139.99.131.177
C2 Infrastructure AsyncRAT Indicator 139.99.131.177 Type ip Category C2 Infrastructure Family AsyncRAT Hosting OVH Confidence high VT Score 17/94 Source shodan First Seen 2026-05-16 16:00:50 UTC Last Seen 2026-05-31 00:00:37 UTC Shodan View on Shodan ↗
Raw JSON
{
"product": "AsyncRAT",
"hash": 0,
"os": null,
"asn": "AS16276",
"tags": [
"c2",
"self-signed"
],
"timestamp": "2026-05-16T14:26:09.552199",
"isp": "OVH SAS",
"transport": "tcp",
"_shodan": {
"region": "na",
"module": "https-simple-new",
"ptr": true,
"options": {},
"id": "9e100b0e-d11d-456d-8944-ec971921b615",
"crawler": "aae39d1b094d4d9c7d50b03c9430f8947d98e661"
},
"ssl": {
"chain_sha256": [
"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"
],
"jarm": "22b22b09b22b22b22b22b22b22b22bfd9c9d14e4f4f67f94f0359f8b28f532",
"tlsext": [
{
"id": 23,
"name": "extended_master_secret"
},
{
"id": 65281,
"name": "renegotiation_info"
}
],
"chain": [
"-----BEGIN CERTIFICATE-----\nMIIE8jCCAtqgAwIBAgIQAPeWQ4YJ3MvReCGwLzn7rTANBgkqhkiG9w0BAQ0FADAa\nMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwNDI1MDA0MTA5WhgPOTk5\nOTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJ\nKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKT9nYYTjYTZhY+g1tekZ8/F29gsEIDg\nf/8odvCbCmYKGGZZi2yND9NjtBXEMANM9PAXCyMapGvapDPbWgjYkLiMw/Vwa3kZ\nRg7kLpXMpzInLQufe7Q587viilcsGDoVXmnf51/SwsKPjSysZUpyayezUlJ1j6aX\nkZGnasiqJ7iKANdSneQducOn6IwaEuJBmpXKWxhhq8R9JMfiWeOXL/hXoE/wCzwz\nvU/CrzPXd3uMsLfFMDHZJ+OQ9OXKU/CHZNCgSPs4VSgCgM4eK0YTbu1mLsWSo5th\n3/ingNFaTyYmGsmLIE2Jq5AR1A+xA+FEdC8zKL1bAwYQcRgIJs7QdedtAIufepPZ\n9D5HiOiy3ITYVonqwTiiIm20en7UICt+J8iDb4M2Q2iLWA7Yi9PN2cr0Xrs8A4/R\nL29Qe5Ly2k35i74RiBTiT7Jbl2r7PcYlUGcjTCbdB9PWt3dYaTysuamoq2Zuo2HV\nRhhoZpwnajS9vNcjuZCYVoQvUQBUnHTeRZrtHXU5JV59ZBlu7flZneMZnbrWXTxo\nb6Bdt8+hrGoSDMWBFcO4jRzhT3hEFUpu4lSFeb9T3Vx4KWkHJhHtMvHuYgDTXERd\nEcI00sOUbVxgd/62LhGXNNommQKCyiAGj0V5uLD73Fyw8vJpm3jXf3NgNt/Cjnla\nMc40DJ+HlXE5AgMBAAGjMjAwMB0GA1UdDgQWBBQsT2WvtxGUK29SWs4sHz1xYye0\nfzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQCK5sVfnYyT5Mqn\nCg3uHV2ojf12fIVFCY02Cc7gy3DVoE6/xZCPjr22V/xZunZ7DG1nt0kOJKDwdQYn\nGoMc5UPh8jbNRoc1ojLOCaluaIYQyl8AGkmUSRA3Ltk0XetDescffrWT/nKuRvIE\nYU4Ra+B39f8ouGMCa7VXaxnGJ0z0BkUie8KsDLgNmJ7/kVfIYuRxl+YefoCsUTCo\ngqf0fu3DuRHBpUVaSQQOf9YCbvFWH7Nupc3UIwpH5D8kSdpKusEfbRp8nfWN/Fm+\nlzF3THeHU6vNJ+5UoAWHYFW8wfJCbzQ/0L8QZeOv4uy74oQP2Ed0RdrWCwUL6SSs\nDPZdDEOy4K4vVYkDTl1nL5tleATguELAEbbT42oLce85z4C7sKvpEfa4DPbU55xB\nLwvHniILFfjB7VVsrgVckUL/lEf4Y92uJVKvLGruQt/mtKSqIuJjD8T9y7RIsk6g\n9624egV5UtLtv+36kLKhgIJlqC7Xx/PVwMc2yw8BiQlvxQZgqSd1k7QmV1AhV/3z\n2wqnYmb09ibTMYaMFjtamFegeFqc4jRLABhVQFEFv8z5E6G9vgKn5mQDWS/JykAR\nBv9o2BjL/PTADfwAtc1b4nWo0l+CI8IjjYXu/mJOuwR+kFJ19INtwbffQvT9U12t\n4smpcZV+OK0opk4Yr9r1tZYm92ghXA==\n-----END CERTIFICATE-----\n"
],
"versions": [],
"acceptable_cas": [],
"alpn": [],
"cert": {
"sig_alg": "sha512WithRSAEncryption",
"issued": "20220425004109Z",
"expires": "99991231235959Z",
"pubkey": {
"bits": 4096,
"type": "rsa"
},
"version": 2,
"extensions": [
{
"data": "\\x04\\x14,Oe\\xaf\\xb7\\x11\\x94+oRZ\\xce,\\x1f=qc\\'\\xb4\\x7f",
"name": "subjectKeyIdentifier"
},
{
"critical": true,
"data": "0\\x03\\x01\\x01\\xff",
"name": "basicConstraints"
}
],
"fingerprint": {
"sha256": "136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe",
"sha1": "c0742fcfac0826954d1fb66f1eab22b391b17590"
},
"serial": 1.2855450352684529e+36,
"issuer": {
"CN": "AsyncRAT Server"
},
"expired": false,
"subject": {
"CN": "AsyncRAT Server"
}
},
"cipher": {
"version": "TLSv1.0",
"bits": 256,
"name": "ECDHE-RSA-AES256-SHA"
},
"trust": {
"revoked": false,
"browser": null
},
"handshake_states": [
"before SSL initialization",
"SSLv3/TLS write client hello",
"SSLv3/TLS read server hello",
"SSLv3/TLS read server certificate",
"SSLv3/TLS read server key exchange",
"SSLv3/TLS read server done",
"SSLv3/TLS write client key exchange",
"SSLv3/TLS write change cipher spec",
"SSLv3/TLS write finished",
"SSLv3/TLS read change cipher spec",
"SSLv3/TLS read finished",
"SSL negotiation finished successfully"
],
"ja3s": "b74704234e6128f33bff9865696e31b3",
"ocsp": {}
},
"hostnames": [
"ns537679.ip-139-99-131.net"
],
"location": {
"city": "Sydney",
"region_code": "NSW",
"area_code": null,
"longitude": 151.20732,
"latitude": -33.86785,
"country_code": "AU",
"country_name": "Australia"
},
"ip": 2338554801,
"domains": [
"ip-139-99-131.net"
],
"org": "OVH Australia PTY LTD",
"data": "",
"port": 4444,
"ip_str": "139.99.131.177"
}