47.82.234.12
C2 Infrastructure CobaltStrike Indicator 47.82.234.12 Type ip Category C2 Infrastructure Family CobaltStrike Hosting Alibaba Cloud LLC Confidence high VT Score 17/94 Source shodan First Seen 2026-05-16 16:00:50 UTC Last Seen 2026-09-11 08:00:43 UTC Shodan View on Shodan ↗
Raw JSON
{
"cobalt_strike_beacon": {
"x86": {
"beacon_type": "HTTP",
"jitter": 37,
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko",
"http-post.client": [
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Accept-Encoding: gzip, deflate",
"X-DEVICE-ID"
],
"maxgetsize": 1398129,
"process-inject.min_alloc": 17500,
"post-ex.spawnto_x86": "%windir%\\syswow64\\dllhost.exe",
"port": 80,
"sleeptime": 45000,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"ntdll:RtlUserThreadStart",
"CreateThread",
"NtQueueApcThread-s",
"CreateRemoteThread",
"RtlCreateUserThread"
],
"process-inject.startrwx": 4,
"post-ex.spawnto_x64": "%windir%\\sysnative\\dllhost.exe",
"process-inject.stub": "ecc996c40e5ea9a2ff8f08a1e6c01391",
"http-get.uri": "agentkernel.top,/iot/telemetry/ping",
"watermark": 1234567890,
"dns-beacon.strategy_fail_seconds": -1,
"process-inject.userwx": 32,
"dns-beacon.strategy_fail_x": -1,
"stage.cleanup": 1,
"http-post.verb": "POST",
"http-post.uri": "/iot/telemetry/event-submit",
"server.publickey_md5": "16390b7b750f32ef7a33ba0a847fe293",
"process-inject.allocator": 1,
"http-get.verb": "GET",
"http-get.client": [
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Accept-Encoding: gzip, deflate",
"X-DEVICE-ID"
]
},
"x64": {
"beacon_type": "HTTP",
"jitter": 37,
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko",
"http-post.client": [
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Accept-Encoding: gzip, deflate",
"X-DEVICE-ID"
],
"maxgetsize": 1398129,
"process-inject.min_alloc": 17500,
"post-ex.spawnto_x86": "%windir%\\syswow64\\dllhost.exe",
"port": 80,
"sleeptime": 45000,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"ntdll:RtlUserThreadStart",
"CreateThread",
"NtQueueApcThread-s",
"CreateRemoteThread",
"RtlCreateUserThread"
],
"process-inject.startrwx": 4,
"post-ex.spawnto_x64": "%windir%\\sysnative\\dllhost.exe",
"process-inject.stub": "ecc996c40e5ea9a2ff8f08a1e6c01391",
"http-get.uri": "agentkernel.top,/iot/telemetry/ping",
"watermark": 1234567890,
"dns-beacon.strategy_fail_seconds": -1,
"process-inject.userwx": 32,
"dns-beacon.strategy_fail_x": -1,
"stage.cleanup": 1,
"http-post.verb": "POST",
"http-post.uri": "/iot/telemetry/event-submit",
"server.publickey_md5": "16390b7b750f32ef7a33ba0a847fe293",
"process-inject.allocator": 1,
"http-get.verb": "GET",
"http-get.client": [
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Accept-Encoding: gzip, deflate",
"X-DEVICE-ID"
]
}
},
"ip": 793963020,
"http": {
"status": 404,
"robots_hash": null,
"redirects": [],
"title_hash": null,
"securitytxt": null,
"title": null,
"sitemap_hash": null,
"robots": null,
"dom_hash": 0,
"headers_hash": -1692967738,
"host": "47.82.234.12",
"html": "",
"server_hash": 1186221244,
"location": "/",
"components": {
"Nginx": {
"categories": [
"Web servers",
"Reverse proxies"
],
"versions": [
"1.24.0"
]
},
"Ubuntu": {
"categories": [
"Operating systems"
]
}
},
"securitytxt_hash": null,
"server": "nginx/1.24.0 (Ubuntu)",
"sitemap": null,
"html_hash": 0
},
"port": 80,
"transport": "tcp",
"cloud": {
"region": null,
"service": null,
"provider": "Alibaba Cloud"
},
"vulns": {
"CVE-2023-44487": {
"verified": false,
"ransomware_campaign": "Unknown",
"ranking_epss": 0.99994,
"cvss_v2": null,
"cvss_version": 3,
"summary": "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.",
"references": [
"http://www.openwall.com/lists/oss-security/2023/10/10/6",
"http://www.openwall.com/lists/oss-security/2023/10/10/7",
"http://www.openwall.com/lists/oss-security/2023/10/13/4",
"http://www.openwall.com/lists/oss-security/2023/10/13/9",
"http://www.openwall.com/lists/oss-security/2023/10/18/4",
"http://www.openwall.com/lists/oss-security/2023/10/18/8",
"http://www.openwall.com/lists/oss-security/2023/10/19/6",
"http://www.openwall.com/lists/oss-security/2023/10/20/8",
"https://access.redhat.com/security/cve/cve-2023-44487",
