 (Ubuntu)",
"sitemap": null,
"html_hash": 0
},
"port": 443,
"transport": "tcp",
"cpe23_hash": -1421849094,
"location": {
"city": "San Francisco",
"region_code": "CA",
"area_code": null,
"longitude": -122.41942,
"latitude": 37.77493,
"country_code": "US",
"country_name": "United States"
},
"vulns": {
"CVE-2023-44487": {
"verified": false,
"ransomware_campaign": "Unknown",
"ranking_epss": 0.99999,
"cvss_v2": null,
"cvss_version": 3,
"summary": "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.",
"references": [
"http://www.openwall.com/lists/oss-security/2023/10/10/6",
"http://www.openwall.com/lists/oss-security/2023/10/10/7",
"http://www.openwall.com/lists/oss-security/2023/10/13/4",
"http://www.openwall.com/lists/oss-security/2023/10/13/9",
"http://www.openwall.com/lists/oss-security/2023/10/18/4",
"http://www.openwall.com/lists/oss-security/2023/10/18/8",
"http://www.openwall.com/lists/oss-security/2023/10/19/6",
"http://www.openwall.com/lists/oss-security/2023/10/20/8",
"https://access.redhat.com/security/cve/cve-2023-44487",
"https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/",
"https://aws.amazon.com/security/security-bulletins/AWS-2023-011/",
"https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/",
"https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/",
"https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/",
"https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack",
"https://blog.vespa.ai/cve-2023-44487/",
"https://bugzilla.proxmox.com/show_bug.cgi?id=4988",
"https://bugzilla.redhat.com/show_bug.cgi?id=2242803",
"https://bugzilla.suse.com/show_bug.cgi?id=1216123",
"https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9",
"https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/",
"https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack",
"https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125",
"https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715",
"https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve",
"https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764",
"https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088",
"https://github.com/Azure/AKS/issues/3947",
"https://github.com/Kong/kong/discussions/11741",
"https://github.com/advisories/GHSA-qppj-fm5r-hxr3",
"https://github.com/advisories/GHSA-vx74-f528-fxqg",
"https://github.com/advisories/GHSA-xpw8-rcwv-8f8p",
"https://github.com/akka/akka-http/issues/4323",
"https://github.com/alibaba/tengine/issues/1872",
"https://github.com/apache/apisix/issues/10320",
"https://github.com/apache/httpd-site/pull/10",
"https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113",
"https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2",
"https://github.com/apache/trafficserver/pull/10564",
"https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487",
"https://github.com/bcdannyboy/CVE-2023-44487",
"https://github.com/caddyserver/caddy/issues/5877",
"https://github.com/caddyserver/caddy/releases/tag/v2.7.5",
"https://github.com/dotnet/announcements/issues/277",
"https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73",
"https://github.com/eclipse/jetty.project/issues/10679",
"https://github.com/envoyproxy/envoy/pull/30055",
"https://github.com/etcd-io/etcd/issues/16740",
"https://github.com/facebook/proxygen/pull/466",
"https://github.com/golang/go/issues/63417",
"https://github.com/grpc/grpc-go/pull/6703",
"https://github.com/grpc/grpc/releases/tag/v1.59.2",
"https://github.com/h2o/h2o/pull/3291",
"https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf",
"https://github.com/haproxy/haproxy/issues/2312",
"https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244",
"https://github.com/junkurihara/rust-rpxy/issues/97",
"https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1",
"https://github.com/kazu-yamamoto/http2/issues/93",
"https://github.com/kubernetes/kubernetes/pull/121120",
"https://github.com/line/armeria/pull/5232",
"https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632",
"https://github.com/micrictor/http2-rst-stream",
"https://github.com/microsoft/CBL-Mariner/pull/6381",
"https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61",
"https://github.com/nghttp2/nghttp2/pull/1961",
"https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0",
"https://github.com/ninenines/cowboy/issues/1615",
"https://github.com/nodejs/node/pull/50121",
"https://github.com/openresty/openresty/issues/930",
"https://github.com/opensearch-project/data-prepper/issues/3474",
"https://github.com/oqtane/oqtane.framework/discussions/3367",
"https://github.com/projectcontour/contour/pull/5826",
