43.128.27.124
C2 Infrastructure CobaltStrike Indicator 43.128.27.124 Type ip Category C2 Infrastructure Family CobaltStrike Hosting Asia Pacific Network Information Center, Pty. Ltd. Confidence high VT Score 8/94 Source shodan First Seen 2026-05-09 16:00:12 UTC Last Seen 2026-05-09 16:00:12 UTC Shodan View on Shodan ↗
Raw JSON
{
"cobalt_strike_beacon": {
"x86": {
"beacon_type": "HTTPS",
"jitter": 43,
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36",
"http-post.client": [
"Host: chat.lzrace.site",
"Connection: close",
"Accept-Language: fr-CH, fr;q=0.9, en;q=0.8, de;q=0.7, *;q=0.5",
"Content-Type: text/plain",
"auth=",
"Cookie"
],
"maxgetsize": 1864478,
"process-inject.min_alloc": 11184,
"post-ex.spawnto_x86": "%windir%\\syswow64\\WUAUCLT.exe",
"port": 443,
"sleeptime": 64964,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"CreateThread",
"RtlCreateUserThread",
"CreateRemoteThread"
],
"process-inject.startrwx": 4,
"post-ex.spawnto_x64": "%windir%\\sysnative\\WUAUCLT.exe",
"process-inject.stub": "ae5afcfee8026674dc8f3b4f2da46c7f",
"http-get.uri": "chat.lzrace.site,/btn_bg.html",
"watermark": 987654321,
"dns-beacon.strategy_fail_seconds": -1,
"server.publickey_md5": "cd15e8b6a8f79b89659fb8a967d6da6e",
"dns-beacon.strategy_fail_x": -1,
"stage.cleanup": 1,
"http-post.verb": "POST",
"http-post.uri": "/modules",
"process-inject.userwx": 32,
"http-get.verb": "GET",
"http-get.client": [
"Host: chat.lzrace.site",
"Connection: close",
"Accept-Language: en-GB;q=0.9, *;q=0.7",
"_stripe_mid=",
"Cookie"
]
},
"x64": {
"beacon_type": "HTTPS",
"jitter": 43,
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36",
"http-post.client": [
"Host: chat.lzrace.site",
"Connection: close",
"Accept-Language: fr-CH, fr;q=0.9, en;q=0.8, de;q=0.7, *;q=0.5",
"Content-Type: text/plain",
"auth=",
"Cookie"
],
"maxgetsize": 1864478,
"process-inject.min_alloc": 11184,
"post-ex.spawnto_x86": "%windir%\\syswow64\\WUAUCLT.exe",
"port": 443,
"sleeptime": 64964,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"CreateThread",
"RtlCreateUserThread",
"CreateRemoteThread"
],
"process-inject.startrwx": 4,
"post-ex.spawnto_x64": "%windir%\\sysnative\\WUAUCLT.exe",
"process-inject.stub": "ae5afcfee8026674dc8f3b4f2da46c7f",
"http-get.uri": "chat.lzrace.site,/tab_shop.html",
"watermark": 987654321,
"dns-beacon.strategy_fail_seconds": -1,
"server.publickey_md5": "cd15e8b6a8f79b89659fb8a967d6da6e",
"dns-beacon.strategy_fail_x": -1,
"stage.cleanup": 1,
"http-post.verb": "POST",
"http-post.uri": "/modules",
"process-inject.userwx": 32,
"http-get.verb": "GET",