"https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/",
"https://aws.amazon.com/security/security-bulletins/AWS-2023-011/",
"https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/",
"https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/",
"https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/",
"https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack",
"https://blog.vespa.ai/cve-2023-44487/",
"https://bugzilla.proxmox.com/show_bug.cgi?id=4988",
"https://bugzilla.redhat.com/show_bug.cgi?id=2242803",
"https://bugzilla.suse.com/show_bug.cgi?id=1216123",
"https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9",
"https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/",
"https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack",
"https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125",
"https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715",
"https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve",
"https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764",
"https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088",
"https://github.com/Azure/AKS/issues/3947",
"https://github.com/Kong/kong/discussions/11741",
"https://github.com/advisories/GHSA-qppj-fm5r-hxr3",
"https://github.com/advisories/GHSA-vx74-f528-fxqg",
"https://github.com/advisories/GHSA-xpw8-rcwv-8f8p",
"https://github.com/akka/akka-http/issues/4323",
"https://github.com/alibaba/tengine/issues/1872",
"https://github.com/apache/apisix/issues/10320",
"https://github.com/apache/httpd-site/pull/10",
"https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113",
"https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2",
"https://github.com/apache/trafficserver/pull/10564",
"https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487",
"https://github.com/bcdannyboy/CVE-2023-44487",
"https://github.com/caddyserver/caddy/issues/5877",
"https://github.com/caddyserver/caddy/releases/tag/v2.7.5",
"https://github.com/dotnet/announcements/issues/277",
"https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73",
"https://github.com/eclipse/jetty.project/issues/10679",
"https://github.com/envoyproxy/envoy/pull/30055",
"https://github.com/etcd-io/etcd/issues/16740",
"https://github.com/facebook/proxygen/pull/466",
"https://github.com/golang/go/issues/63417",
"https://github.com/grpc/grpc-go/pull/6703",
"https://github.com/grpc/grpc/releases/tag/v1.59.2",
"https://github.com/h2o/h2o/pull/3291",
"https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf",
"https://github.com/haproxy/haproxy/issues/2312",
"https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244",
"https://github.com/junkurihara/rust-rpxy/issues/97",
"https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1",
"https://github.com/kazu-yamamoto/http2/issues/93",
"https://github.com/kubernetes/kubernetes/pull/121120",
"https://github.com/line/armeria/pull/5232",
"https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632",
"https://github.com/micrictor/http2-rst-stream",
"https://github.com/microsoft/CBL-Mariner/pull/6381",
"https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61",
"https://github.com/nghttp2/nghttp2/pull/1961",
"https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0",
"https://github.com/ninenines/cowboy/issues/1615",
"https://github.com/nodejs/node/pull/50121",
"https://github.com/openresty/openresty/issues/930",
"https://github.com/opensearch-project/data-prepper/issues/3474",
"https://github.com/oqtane/oqtane.framework/discussions/3367",
"https://github.com/projectcontour/contour/pull/5826",
"https://github.com/tempesta-tech/tempesta/issues/1986",
"https://github.com/varnishcache/varnish-cache/issues/3996",
"https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo",
"https://istio.io/latest/news/security/istio-security-2023-004/",
"https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/",
"https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html",
"https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html",
"https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/",
"https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html",
