91.197.97.236 — intel.lukealbertson.com

Indicator 91.197.97.236 Type ip Category C2 Infrastructure Family CobaltStrike Hosting Domain names registrar REG.RU, Ltd Confidence high VT Score 10/94 Source shodan First Seen 2026-04-18 05:03:23 UTC Last Seen 2026-05-09 16:00:12 UTC Shodan View on Shodan ↗

Raw JSON

{
  "hash": -1488087466,
  "product": "Cobalt Strike Beacon",
  "http": {
    "status": 404,
    "robots_hash": null,
    "redirects": [],
    "title_hash": null,
    "securitytxt": null,
    "title": null,
    "sitemap_hash": null,
    "robots": null,
    "dom_hash": 0,
    "headers_hash": -1392026739,
    "host": "91.197.97.236",
    "html": "",
    "server_hash": 869690771,
    "location": "/",
    "components": {
      "Apache HTTP Server": {
        "categories": [
          "Web servers"
        ]
      }
    },
    "securitytxt_hash": null,
    "server": "Apache",
    "sitemap": null,
    "html_hash": 0
  },
  "os": null,
  "transport": "tcp",
  "timestamp": "2026-04-18T03:02:11.646979",
  "isp": "\"Domain names registrar REG.RU\", Ltd",
  "cpe23": [
    "cpe:2.3:a:apache:http_server",
    "cpe:2.3:a:helpsystems:cobalt_strike"
  ],
  "cpe": [
    "cpe:/a:apache:http_server",
    "cpe:/a:helpsystems:cobalt_strike"
  ],
  "_shodan": {
    "region": "na",
    "module": "http-simple-new",
    "ptr": true,
    "options": {},
    "id": "5cf7d129-15e1-434c-85d0-16208ed33f2e",
    "crawler": "36f536ccfb8f2bed3f4109d29ab93e6221906564"
  },
  "asn": "AS197695",
  "hostnames": [
    "91-197-97-236.cloudvps.regruhosting.ru"
  ],
  "location": {
    "city": "Moscow",
    "region_code": "MOW",
    "area_code": null,
    "longitude": 37.61556,
    "latitude": 55.75222,
    "country_code": "RU",
    "country_name": "Russian Federation"
  },
  "ip": 1539662316,
  "domains": [
    "regruhosting.ru"
  ],
  "org": "Domain names registrar REG.RU, Ltd",
  "data": "HTTP/1.1 404 Not Found\r\nDate: Sat, 18 Apr 2026 03:02:10 GMT\r\nServer: Apache\r\nContent-Length: 0\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/plain\r\n\r\n",
  "port": 4848,
  "ip_str": "91.197.97.236"
}