"http-get.client": [
"Host: chat.lzrace.site",
"Connection: close",
"Accept-Language: en-GB;q=0.9, *;q=0.7",
"_stripe_mid=",
"Cookie"
]
}
},
"ip": 729815932,
"http": {
"status": 404,
"robots_hash": null,
"redirects": [],
"title_hash": null,
"securitytxt": null,
"title": null,
"sitemap_hash": null,
"waf": "Cloudflare (Cloudflare Inc.)",
"robots": null,
"dom_hash": 0,
"headers_hash": 11853219,
"host": "43.128.27.124",
"html": "",
"server_hash": 958142897,
"location": "/",
"components": {
"Cloudflare": {
"categories": [
"CDN"
]
}
},
"securitytxt_hash": null,
"server": "cloudflare",
"sitemap": null,
"html_hash": 0
},
"port": 443,
"transport": "tcp",
"location": {
"city": "Hong Kong",
"region_code": "",
"area_code": null,
"longitude": 114.17469,
"latitude": 22.27832,
"country_code": "HK",
"country_name": "Hong Kong"
},
"product": "Cobalt Strike Beacon",
"hash": 1222656184,
"timestamp": "2026-05-05T11:36:55.802951",
"ssl": {
"chain_sha256": [
"cb9f359097f6e1a0efbd02c80628bf42a6e5d1e0aff0839f0827d15b549c1ef7",
"aeb1fd7410e83bc96f5da3c6a7c2c1bb836d1fa5cb86e708515890e428a8770b"
],
"jarm": "28d28d28d00028d00042d42d00042de0d120da90d5910c5de2af43b74a6bd8",
"tlsext": [
{
"id": 43,
"name": "supported_versions"
},
{
"id": 51,
"name": "key_share"
},
{
"id": 10,
"name": "supported_groups"
}
],
"chain": [
"-----BEGIN CERTIFICATE-----\nMIIDizCCAxCgAwIBAgISBbgi2UOejg1BYO4WI4qWqdXMMAoGCCqGSM49BAMDMDIx\nCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF\nNzAeFw0yNjA0MjkxNTIwNDZaFw0yNjA3MjgxNTIwNDVaMBsxGTAXBgNVBAMTEGNo\nYXQubHpyYWNlLnNpdGUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASuFEkBukfx\n+zEuk4LNKPFSgmkLBEGgXvpnlcSWQS1RdqeP38CZ0uclbdtbGfsqL7vMCz27mvCW\nvq5ZZPUOXaxqo4ICGzCCAhcwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsG\nAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFHf1sG2vIPRe8futRn1bxN07\nciD9MB8GA1UdIwQYMBaAFK5IntyHHUSgb9qi5WB0BHjCnACAMDIGCCsGAQUFBwEB\nBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL2U3LmkubGVuY3Iub3JnLzAbBgNVHREE\nFDASghBjaGF0Lmx6cmFjZS5zaXRlMBMGA1UdIAQMMAowCAYGZ4EMAQIBMC0GA1Ud\nHwQmMCQwIqAgoB6GHGh0dHA6Ly9lNy5jLmxlbmNyLm9yZy83Ny5jcmwwggELBgor\nBgEEAdZ5AgQCBIH8BIH5APcAdQDYCVU7lE96/8gWGW+UT4WrsPj8XodVJg8V0S5y\nu0VLFAAAAZ3aCZ0pAAAEAwBGMEQCIEdZMD1FEJc57pZG1rptr/PjsvdhA57YZlu7\nUmG0cljSAiA8H3Q8QIajB5fg4FxX8T0UOMc2ClWf55OQRLHjkmtPcgB+AEavhj07\nPuWfpXfeqCRdNrDZ7SKiI/Rhd0EilFLulVBfAAABndoJnbIACAAABQAFOfLLBAMA\nRzBFAiBrnYUVn75aEpvqzlqzpzeS2RHKPIc7gRWJvbqHNp81LgIhAIdqRJyDBlh9\nzz7eUVGJk0DYmXKelfgRGnajkef+yK+tMAoGCCqGSM49BAMDA2kAMGYCMQDxlrvZ\nH0VY6Pqsc1Fqe8e7r3A8zA3FHwfcRB55IOW/