"https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html",
"https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html",
"https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487",
"https://my.f5.com/manage/s/article/K000137106",
"https://netty.io/news/2023/10/10/4-1-100-Final.html",
"https://news.ycombinator.com/item?id=37830987",
"https://news.ycombinator.com/item?id=37830998",
"https://news.ycombinator.com/item?id=37831062",
"https://news.ycombinator.com/item?id=37837043",
"https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/",
"https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected",
"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ",
"https://security.gentoo.org/glsa/202311-09",
"https://security.netapp.com/advisory/ntap-20231016-0001/",
"https://security.netapp.com/advisory/ntap-20240426-0007/",
"https://security.netapp.com/advisory/ntap-20240621-0006/",
"https://security.netapp.com/advisory/ntap-20240621-0007/",
"https://security.paloaltonetworks.com/CVE-2023-44487",
"https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14",
"https://ubuntu.com/security/CVE-2023-44487",
"https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/",
"https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487",
"https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event",
"https://www.debian.org/security/2023/dsa-5521",
"https://www.debian.org/security/2023/dsa-5522",
"https://www.debian.org/security/2023/dsa-5540",
"https://www.debian.org/security/2023/dsa-5549",
"https://www.debian.org/security/2023/dsa-5558",
"https://www.debian.org/security/2023/dsa-5570",
"https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487",
"https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/",
"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/",
"https://www.openwall.com/lists/oss-security/2023/10/10/6",
"https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack",
"https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/",
"http://www.openwall.com/lists/oss-security/2023/10/13/4",
"http://www.openwall.com/lists/oss-security/2023/10/13/9",
"http://www.openwall.com/lists/oss-security/2023/10/18/4",
"http://www.openwall.com/lists/oss-security/2023/10/18/8",
"http://www.openwall.com/lists/oss-security/2023/10/19/6",
"http://www.openwall.com/lists/oss-security/2023/10/20/8",
"http://www.openwall.com/lists/oss-security/2025/08/13/6",
"https://access.redhat.com/security/cve/cve-2023-44487",
"https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/",
"https://aws.amazon.com/security/security-bulletins/AWS-2023-011/",
"https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/",
"https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/",
"https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/",
"https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack",
"https://blog.vespa.ai/cve-2023-44487/",
"https://bugzilla.proxmox.com/show_bug.cgi?id=4988",
"https://bugzilla.redhat.com/show_bug.cgi?id=2242803",
"https://bugzilla.suse.com/show_bug.cgi?id=1216123",
"https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9",
"https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/",
"https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack",
"https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125",
"https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715",
"https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve",
"https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764",
"https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088",
"https://github.com/Azure/AKS/issues/3947",
"https://github.com/Kong/kong/discussions/11741",
"https://github.com/advisories/GHSA-qppj-fm5r-hxr3",
"https://github.com/advisories/GHSA-vx74-f528-fxqg",
"https://github.com/advisories/GHSA-xpw8-rcwv-8f8p",
"https://github.com/akka/akka-http/issues/4323",
"https://github.com/alibaba/tengine/issues/1872",
"https://github.com/apache/apisix/issues/10320",
"https://github.com/apache/httpd-site/pull/10",
"https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113",
"https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2",