"https://github.com/tempesta-tech/tempesta/issues/1986",
"https://github.com/varnishcache/varnish-cache/issues/3996",
"https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo",
"https://istio.io/latest/news/security/istio-security-2023-004/",
"https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/",
"https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html",
"https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html",
"https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/",
"https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html",
"https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html",
"https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html",
"https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487",
"https://my.f5.com/manage/s/article/K000137106",
"https://netty.io/news/2023/10/10/4-1-100-Final.html",
"https://news.ycombinator.com/item?id=37830987",
"https://news.ycombinator.com/item?id=37830998",
"https://news.ycombinator.com/item?id=37831062",
"https://news.ycombinator.com/item?id=37837043",
"https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/",
"https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected",
"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ",
"https://security.gentoo.org/glsa/202311-09",
"https://security.netapp.com/advisory/ntap-20231016-0001/",
"https://security.netapp.com/advisory/ntap-20240426-0007/",
"https://security.netapp.com/advisory/ntap-20240621-0006/",
"https://security.netapp.com/advisory/ntap-20240621-0007/",
"https://security.paloaltonetworks.com/CVE-2023-44487",
"https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14",
"https://ubuntu.com/security/CVE-2023-44487",
"https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/",
"https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487",
"https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event",
"https://www.debian.org/security/2023/dsa-5521",
"https://www.debian.org/security/2023/dsa-5522",
"https://www.debian.org/security/2023/dsa-5540",
"https://www.debian.org/security/2023/dsa-5549",
"https://www.debian.org/security/2023/dsa-5558",
"https://www.debian.org/security/2023/dsa-5570",
"https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487",
"https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/",
"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/",
"https://www.openwall.com/lists/oss-security/2023/10/10/6",
"https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack",
"https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/",
"http://www.openwall.com/lists/oss-security/2023/10/13/4",
"http://www.openwall.com/lists/oss-security/2023/10/13/9",
"http://www.openwall.com/lists/oss-security/2023/10/18/4",
"http://www.openwall.com/lists/oss-security/2023/10/18/8",
"http://www.openwall.com/lists/oss-security/2023/10/19/6",
"http://www.openwall.com/lists/oss-security/2023/10/20/8",
"http://www.openwall.com/lists/oss-security/2025/08/13/6",
"https://access.redhat.com/security/cve/cve-2023-44487",
"https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/",
"https://aws.amazon.com/security/security-bulletins/AWS-2023-011/",
"https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/",
"https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/",
"https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/",
"https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack",
"https://blog.vespa.ai/cve-2023-44487/",
"https://bugzilla.proxmox.com/show_bug.cgi?id=4988",
"https://bugzilla.redhat.com/show_bug.cgi?id=2242803",
"https://bugzilla.suse.com/show_bug.cgi?id=1216123",
"https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9",
"https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/",
"https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack",
"https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125",
"https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715",
"https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve",
"https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764",
"https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088",
"https://github.com/Azure/AKS/issues/3947",
"https://github.com/Kong/kong/discussions/11741",
"https://github.com/advisories/GHSA-qppj-fm5r-hxr3",
"https://github.com/advisories/GHSA-vx74-f528-fxqg",
"https://github.com/advisories/GHSA-xpw8-rcwv-8f8p",
"https://github.com/akka/akka-http/issues/4323",
"https://github.com/alibaba/tengine/issues/1872",
"https://github.com/apache/apisix/issues/10320",
"https://github.com/apache/httpd-site/pull/10",