u/pJFrHquMhwWnCS8Wad2bsCMQDt\nO6X1l4SMPjxv72meb4I6tZfXW23YHUGJIS1rdd1czd7u+QZH6szEFLzipkAbah4=\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMIIEVzCCAj+gAwIBAgIRAKp18eYrjwoiCWbTi7/UuqEwDQYJKoZIhvcNAQELBQAw\nTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh\ncmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw\nWhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg\nRW5jcnlwdDELMAkGA1UEAxMCRTcwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAARB6AST\nCFh/vjcwDMCgQer+VtqEkz7JANurZxLP+U9TCeioL6sp5Z8VRvRbYk4P1INBmbef\nQHJFHCxcSjKmwtvGBWpl/9ra8HW0QDsUaJW2qOJqceJ0ZVFT3hbUHifBM/2jgfgw\ngfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD\nATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSuSJ7chx1EoG/aouVgdAR4\nwpwAgDAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB\nAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g\nBAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu\nY3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAjx66fDdLk5ywFn3CzA1w1qfylHUD\naEf0QZpXcJseddJGSfbUUOvbNR9N/QQ16K1lXl4VFyhmGXDT5Kdfcr0RvIIVrNxF\nh4lqHtRRCP6RBRstqbZ2zURgqakn/Xip0iaQL0IdfHBZr396FgknniRYFckKORPG\nyM3QKnd66gtMst8I5nkRQlAg/Jb+Gc3egIvuGKWboE1G89NTsN9LTDD3PLj0dUMr\nOIuqVjLB8pEC6yk9enrlrqjXQgkLEYhXzq7dLafv5Vkig6Gl0nuuqjqfp0Q1bi1o\nyVNAlXe6aUXw92CcghC9bNsKEO1+M52YY5+ofIXlS/SEQbvVYYBLZ5yeiglV6t3S\nM6H+vTG0aP9YHzLn/KVOHzGQfXDP7qM5tkf+7diZe7o2fw6O7IvN6fsQXEQQj8TJ\nUXJxv2/uJhcuy/tSDgXwHM8Uk34WNbRT7zGTGkQRX0gsbjAea/jYAoWv0ZvQRwpq\nPe79D/i7Cep8qWnA+7AE/3B3S/3dEEYmc0lpe1366A/6GEgk3ktr9PEoQrLChs6I\ntu3wnNLB2euC8IKGLQFpGtOO/2/hiAKjyajaBP25w1jF0Wl8Bbqne3uZ2q1GyPFJ\nYRmT7/OXpmOH/FVLtwS+8ng1cAmpCujPwteJZNcDG0sF2n/sc0+SQf49fdyUK0ty\n+VUwFj9tmWxyR/M=\n-----END CERTIFICATE-----\n"
],
"versions": [
"-TLSv1",
"-SSLv2",
"-SSLv3",
"-TLSv1.1",
"TLSv1.2",
"TLSv1.3"
],
"acceptable_cas": [],
"alpn": [],
"cert": {
"sig_alg": "ecdsa-with-SHA384",
"issued": "20260429152046Z",
"expires": "20260728152045Z",
"pubkey": {
"bits": 256,
"type": "dsa"
},
"version": 2,
"extensions": [
{
"critical": true,
"data": "\\x03\\x02\\x07\\x80",
"name": "keyUsage"
},
{
"data": "0\\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01",
"name": "extendedKeyUsage"
},
{
"critical": true,
"data": "0\\x00",
"name": "basicConstraints"
},
{
"data": "\\x04\\x14w\\xf5\\xb0m\\xaf \\xf4^\\xf1\\xfb\\xadF}[\\xc4\\xdd;r \\xfd",
"name": "subjectKeyIdentifier"
},
{
"data": "0\\x16\\x80\\x14\\xaeH\\x9e\\xdc\\x87\\x1dD\\xa0o\\xda\\xa2\\xe5`t\\x04x\\xc2\\x9c\\x00\\x80",
"name": "authorityKeyIdentifier"
},
{