"https://github.com/apache/trafficserver/pull/10564",
"https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487",
"https://github.com/bcdannyboy/CVE-2023-44487",
"https://github.com/caddyserver/caddy/issues/5877",
"https://github.com/caddyserver/caddy/releases/tag/v2.7.5",
"https://github.com/dotnet/announcements/issues/277",
"https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73",
"https://github.com/eclipse/jetty.project/issues/10679",
"https://github.com/envoyproxy/envoy/pull/30055",
"https://github.com/etcd-io/etcd/issues/16740",
"https://github.com/facebook/proxygen/pull/466",
"https://github.com/golang/go/issues/63417",
"https://github.com/grpc/grpc-go/pull/6703",
"https://github.com/h2o/h2o/pull/3291",
"https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf",
"https://github.com/haproxy/haproxy/issues/2312",
"https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244",
"https://github.com/junkurihara/rust-rpxy/issues/97",
"https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1",
"https://github.com/kazu-yamamoto/http2/issues/93",
"https://github.com/kubernetes/kubernetes/pull/121120",
"https://github.com/line/armeria/pull/5232",
"https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632",
"https://github.com/micrictor/http2-rst-stream",
"https://github.com/microsoft/CBL-Mariner/pull/6381",
"https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61",
"https://github.com/nghttp2/nghttp2/pull/1961",
"https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0",
"https://github.com/ninenines/cowboy/issues/1615",
"https://github.com/nodejs/node/pull/50121",
"https://github.com/openresty/openresty/issues/930",
"https://github.com/opensearch-project/data-prepper/issues/3474",
"https://github.com/oqtane/oqtane.framework/discussions/3367",
"https://github.com/projectcontour/contour/pull/5826",
"https://github.com/tempesta-tech/tempesta/issues/1986",
"https://github.com/varnishcache/varnish-cache/issues/3996",
"https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo",
"https://istio.io/latest/news/security/istio-security-2023-004/",
"https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/",
"https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html",
"https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html",
"https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/",
"https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html",
"https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html",
"https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html",
"https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487",
"https://my.f5.com/manage/s/article/K000137106",
"https://netty.io/news/2023/10/10/4-1-100-Final.html",
"https://news.ycombinator.com/item?id=37830987",
"https://news.ycombinator.com/item?id=37830998",
"https://news.ycombinator.com/item?id=37831062",
"https://news.ycombinator.com/item?id=37837043",
"https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/",
"https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected",
"https://security.gentoo.org/glsa/202311-09",
"https://security.netapp.com/advisory/ntap-20231016-0001/",
"https://security.netapp.com/advisory/ntap-20240426-0007/",
"https://security.netapp.com/advisory/ntap-20240621-0006/",
"https://security.netapp.com/advisory/ntap-20240621-0007/",
"https://security.paloaltonetworks.com/CVE-2023-44487",
"https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14",
"https://ubuntu.com/security/CVE-2023-44487",
"https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/",
"https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487",
"https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event",
"https://www.debian.org/security/2023/dsa-5521",
"https://www.debian.org/security/2023/dsa-5522",
"https://www.debian.org/security/2023/dsa-5540",
"https://www.debian.org/security/2023/dsa-5549",
"https://www.debian.org/security/2023/dsa-5558",
"https://www.debian.org/security/2023/dsa-5570",
"https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487",
"https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/",
