91.92.47.99
C2 Infrastructure CobaltStrike Indicator 91.92.47.99 Type ip Category C2 Infrastructure Family CobaltStrike Hosting TechTies Inc. Confidence high VT Score 12/94 Source shodan First Seen 2026-10-10 00:00:19 UTC Last Seen 2026-10-10 00:00:19 UTC Shodan View on Shodan ↗
Raw JSON
{
"cobalt_strike_beacon": {
"x86": {
"beacon_type": "HTTPS",
"jitter": 33,
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.119 Safari/537.36",
"http-post.client": [
"Host: meritphilips.fans",
"Accept: application/json, */*;q=0.8",
"Accept-Language: en-US,en;q=0.9",
"Content-Type: application/json",
"Referer: https://meritphilips.fans/",
"sid"
],
"maxgetsize": 1048631,
"post-ex.spawnto_x86": "%windir%\\syswow64\\WerFault.exe",
"port": 443,
"sleeptime": 45000,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"CreateThread",
"SetThreadContext",
"CreateRemoteThread",
"RtlCreateUserThread"
],
"process-inject.startrwx": 64,
"post-ex.spawnto_x64": "%windir%\\sysnative\\WerFault.exe",
"process-inject.stub": "ae5afcfee8026674dc8f3b4f2da46c7f",
"http-get.uri": "meritphilips.fans,/cdn/assets/app.min.js",
"watermark": 987654321,
"dns-beacon.strategy_fail_seconds": -1,
"server.publickey_md5": "2fa2cac336b542cab8ca7e71ea5298db",
"dns-beacon.strategy_fail_x": -1,
"http-post.verb": "POST",
"http-post.uri": "/api/v1/events",
"process-inject.userwx": 64,
"http-get.verb": "GET",
"http-get.client": [
"Host: meritphilips.fans",
"Accept: application/javascript, */*;q=0.8",
"Accept-Language: en-US,en;q=0.9",
"Referer: https://meritphilips.fans/",
"__cfduid=",
"Cookie"
]
},
"x64": {
"beacon_type": "HTTPS",
"jitter": 33,
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.119 Safari/537.36",
"http-post.client": [
"Host: meritphilips.fans",
"Accept: application/json, */*;q=0.8",
"Accept-Language: en-US,en;q=0.9",
"Content-Type: application/json",
"Referer: https://meritphilips.fans/",
"sid"
],
"maxgetsize": 1048631,
"post-ex.spawnto_x86": "%windir%\\syswow64\\WerFault.exe",
"port": 443,
"sleeptime": 45000,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"CreateThread",
"SetThreadContext",
"CreateRemoteThread",
"RtlCreateUserThread"
],
"process-inject.startrwx": 64,
"post-ex.spawnto_x64": "%windir%\\sysnative\\WerFault.exe",
"process-inject.stub": "ae5afcfee8026674dc8f3b4f2da46c7f",
"http-get.uri": "meritphilips.fans,/static/js/runtime.js",
"watermark": 987654321,
"dns-beacon.strategy_fail_seconds": -1,
"server.publickey_md5": "2fa2cac336b542cab8ca7e71ea5298db",
"dns-beacon.strategy_fail_x": -1,
"http-post.verb": "POST",
"http-post.uri": "/api/v1/events",
"process-inject.userwx": 64,
"http-get.verb": "GET",
"http-get.client": [
"Host: meritphilips.fans",
"Accept: application/javascript, */*;q=0.8",
"Accept-Language: en-US,en;q=0.9",
"Referer: https://meritphilips.fans/",
"__cfduid=",
"Cookie"
]
}
},
"ip": 1532768099,
"http": {
"status": 404,
"robots_hash": null,
"redirects": [],
"title_hash": null,
"securitytxt": null,
"title": null,
"sitemap_hash": null,
"robots": null,
"dom_hash": 0,
"components_hash": 0,