"https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113",
"https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2",
"https://github.com/apache/trafficserver/pull/10564",
"https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487",
"https://github.com/bcdannyboy/CVE-2023-44487",
"https://github.com/caddyserver/caddy/issues/5877",
"https://github.com/caddyserver/caddy/releases/tag/v2.7.5",
"https://github.com/dotnet/announcements/issues/277",
"https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73",
"https://github.com/eclipse/jetty.project/issues/10679",
"https://github.com/envoyproxy/envoy/pull/30055",
"https://github.com/etcd-io/etcd/issues/16740",
"https://github.com/facebook/proxygen/pull/466",
"https://github.com/golang/go/issues/63417",
"https://github.com/grpc/grpc-go/pull/6703",
"https://github.com/h2o/h2o/pull/3291",
"https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf",
"https://github.com/haproxy/haproxy/issues/2312",
"https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244",
"https://github.com/junkurihara/rust-rpxy/issues/97",
"https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1",
"https://github.com/kazu-yamamoto/http2/issues/93",
"https://github.com/kubernetes/kubernetes/pull/121120",
"https://github.com/line/armeria/pull/5232",
"https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632",
"https://github.com/micrictor/http2-rst-stream",
"https://github.com/microsoft/CBL-Mariner/pull/6381",
"https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61",
"https://github.com/nghttp2/nghttp2/pull/1961",
"https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0",
"https://github.com/ninenines/cowboy/issues/1615",
"https://github.com/nodejs/node/pull/50121",
"https://github.com/openresty/openresty/issues/930",
"https://github.com/opensearch-project/data-prepper/issues/3474",
"https://github.com/oqtane/oqtane.framework/discussions/3367",
"https://github.com/projectcontour/contour/pull/5826",
"https://github.com/tempesta-tech/tempesta/issues/1986",
"https://github.com/varnishcache/varnish-cache/issues/3996",
"https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo",
"https://istio.io/latest/news/security/istio-security-2023-004/",
"https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/",
"https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html",
"https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html",
"https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/",
"https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html",
"https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html",
"https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html",
"https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487",
"https://my.f5.com/manage/s/article/K000137106",
"https://netty.io/news/2023/10/10/4-1-100-Final.html",
"https://news.ycombinator.com/item?id=37830987",
"https://news.ycombinator.com/item?id=37830998",
"https://news.ycombinator.com/item?id=37831062",
"https://news.ycombinator.com/item?id=37837043",
"https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/",
"https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected",
"https://security.gentoo.org/glsa/202311-09",
"https://security.netapp.com/advisory/ntap-20231016-0001/",
"https://security.netapp.com/advisory/ntap-20240426-0007/",
"https://security.netapp.com/advisory/ntap-20240621-0006/",
"https://security.netapp.com/advisory/ntap-20240621-0007/",
"https://security.paloaltonetworks.com/CVE-2023-44487",
"https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14",
"https://ubuntu.com/security/CVE-2023-44487",
"https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/",
"https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487",
"https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event",
"https://www.debian.org/security/2023/dsa-5521",
"https://www.debian.org/security/2023/dsa-5522",
"https://www.debian.org/security/2023/dsa-5540",
"https://www.debian.org/security/2023/dsa-5549",
"https://www.debian.org/security/2023/dsa-5558",
"https://www.debian.org/security/2023/dsa-5570",
"https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487",
"https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/",
"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/",
"https://www.openwall.com/lists/oss-security/2023/10/10/6",
"https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack",
"https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/",
"https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause",
"https://cert-portal.siemens.com/productcert/html/ssa-082556.html",