"data": "0$0\"\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86\\x16http://e7.i.lencr.org/",
"name": "authorityInfoAccess"
},
{
"data": "0\\x12\\x82\\x10chat.lzrace.site",
"name": "subjectAltName"
},
{
"data": "0\\n0\\x08\\x06\\x06g\\x81\\x0c\\x01\\x02\\x01",
"name": "certificatePolicies"
},
{
"data": "0$0\"\\xa0 \\xa0\\x1e\\x86\\x1chttp://e7.c.lencr.org/77.crl",
"name": "crlDistributionPoints"
},
{
"data": "\\x04\\x81\\xf9\\x00\\xf7\\x00u\\x00\\xd8\\tU;\\x94Oz\\xff\\xc8\\x16\\x19o\\x94O\\x85\\xab\\xb0\\xf8\\xfc^\\x87U&\\x0f\\x15\\xd1.r\\xbbEK\\x14\\x00\\x00\\x01\\x9d\\xda\\t\\x9d)\\x00\\x00\\x04\\x03\\x00F0D\\x02 GY0=E\\x10\\x979\\xee\\x96F\\xd6\\xbam\\xaf\\xf3\\xe3\\xb2\\xf7a\\x03\\x9e\\xd8f[\\xbbRa\\xb4rX\\xd2\\x02 <\\x1ft<@\\x86\\xa3\\x07\\x97\\xe0\\xe0\\\\W\\xf1=\\x148\\xc76\\nU\\x9f\\xe7\\x93\\x90D\\xb1\\xe3\\x92kOr\\x00~\\x00F\\xaf\\x86=;>\\xe5\\x9f\\xa5w\\xde\\xa8$]6\\xb0\\xd9\\xed\"\\xa2#\\xf4awA\"\\x94R\\xee\\x95P_\\x00\\x00\\x01\\x9d\\xda\\t\\x9d\\xb2\\x00\\x08\\x00\\x00\\x05\\x00\\x059\\xf2\\xcb\\x04\\x03\\x00G0E\\x02 k\\x9d\\x85\\x15\\x9f\\xbeZ\\x12\\x9b\\xea\\xceZ\\xb3\\xa77\\x92\\xd9\\x11\\xca<\\x87;\\x81\\x15\\x89\\xbd\\xba\\x876\\x9f5.\\x02!\\x00\\x87jD\\x9c\\x83\\x06X}\\xcf>\\xdeQQ\\x89\\x93@\\xd8\\x99r\\x9e\\x95\\xf8\\x11\\x1av\\xa3\\x91\\xe7\\xfe\\xc8\\xaf\\xad",
"name": "ct_precert_scts"
}
],
"fingerprint": {
"sha256": "cb9f359097f6e1a0efbd02c80628bf42a6e5d1e0aff0839f0827d15b549c1ef7",
"sha1": "3d907f68b00233e62305aaf9838fe29555f0c9e8"
},
"serial": 4.9821970702401234e+41,
"issuer": {
"C": "US",
"CN": "E7",
"O": "Let's Encrypt"
},
"expired": false,
"subject": {
"CN": "chat.lzrace.site"
}
},
"cipher": {
"version": "TLSv1.3",
"bits": 256,
"name": "TLS_AES_256_GCM_SHA384"
},
"trust": {
"revoked": false,
"browser": null
},
"handshake_states": [
"before SSL initialization",
"SSLv3/TLS write client hello",
"SSLv3/TLS read server hello",
"TLSv1.3 read encrypted extensions",
"SSLv3/TLS read server certificate",
"TLSv1.3 read server certificate verify",
"SSLv3/TLS read finished",
"SSLv3/TLS write change cipher spec",
"SSLv3/TLS write finished",
"SSL negotiation finished successfully"
],
"ja3s": "f03a69cfa3944d6d51bc52febd87a1a8",
"ocsp": {}
},
"hostnames": [
"chat.lzrace.site"
],
"org": "Asia Pacific Network Information Center, Pty. Ltd.",