"headers_hash": 2129120964,
"host": "91.92.47.99",
"html": "",
"server_hash": null,
"location": "/",
"components": {},
"securitytxt_hash": null,
"headers": {
"date": "Mon, 5 Oct 2026 12:18:03 GMT",
"content-length": "0",
"content-type": "text/plain"
},
"server": null,
"sitemap": null,
"html_hash": 0
},
"port": 443,
"transport": "tcp",
"cpe23_hash": -527748401,
"location": {
"city": "London",
"region_code": "ENG",
"area_code": null,
"longitude": -0.12574,
"latitude": 51.50853,
"country_code": "GB",
"country_name": "United Kingdom"
},
"product": "Cobalt Strike Beacon",
"hash": 1273882565,
"timestamp": "2026-10-05T12:18:03.846036",
"ssl": {
"chain_sha256": [
"bd032de057fbfc1bce5d5abd7f2aa22aa255aaf2150a5623b52ee696ce9755b4",
"97658de8c68dfa98ace1e5028a63d54a1aae911b3e21471076c6850cd08cbab4",
"0fc0901cca2bae9e9fdbb02d50d02f1094f7b36672086991b9e897626dc485f0",
"ee5f7abd6981bb0255632cd8f49283451b4b18844d12040b44ee00f07b8fe2c6"
],
"jarm": "28d28d28d00028d00042d42d00042de0d120da90d5910c5de2af43b74a6bd8",
"tlsext": [
{
"id": 43,
"name": "supported_versions"
},
{
"id": 51,
"name": "key_share"
},
{
"id": 10,
"name": "supported_groups"
}
],
"chain": [
"-----BEGIN CERTIFICATE-----\nMIIDjzCCAxagAwIBAgISBt3XJhpdSTWOxUieVHq0MNBOMAoGCCqGSM49BAMDMDMx\nCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZ\nRTIwHhcNMjYwOTIxMTE0OTIwWhcNMjYxMjIwMTE0OTE5WjAcMRowGAYDVQQDExFt\nZXJpdHBoaWxpcHMuZmFuczBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCE3Egjh\nJWegMastcwM3mqF+F3FNFEskysmZ9p+0K8ufFa8Y7phGdhJCMP8EGILJb6mJTgtr\n2bTdRC1EzOaBPFejggIfMIICGzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYI\nKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUG5Xo/C0MBRJp+8pjdoo7\nIjWcJYkwHwYDVR0jBBgwFoAUuVnyjs8i8IbTN0j/dhQYuoLYVYcwMwYIKwYBBQUH\nAQEEJzAlMCMGCCsGAQUFBzAChhdodHRwOi8veWUyLmkubGVuY3Iub3JnLzAcBgNV\nHREEFTATghFtZXJpdHBoaWxpcHMuZmFuczATBgNVHSAEDDAKMAgGBmeBDAECATAu\nBgNVHR8EJzAlMCOgIaAfhh1odHRwOi8veWUyLmMubGVuY3Iub3JnLzc5LmNybDCC\nAQwGCisGAQQB1nkCBAIEgf0EgfoA+AB+ACbjZG5YaSEjvDQ/RyQ1mzeSzSRaiNgV\n05Mz/ZkYq0cjAAABoMQCHn4ACAAABQBEtTqbBAMARzBFAiBgpJOju6pWkae1TK1s\nShCG3NGzNXcK7WNcIB7SYEp1mAIhAKTxhFHsYmEM7vsROFsNBP+VAGdyDMRMxDwJ\n8sKwqS2HAHYA1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXcAAAGgxAIv\njwAABAMARzBFAiB4k8DtCM3m10F7UsHNf8fm0hsQnLKmUN81zdhu2YcmRgIhAJVl\nWRtpS7hfhXrUKTWQLIHYmurx6WondNroCZ8OJNuPMAoGCCqGSM49BAMDA2cAMGQC\nMHqnXLRWKYOQg5K9E0xH2LiqYDG7243hGEHg+JutNiFwjlALNo0T342m8QqvERYn\nQQIwbMk6+i09ET8xi1F3qWcJCERyezt+awpJr4DR0FBpGJfa4goyi8Lp/g/HuYC9\n461w\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMIICjDCCAhGgAwIBAgIQTfOxXdbAeExQfNN7WObxFTAKBggqhkjOPQQDAzAuMQsw\nCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTAeFw0y\nNTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYD\nVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTIwdjAQBgcqhkjOPQIBBgUr\ngQQAIgNiAARxmrQzkdbEEL3MqXt3dJQttYc47axkdDTHud5TPqM2z5uSD5cmk0Wr\nHlWXvnlvqBLqiB34kluxIbmMyAiq3/YD6e80/vV259K8XQIdjFXloYOa0mIU71f7\nHQ09PvYDlw+jge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUF\nBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFLlZ8o7PIvCG0zdI/3YU\nGLqC2FWHMB8GA1UdIwQYMBaAFKPIJlqOoUzQNWP8myPIOq5W809WMDIGCCsGAQUF\nBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3llLmkubGVuY3Iub3JnLzATBgNV\nHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veWUuYy5s\nZW5jci5vcmcvMAoGCCqGSM49BAMDA2kAMGYCMQDIcnw5dcZLN9ffynXnnkLD/itS\nJEycJPb3sRkzeqBowup7vOsAwaqoCnNn/jh9wycCMQCJM6CPlaOC4pQYYbJtVPYb\nDKrIb2EKk5NpOpE6/XttQYZV/3gilB9l+Cc/DOVwmyg=\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMIICpjCCAiugAwIBAgIRAIchZfw0tuX7qK3Vs3BftTowCgYIKoZIzj0EAwMwTzEL\nMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNo\nIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDIwHhcNMjYwNTEzMDAwMDAwWhcN\nMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4G\nA1UEAxMHUm9vdCBZRTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDwS/6vhrcVqcbBo\n+wgdI3fwn9x7DNJJOY/lTOti0vkwuRN87RhEhTH17E7XyFjWsPYhIPt/wzOqxTd2\nb+4ZJNy9ID04YywF9U5zasDVyGSNErVNtz8uSGh5izW87j77GaOB6zCB6DAOBgNV\nHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB\n/zAdBgNVHQ4EFgQUo8gmWo6hTNA1Y/ybI8g6rlbzT1YwHwYDVR0jBBgwFoAUfEKW\nrt5LSDv6kviejM9ti6lyN5UwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZo\ndHRwOi8veDIuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1Ud\nHwQgMB4wHKAaoBiGFmh0dHA6Ly94Mi5jLmxlbmNyLm9yZy8wCgYIKoZIzj0EAwMD\naQAwZgIxAMU19WCtmxVND8UHBZRoma49Z7jPs64Dma0eTu1OChVbB/2J7GV3nvYK\nAx54uk1G9QIxAO0miLVJu8PLNiXXXkiE/gsK3CTRTF/aeo4bMX42Zw40csRU6AC2\n6hSW1/IWaas6dg==\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMIIEcDCCAligAwIBAgIQbI8dxyfHEX97r4U6yYD5zTANBgkqhkiG9w0BAQsFADBP\nMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy\nY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNjA1MTMwMDAwMDBa\nFw0zMjA5MDIyMzU5NTlaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5l\ndCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgy\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0H\nttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7\nAlF9ItgKbppbd9/w+kHsOdx1ymgHDB/qo4H1MIHyMA4GA1UdDwEB/wQEAwIBBjAd\nBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAd\nBgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwHwYDVR0jBBgwFoAUebRZ5nu2\n5eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRw\nOi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQg\nMB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcNAQELBQAD\nggIBAD2/e9frmMxNpCV03qUHegg+MV2wz9644YoXdqtH8RyWYcBO7xfjjGEXdU1e\n/o0OkEFiynUCOSIk/vLLo7ttz6CPAeNlWfC0XNkoGeWgK6jjXvozBaGuGH5n0Ufo\nshMeWTuURqNN5G00sSXDTBrpp2+mgvdZQjb8K11TYMA25QA+YHNfbIEL0BniAhKS\n2gsnJjSzrdZLI+EZ7SEyqdR2rkjd1KutLDU+n3TFyxjniZVGur4YlhMP3mY/dV95\nIruAkkjOZier6hGBdEgZXXvaCz9u9iVEadsIE75pAGL8oHV5vxdARDiotRpul1IN\n/UZwzAbrfUFcw1HkAcYD/mlZfnQ2ieCF2MS7j3Vhv7JPDKp45fmykmzYNSrumRW0\nupFFKDBOoF7hsOb7oLyHS+Uft6jOUfOrogj8YUx38hKb2K20r42OgsSdDdxdeYWc\nMS3Sb6mwJeSZEYxJ2gaXnDSPaKhhrNkYwljyVQyr4Nq+MEJytXNTnHqaAcrNwZlV\npcJL1KBnMrMjP7eanvUwL3FYj3cF17jtboLt7gLoi4+2rWZFvn+w54jmd/FIuhhZ\ncEaU/wvU6BUNMtcVquVGHp7itQeDth5j+XL3j4WJ2SABwzUl6OeYdgpIt/ITZa+p\nTT0mQ/r5XyA4MEAiabn7XJjvCERlF2dcn2wqJw+CreTkkQ2R\n-----END CERTIFICATE-----\n"