"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/",
"https://www.openwall.com/lists/oss-security/2023/10/10/6",
"https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack",
"https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/",
"https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause",
"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487"
],
"epss": 0.9446,
"kev": true,
"cvss": 7.5
},
"CVE-2025-23419": {
"verified": false,
"ranking_epss": 0.86304,
"cvss_v2": null,
"cvss_version": 4,
"summary": "When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication. \n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
"references": [
"https://my.f5.com/manage/s/article/K000149173",
"http://www.openwall.com/lists/oss-security/2025/02/05/8",
"https://lists.debian.org/debian-lts-announce/2025/03/msg00017.html"
],
"epss": 0.02857,
"cvss": 5.3
}
},
"location": {
"city": "San Mateo",
"region_code": "CA",
"area_code": null,
"longitude": -122.3276,
"latitude": 37.5507,
"country_code": "US",
"country_name": "United States"
},
"product": "Cobalt Strike Beacon",
"hash": -261887606,
"tags": [
"cloud",
"eol-product"
],
"timestamp": "2026-05-15T11:50:39.781060",
"hostnames": [],
"org": "Alibaba Cloud LLC",
"data": "HTTP/1.1 404 Not Found\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Fri, 15 May 2026 11:50:39 GMT\r\nContent-Type: text/plain\r\nContent-Length: 0\r\nConnection: keep-alive\r\n\r\n\nCobalt Strike Beacon:\n x86:\n beacon_type: HTTP\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\n Accept-Encoding: gzip, deflate\n X-DEVICE-ID\n http-get.uri: agentkernel.top,/iot/telemetry/ping\n http-get.verb: GET\n http-post.client:\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\n Accept-Encoding: gzip, deflate\n X-DEVICE-ID\n http-post.uri: /iot/telemetry/event-submit\n http-post.verb: POST\n jitter: 37\n maxgetsize: 1398129\n port: 80\n post-ex.spawnto_x64: %windir%\\sysnative\\dllhost.exe\n post-ex.spawnto_x86: %windir%\\syswow64\\dllhost.exe\n process-inject.allocator: 1\n process-inject.execute:\n ntdll:RtlUserThreadStart\n CreateThread\n NtQueueApcThread-s\n CreateRemoteThread\n RtlCreateUserThread\n process-inject.min_alloc: 17500\n process-inject.startrwx: 4\n process-inject.stub: ecc996c40e5ea9a2ff8f08a1e6c01391\n process-inject.userwx: 32\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: 16390b7b750f32ef7a33ba0a847fe293\n sleeptime: 45000\n stage.cleanup: 1\n useragent_header: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\n watermark: 1234567890\n x64:\n beacon_type: HTTP\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\n Accept-Encoding: gzip, deflate\n X-DEVICE-ID\n http-get.uri: agentkernel.top,/iot/telemetry/ping\n http-get.verb: GET\n http-post.client:\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\n Accept-Encoding: gzip, deflate\n X-DEVICE-ID\n http-post.uri: /iot/telemetry/event-submit\n http-post.verb: POST\n jitter: 37\n maxgetsize: 1398129\n port: 80\n post-ex.spawnto_x64: %windir%\\sysnative\\dllhost.exe\n post-ex.spawnto_x86: %windir%\\syswow64\\dllhost.exe\n process-inject.allocator: 1\n process-inject.execute:\n ntdll:RtlUserThreadStart\n CreateThread\n NtQueueApcThread-s\n CreateRemoteThread\n RtlCreateUserThread\n process-inject.min_alloc: 17500\n process-inject.startrwx: 4\n process-inject.stub: ecc996c40e5ea9a2ff8f08a1e6c01391\n process-inject.userwx: 32\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: 16390b7b750f32ef7a33ba0a847fe293\n sleeptime: 45000\n stage.cleanup: 1\n useragent_header: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\n watermark: 1234567890\n",
"cpe23": [
"cpe:2.3:a:f5:nginx:1.24.0",
"cpe:2.3:a:helpsystems:cobalt_strike",
"cpe:2.3:o:canonical:ubuntu_linux",
"cpe:2.3:o:linux:linux_kernel"
],
"isp": null,
"cpe": [
"cpe:/a:f5:nginx:1.24.0",
"cpe:/a:helpsystems:cobalt_strike",
"cpe:/o:canonical:ubuntu_linux",
"cpe:/o:linux:linux_kernel"
],
"domains": [],
"ip_str": "47.82.234.12",
"os": "Ubuntu",
"_shodan": {
"region": "na",
"crawler": "667c9d6cc4bbbf0594c20c6f1ba56a8147913fd0",
"options": {},
"module": "http",
"id": "c1ca2b59-cb9a-469e-8db5-967d2a075256"
}
}