"data": "HTTP/1.1 404 Not Found\r\nDate: Tue, 5 May 2026 11:36:55 GMT\r\nContent-Type: text/plain\r\nContent-Length: 0\r\nServer: cloudflare\r\n\r\n\nCobalt Strike Beacon:\n x86:\n beacon_type: HTTPS\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n Host: chat.lzrace.site\n Connection: close\n Accept-Language: en-GB;q=0.9, *;q=0.7\n _stripe_mid=\n Cookie\n http-get.uri: chat.lzrace.site,/btn_bg.html\n http-get.verb: GET\n http-post.client:\n Host: chat.lzrace.site\n Connection: close\n Accept-Language: fr-CH, fr;q=0.9, en;q=0.8, de;q=0.7, *;q=0.5\n Content-Type: text/plain\n auth=\n Cookie\n http-post.uri: /modules\n http-post.verb: POST\n jitter: 43\n maxgetsize: 1864478\n port: 443\n post-ex.spawnto_x64: %windir%\\sysnative\\WUAUCLT.exe\n post-ex.spawnto_x86: %windir%\\syswow64\\WUAUCLT.exe\n process-inject.execute:\n CreateThread\n RtlCreateUserThread\n CreateRemoteThread\n process-inject.min_alloc: 11184\n process-inject.startrwx: 4\n process-inject.stub: ae5afcfee8026674dc8f3b4f2da46c7f\n process-inject.userwx: 32\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: cd15e8b6a8f79b89659fb8a967d6da6e\n sleeptime: 64964\n stage.cleanup: 1\n useragent_header: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36\n uses_cookies: 1\n watermark: 987654321\n x64:\n beacon_type: HTTPS\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n Host: chat.lzrace.site\n Connection: close\n Accept-Language: en-GB;q=0.9, *;q=0.7\n _stripe_mid=\n Cookie\n http-get.uri: chat.lzrace.site,/tab_shop.html\n http-get.verb: GET\n http-post.client:\n Host: chat.lzrace.site\n Connection: close\n Accept-Language: fr-CH, fr;q=0.9, en;q=0.8, de;q=0.7, *;q=0.5\n Content-Type: text/plain\n auth=\n Cookie\n http-post.uri: /modules\n http-post.verb: POST\n jitter: 43\n maxgetsize: 1864478\n port: 443\n post-ex.spawnto_x64: %windir%\\sysnative\\WUAUCLT.exe\n post-ex.spawnto_x86: %windir%\\syswow64\\WUAUCLT.exe\n process-inject.execute:\n CreateThread\n RtlCreateUserThread\n CreateRemoteThread\n process-inject.min_alloc: 11184\n process-inject.startrwx: 4\n process-inject.stub: ae5afcfee8026674dc8f3b4f2da46c7f\n process-inject.userwx: 32\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: cd15e8b6a8f79b89659fb8a967d6da6e\n sleeptime: 64964\n stage.cleanup: 1\n useragent_header: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36\n uses_cookies: 1\n watermark: 987654321\n",
"asn": "AS132203",
"cpe23": [
"cpe:2.3:a:cloudflare:cloudflare",
"cpe:2.3:a:helpsystems:cobalt_strike"
],
"isp": "Tencent Building, Kejizhongyi Avenue",
"cpe": [
"cpe:/a:cloudflare:cloudflare",
"cpe:/a:helpsystems:cobalt_strike"
],
"domains": [
"lzrace.site"
],
"ip_str": "43.128.27.124",
"os": null,
"_shodan": {
"region": "eu",
"module": "https",
"ptr": true,
"options": {},
"id": "01653f98-c0d2-471f-9048-f12cdc407b5d",
"crawler": "a23c78e6d5c5d60475b41bbc57ba6077d8930999"
}
}