],
"versions": [
"-TLSv1",
"-SSLv2",
"-SSLv3",
"-TLSv1.1",
"TLSv1.2",
"TLSv1.3"
],
"acceptable_cas": [],
"alpn": [],
"cert": {
"sig_alg": "ecdsa-with-SHA384",
"issued": "20260921114920Z",
"expires": "20261220114919Z",
"pubkey": {
"bits": 256,
"type": "dsa"
},
"version": 2,
"extensions": [
{
"critical": true,
"data": "\\x03\\x02\\x07\\x80",
"name": "keyUsage"
},
{
"data": "0\\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01",
"name": "extendedKeyUsage"
},
{
"critical": true,
"data": "0\\x00",
"name": "basicConstraints"
},
{
"data": "\\x04\\x14\\x1b\\x95\\xe8\\xfc-\\x0c\\x05\\x12i\\xfb\\xcacv\\x8a;\"5\\x9c%\\x89",
"name": "subjectKeyIdentifier"
},
{
"data": "0\\x16\\x80\\x14\\xb9Y\\xf2\\x8e\\xcf\"\\xf0\\x86\\xd37H\\xffv\\x14\\x18\\xba\\x82\\xd8U\\x87",
"name": "authorityKeyIdentifier"
},
{
"data": "0%0#\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86\\x17http://ye2.i.lencr.org/",
"name": "authorityInfoAccess"
},
{
"data": "0\\x13\\x82\\x11meritphilips.fans",
"name": "subjectAltName"
},
{
"data": "0\\n0\\x08\\x06\\x06g\\x81\\x0c\\x01\\x02\\x01",
"name": "certificatePolicies"
},
{
"data": "0%0#\\xa0!\\xa0\\x1f\\x86\\x1dhttp://ye2.c.lencr.org/79.crl",
"name": "crlDistributionPoints"
},
{
"data": "\\x04\\x81\\xfa\\x00\\xf8\\x00~\\x00&\\xe3dnXi!#\\xbc4?G$5\\x9b7\\x92\\xcd$Z\\x88\\xd8\\x15\\xd3\\x933\\xfd\\x99\\x18\\xabG#\\x00\\x00\\x01\\xa0\\xc4\\x02\\x1e~\\x00\\x08\\x00\\x00\\x05\\x00D\\xb5:\\x9b\\x04\\x03\\x00G0E\\x02 `\\xa4\\x93\\xa3\\xbb\\xaaV\\x91\\xa7\\xb5L\\xadlJ\\x10\\x86\\xdc\\xd1\\xb35w\\n\\xedc\\\\ \\x1e\\xd2`Ju\\x98\\x02!\\x00\\xa4\\xf1\\x84Q\\xecba\\x0c\\xee\\xfb\\x118[\\r\\x04\\xff\\x95\\x00gr\\x0c\\xc4L\\xc4<\\t\\xf2\\xc2\\xb0\\xa9-\\x87\\x00v\\x00\\xd7m}\\x10\\xd1\\xa7\\xf5w\\xc2\\xc7\\xe9_\\xd7\\x00\\xbf\\xf9\\x82\\xc93Ze\\xe1\\xd0\\xb3\\x01s\\x17\\xc0\\xc8\\xc5iw\\x00\\x00\\x01\\xa0\\xc4\\x02/\\x8f\\x00\\x00\\x04\\x03\\x00G0E\\x02 x\\x93\\xc0\\xed\\x08\\xcd\\xe6\\xd7A{R\\xc1\\xcd\\x7f\\xc7\\xe6\\xd2\\x1b\\x10\\x9c\\xb2\\xa6P\\xdf5\\xcd\\xd8n\\xd9\\x87&F\\x02!\\x00\\x95eY\\x1biK\\xb8_\\x85z\\xd4)5\\x90,\\x81\\xd8\\x9a\\xea\\xf1\\xe9j\\'t\\xda\\xe8\\t\\x9f\\x0e$\\xdb\\x8f",
"name": "ct_precert_scts"
}
],
"fingerprint": {
"sha256": "bd032de057fbfc1bce5d5abd7f2aa22aa255aaf2150a5623b52ee696ce9755b4",
"sha1": "4ae594f49d14cb023c4d236474600455d6868999"
},
"serial": 5.981621005411968e+41,
"issuer": {
"C": "US",
"CN": "YE2",
"O": "Let's Encrypt"
},
"expired": false,
"subject": {
"CN": "meritphilips.fans"
}
},
"cipher": {
"version": "TLSv1.3",
"bits": 256,
"name": "TLS_AES_256_GCM_SHA384"
},
"trust": {
"revoked": false,
"browser": null
},
"handshake_states": [
"before SSL initialization",
"SSLv3/TLS write client hello",
"SSLv3/TLS read server hello",
"TLSv1.3 read encrypted extensions",
"SSLv3/TLS read server certificate",
"TLSv1.3 read server certificate verify",
"SSLv3/TLS read finished",
"SSLv3/TLS write change cipher spec",
"SSLv3/TLS write finished",
"SSL negotiation finished successfully"
],