"https://cert-portal.siemens.com/productcert/html/ssa-341067.html",
"https://cert-portal.siemens.com/productcert/html/ssa-784301.html",
"https://cert-portal.siemens.com/productcert/html/ssa-832273.html",
"https://cert-portal.siemens.com/productcert/html/ssa-915275.html",
"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487"
],
"epss": 0.99999,
"kev": true,
"cvss": 7.5
},
"CVE-2025-23419": {
"verified": false,
"ranking_epss": 0.85811,
"cvss_v2": null,
"cvss_version": 4,
"summary": "When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication. \n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
"references": [
"https://my.f5.com/manage/s/article/K000149173",
"http://www.openwall.com/lists/oss-security/2025/02/05/8",
"https://lists.debian.org/debian-lts-announce/2025/03/msg00017.html"
],
"epss": 0.02795,
"cvss": 5.3
}
},
"product": "Cobalt Strike Beacon",
"hash": -686998716,
"tags": [
"self-signed",
"eol-product"
],
"timestamp": "2026-09-30T07:21:10.266309",
"ssl": {
"chain_sha256": [
"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"
],
"jarm": "2ad2ad16d2ad2ad00042d42d00042ddb04deffa1705e2edc44cae1ed24a4da",
"tlsext": [
{
"id": 43,
"name": "supported_versions"
},
{
"id": 51,
"name": "key_share"
},
{
"id": 10,
"name": "supported_groups"
}
],
"chain": [
"-----BEGIN CERTIFICATE-----\nMIIDIzCCAgugAwIBAgIECLsA7jANBgkqhkiG9w0BAQsFADBCMQkwBwYDVQQGEwAx\nCTAHBgNVBAgTADEJMAcGA1UEBxMAMQkwBwYDVQQKEwAxCTAHBgNVBAsTADEJMAcG\nA1UEAxMAMB4XDTE1MDUyMDE4MjYyNFoXDTI1MDUxNzE4MjYyNFowQjEJMAcGA1UE\nBhMAMQkwBwYDVQQIEwAxCTAHBgNVBAcTADEJMAcGA1UEChMAMQkwBwYDVQQLEwAx\nCTAHBgNVBAMTADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJjXGpNx\njm97YowJUxMyM/QBjGTnyUqMXt1IsXArVdop3F/fGdhsmWkExTt8AfjWm9TL2I3K\nCVKqBhQ9U8+W+l3JAPNaqLnOqRSfeQ+SQ0tmLuVn1AVQt1RKYZGo+o70G/yAXBNw\nCQ3mUisLe6Ln926E3seZM6gb8HesF/w+2sCcQ2UaqLY3hKVIDYvlenNaNMxtaw+8\nA/3udT+pIX1JyrlIlt0SDg5Ya2opwYTFJM64KbuyDKkK213A5Sz00Rh13PVRKWlp\nfVtgoh9BNupzJOG/GE/x0XmXCYAOIGrm8uujAtUWJ5nkbaczf2ldnITJBw+3iQrt\nE1LEM8aUJeKRCVkCAwEAAaMhMB8wHQYDVR0OBBYEFHNrXtvPyRkdW9AfjOOrVjgY\nnwJPMA0GCSqGSIb3DQEBCwUAA4IBAQBU9S+o9YRFBTzcCeZ4phipmwJ9PsIFKoid\ngkTekbt3EzyL+Q+nySQ/Gn4ZXdliFYxKNcRmxbSWCa9jX6qJb6t7gcLBP8Hp7kWL\nsNdbk19+iSDphVfO6UdL6ZVIbIy0vNO0/LgEKVi7tzE84elcaS45ZSPY+HnySF2s\nP3SF0n9iF/bWdzYOjLcPpgavsT66KLrileXkYjCWFOXufnZgpf11pGd3wTJEIenS\nabc90LQ4rAvBJPicY/AfhIth/g4GiDG+M1DmzlV+1F0nNr3KuNGjeghLVegKoRq/\nb5PF+0kpSK7HUwIdrgZsqz1ORsMToEyv8LvxIyL0DTCLBJSHmgJy\n-----END CERTIFICATE-----\n"
],
"versions": [
"-TLSv1",
"-SSLv2",
"-SSLv3",
"-TLSv1.1",
"TLSv1.2",
"TLSv1.3"
],
"acceptable_cas": [],
"alpn": [],
"cert": {
"sig_alg": "sha256WithRSAEncryption",
"issued": "20150520182624Z",
"expires": "20250517182624Z",
"pubkey": {
"bits": 2048,
"type": "rsa"
},
"version": 2,
"extensions": [
{
"data": "\\x04\\x14sk^\\xdb\\xcf\\xc9\\x19\\x1d[\\xd0\\x1f\\x8c\\xe3\\xabV8\\x18\\x9f\\x02O",
"name": "subjectKeyIdentifier"
}
],
"fingerprint": {
"sha256": "87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c",
"sha1": "6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c"
},
"serial": 146473198,
"issuer": {
"C": "",
"CN": "",
"L": "",
"O": "",
"ST": "",
"OU": ""
},
"expired": true,
"subject": {
"C": "",
"CN": "",
"L": "",
"O": "",
"ST": "",
"OU": ""
}
},
"cipher": {
"version": "TLSv1.3",
"bits": 256,
"name": "TLS_AES_256_GCM_SHA384"
},
"trust": {
"revoked": false,
"browser": null
},
"handshake_states": [
"before SSL initialization",
"SSLv3/TLS write client hello",
"SSLv3/TLS read server hello",
"TLSv1.3 read encrypted extensions",
"SSLv3/TLS read server certificate",
"TLSv1.3 read server certificate verify",
"SSLv3/TLS read finished",
"SSLv3/TLS write change cipher spec",
"SSLv3/TLS write finished",
"SSL negotiation finished successfully"
],
"ja3s": "f03a69cfa3944d6d51bc52febd87a1a8",
"ocsp": {}
},
"hostnames": [],
"org": "Internet Utilities NA LLC",
"data": "HTTP/1.1 404 Not Found\r\nDate: Wed, 30 Sep 2026 07:21:10 GMT\r\nServer: nginx/1.24.0 (Ubuntu)\r\nContent-Length: 0\r\nKeep-Alive: timeout=5, max=100\r\nContent-Type: text/plain\r\n\r\n",
"asn": "AS399486",
"cpe23": [
"cpe:2.3:a:f5:nginx:1.24.0",
"cpe:2.3:a:helpsystems:cobalt_strike",
"cpe:2.3:o:canonical:ubuntu_linux",
"cpe:2.3:o:linux:linux_kernel"
],
"isp": "VIRTUO - 12651980 CANADA INC.",
"cpe": [
"cpe:/a:f5:nginx:1.24.0",
"cpe:/a:helpsystems:cobalt_strike",
"cpe:/o:canonical:ubuntu_linux",
"cpe:/o:linux:linux_kernel"
],
"domains": [],
"ip_str": "74.0.32.177",
"os": "Ubuntu",
"_shodan": {
"region": "na",
"module": "https",
"ptr": true,
"options": {},
"id": "d1c5d73e-86fb-4d6b-ac4e-6d02fb3d5319",
"crawler": "eb6a3b0c4c23bbec821e9a56c850ef9b7c5c7f4c"
}
}