158.94.208.206 — intel.lukealbertson.com

Indicator 158.94.208.206 Type ip Category C2 Infrastructure Family AsyncRAT Hosting Middlesex University Confidence high VT Score 16/94 Source shodan First Seen 2026-04-18 05:03:23 UTC Last Seen 2026-05-16 16:00:50 UTC Shodan View on Shodan ↗
Raw JSON
{
  "product": "AsyncRAT",
  "hash": 0,
  "os": null,
  "tags": [
    "c2",
    "self-signed"
  ],
  "timestamp": "2026-04-17T12:37:03.134895",
  "isp": null,
  "transport": "tcp",
  "_shodan": {
    "region": "na",
    "crawler": "882b86ace587f9a0c7e7358585830fb0a6fff519",
    "options": {},
    "module": "https-simple-new",
    "id": "758e8f6f-88ac-4877-ad61-7be46d8d3389"
  },
  "ssl": {
    "chain_sha256": [
      "65a8ef64e5d7757cf017fd80952c1fdd65c96fd3ca295a460ca98c6d2a3c39a5"
    ],
    "jarm": "22b22b00022b22b22b22b22b22b22bd3b67dd3674d9af9dd91c1955a35d0e9",
    "tlsext": [
      {
        "id": 23,
        "name": "extended_master_secret"
      },
      {
        "id": 65281,
        "name": "renegotiation_info"
      }
    ],
    "chain": [
      "-----BEGIN CERTIFICATE-----\nMIIE8jCCAtqgAwIBAgIQAMfly/P1VHkxsh4uegKRczANBgkqhkiG9w0BAQ0FADAa\nMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIxMjA3MDA0MjI0WhgPOTk5\nOTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJ\nKoZIhvcNAQEBBQADggIPADCCAgoCggIBALWcHxzRn+IwS+ygH0E0qHSjAk5QnSW4\nJ9K7aRV+hDPCYVQJbX8naMF/seJdK5AQEhO8eq2xPCbaCv7BnE6wkMO4qs7cLRJc\noK+jrBuFV/Jp6+K1EFfi9B3D+o1aGYffsN5qG+mu7qsyTrvh0FEdzcgTMwGmDLYo\nndMglWmutjv3ooHVpBlPG4BKBxIl8ZR5BCcF845eyjShuEy57X0/t/ggVKbvSpcT\nnjH89aAhUKKYSCjIYH/E2q3meZ7hyDZZS468tpOJbFq1F96UIgUR8mtoDJPo3mNZ\nCHYgE/LFkCXbVFiC3BstSV1iCw80Dtt3vtFd4V0u65Tb61hK2d2u2B23Ecw+/t6B\n5hSvubzGYAFbKei/4v4XOMSYyyULXek0CKk4cXRhZ23DQh09JWhc1WZIV2DT49v5\nzqwXgetIxcYD0/eh4U3/s3V2CQW+lp/9TYjc6qGvH6XhTAdt06gQY/6vszzLI144\nY9cohalLFJxFApQNEQLIS/6iVzUbBP8dlQTzTQEUhVVCYOnwZQBFNCjRHeLVW3T/\nMwg0Pha8vM57jykyBMYqQyV86beuMedt/l+vQke5HzSBj1hM06pEkFegL+RYgQdW\nxtG+Jm+Rlz7AdJPQ82jJFUrGkjsZlBmg56qBZtnJFzcDpgHO1hBJeIojmVF/jpzR\nKakDaWJ7UNa3AgMBAAGjMjAwMB0GA1UdDgQWBBRo5L6Hno4FfXnETSuqj2EaKKQi\nWTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAPy9xg7hFLAnFh\nGje634kVcTW8pptehj6dKJCInhSgr2AU72kd4o+Z71bis3uN9zlmij7mprgvJreJ\nqsQ2kNBYIEPv6MBgNnuaZDQfLJbdLpABcSR8Rp24VrCrn2R6tkD7jBM4MWl12fYt\na5jRWVthISRI6wGJbr3dhHLcC+F/56u/V3C4k2U9JIVFvZGOVKEPyXsaSx/MZcS4\nitzulet+oJJOxx7qSu3vp83mi+d+hf/ScbaeHE+iriEEZ+3FO/dYPH8XBw/QFkLR\nrpyDdOVciVCTxdC8Sy9nYkTyn0AX4BxQuT9bxxSXEyny4un+lT1CYWxh70NutGLd\nRfDXt2b2uomUDzsSNd4L4enKkZrUoMp4U7G0IYPc646q8MlZqj3BJ/bF3YnAzIDK\nSOGAX64d1gk7FSafyKNXt03vKZDwbw+JEaon6BcJUloxXduTdr6JnV7gmV11TBaN\nvTa5tdJy6kgmfCAL38sgpBAzGAhdWrLWy09hsVAG8bUwjVmMipYLWa8h+VF7oiBq\nyqNie/B3a1+X7pwyPKCCYibReycfWvNEUfFrHjY73v9jYURY65AV1vlmFMnzKuDl\nHCTiMyfC/Il3AfaLijAt3vjdDxxOwz+79DQai+TAjvXK2Uk+gFUPVSFAgRWghd4R\ns7sjVoLTNjyBfEkvtoYI9Th8HGX3jw==\n-----END CERTIFICATE-----\n"
    ],
    "versions": [],
    "acceptable_cas": [],
    "alpn": [],
    "cert": {
      "sig_alg": "sha512WithRSAEncryption",
      "issued": "20221207004224Z",
      "expires": "99991231235959Z",
      "pubkey": {
        "bits": 4096,
        "type": "rsa"
      },
      "version": 2,
      "extensions": [
        {
          "data": "\\x04\\x14h\\xe4\\xbe\\x87\\x9e\\x8e\\x05}y\\xc4M+\\xaa\\x8fa\\x1a(\\xa4\"Y",
          "name": "subjectKeyIdentifier"
        },
        {
          "critical": true,
          "data": "0\\x03\\x01\\x01\\xff",
          "name": "basicConstraints"
        }
      ],
      "fingerprint": {
        "sha256": "65a8ef64e5d7757cf017fd80952c1fdd65c96fd3ca295a460ca98c6d2a3c39a5",
        "sha1": "ee882e313d72643dcda040cb6754ccc7ac79d95b"
      },
      "serial": 1.0379279054661004e+36,
      "issuer": {
        "CN": "AsyncRAT Server"
      },
      "expired": false,
      "subject": {
        "CN": "AsyncRAT Server"
      }
    },
    "cipher": {
      "version": "TLSv1.0",
      "bits": 256,
      "name": "ECDHE-RSA-AES256-SHA"
    },
    "trust": {
      "revoked": false,
      "browser": null
    },
    "handshake_states": [
      "before SSL initialization",
      "SSLv3/TLS write client hello",
      "SSLv3/TLS read server hello",
      "SSLv3/TLS read server certificate",
      "SSLv3/TLS read server key exchange",
      "SSLv3/TLS read server done",
      "SSLv3/TLS write client key exchange",
      "SSLv3/TLS write change cipher spec",
      "SSLv3/TLS write finished",
      "SSLv3/TLS read change cipher spec",
      "SSLv3/TLS read finished",
      "SSL negotiation finished successfully"
    ],
    "ja3s": "b74704234e6128f33bff9865696e31b3",
    "ocsp": {}
  },
  "hostnames": [],
  "location": {
    "city": "London",
    "region_code": "ENG",
    "area_code": null,
    "longitude": -0.12574,
    "latitude": 51.50853,
    "country_code": "GB",
    "country_name": "United Kingdom"
  },
  "ip": 2657013966,
  "domains": [],
  "org": "Middlesex University",
  "data": "",
  "port": 7001,
  "ip_str": "158.94.208.206"
}