"ja3s": "f03a69cfa3944d6d51bc52febd87a1a8",
"ocsp": {}
},
"hostnames": [
"meritphilips.fans"
],
"org": "TechTies Inc.",
"data": "HTTP/1.1 404 Not Found\r\nDate: Mon, 5 Oct 2026 12:18:03 GMT\r\nContent-Type: text/plain\r\nContent-Length: 0\r\n\r\n\nCobalt Strike Beacon:\n x86:\n beacon_type: HTTPS\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n Host: meritphilips.fans\n Accept: application/javascript, */*;q=0.8\n Accept-Language: en-US,en;q=0.9\n Referer: https://meritphilips.fans/\n __cfduid=\n Cookie\n http-get.uri: meritphilips.fans,/cdn/assets/app.min.js\n http-get.verb: GET\n http-post.client:\n Host: meritphilips.fans\n Accept: application/json, */*;q=0.8\n Accept-Language: en-US,en;q=0.9\n Content-Type: application/json\n Referer: https://meritphilips.fans/\n sid\n http-post.uri: /api/v1/events\n http-post.verb: POST\n jitter: 33\n maxgetsize: 1048631\n port: 443\n post-ex.spawnto_x64: %windir%\\sysnative\\WerFault.exe\n post-ex.spawnto_x86: %windir%\\syswow64\\WerFault.exe\n process-inject.execute:\n CreateThread\n SetThreadContext\n CreateRemoteThread\n RtlCreateUserThread\n process-inject.startrwx: 64\n process-inject.stub: ae5afcfee8026674dc8f3b4f2da46c7f\n process-inject.userwx: 64\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: 2fa2cac336b542cab8ca7e71ea5298db\n sleeptime: 45000\n useragent_header: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.119 Safari/537.36\n uses_cookies: 1\n watermark: 987654321\n x64:\n beacon_type: HTTPS\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n Host: meritphilips.fans\n Accept: application/javascript, */*;q=0.8\n Accept-Language: en-US,en;q=0.9\n Referer: https://meritphilips.fans/\n __cfduid=\n Cookie\n http-get.uri: meritphilips.fans,/static/js/runtime.js\n http-get.verb: GET\n http-post.client:\n Host: meritphilips.fans\n Accept: application/json, */*;q=0.8\n Accept-Language: en-US,en;q=0.9\n Content-Type: application/json\n Referer: https://meritphilips.fans/\n sid\n http-post.uri: /api/v1/events\n http-post.verb: POST\n jitter: 33\n maxgetsize: 1048631\n port: 443\n post-ex.spawnto_x64: %windir%\\sysnative\\WerFault.exe\n post-ex.spawnto_x86: %windir%\\syswow64\\WerFault.exe\n process-inject.execute:\n CreateThread\n SetThreadContext\n CreateRemoteThread\n RtlCreateUserThread\n process-inject.startrwx: 64\n process-inject.stub: ae5afcfee8026674dc8f3b4f2da46c7f\n process-inject.userwx: 64\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: 2fa2cac336b542cab8ca7e71ea5298db\n sleeptime: 45000\n useragent_header: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.119 Safari/537.36\n uses_cookies: 1\n watermark: 987654321\n",
"asn": "AS197170",
"cpe23": [
"cpe:2.3:a:helpsystems:cobalt_strike"
],
"isp": "TechTies Inc.",
"cpe": [
"cpe:/a:helpsystems:cobalt_strike"
],
"domains": [
"meritphilips.fans"
],
"ip_str": "91.92.47.99",
"os": null,
"_shodan": {
"region": "eu",
"module": "https",
"ptr": true,
"options": {},
"id": "363cf7e8-1715-45a5-8771-e6beff0805e8",
"crawler": "78039f81a0245caa8ab71c98182f0eff0ce52aab"
}
}