20.81.139.12
C2 Infrastructure CobaltStrike Indicator 20.81.139.12 Type ip Category C2 Infrastructure Family CobaltStrike Hosting Azure Confidence high VT Score 6/94 Source shodan First Seen 2026-05-24 00:00:05 UTC Last Seen 2026-07-08 08:00:43 UTC Shodan View on Shodan ↗
Raw JSON
{
"ip": 340888332,
"http": {
"status": 404,
"robots_hash": null,
"redirects": [],
"title_hash": null,
"securitytxt": null,
"title": null,
"sitemap_hash": null,
"robots": null,
"dom_hash": 0,
"headers_hash": -505627267,
"host": "20.81.139.12",
"html": "",
"server_hash": -1604084462,
"location": "/",
"components": {
"Apache HTTP Server": {
"categories": [
"Web servers"
],
"versions": [
"2.2.36"
]
}
},
"securitytxt_hash": null,
"server": "Apache/2.2.36 (custom) mod_antiloris/0.4",
"sitemap": null,
"html_hash": 0
},
"port": 443,
"transport": "tcp",
"cloud": {
"region": "eastus2",
"service": "AzureCloud",
"provider": "Azure"
},
"location": {
"city": "Boydton",
"region_code": "VA",
"area_code": null,
"longitude": -78.3875,
"latitude": 36.66764,
"country_code": "US",
"country_name": "United States"
},
"product": "Cobalt Strike Beacon",
"hash": 940295850,
"tags": [
"cloud"
],
"timestamp": "2026-05-23T14:00:36.706497",
"ssl": {
"chain_sha256": [
"d0aa9fed5aed8e01b07f9b4043d9532786f5fcd148776e4ef6713848922bef8d",
"aeb1fd7410e83bc96f5da3c6a7c2c1bb836d1fa5cb86e708515890e428a8770b"
],
"jarm": "28d28d28d00028d00042d42d00042de0d120da90d5910c5de2af43b74a6bd8",
"tlsext": [
{
"id": 43,
"name": "supported_versions"
},
{
"id": 51,
"name": "key_share"
},
{
"id": 10,
"name": "supported_groups"
}
],
"chain": [
"-----BEGIN CERTIFICATE-----\nMIIDijCCAxCgAwIBAgISBue3TlDszln1pUujsGbd+hzcMAoGCCqGSM49BAMDMDIx\nCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF\nNzAeFw0yNjA1MTkxMjU3NDdaFw0yNjA4MTcxMjU3NDZaMBoxGDAWBgNVBAMTD2My\nMi5tcy1jbmV0LmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABA4bEA8bnQb9\ng/Xnm7K/Nm1jxTGYKoR2+SFF8HdyJrn941Jw0BTR1LiXjg+/WKvHUCwbCvPk3qE1\nXsq7fRAdU3mjggIcMIICGDAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYB\nBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQULE2BuzglgvtGbn/eJCkOREMR\nf64wHwYDVR0jBBgwFoAUrkie3IcdRKBv2qLlYHQEeMKcAIAwMgYIKwYBBQUHAQEE\nJjAkMCIGCCsGAQUFBzAChhZodHRwOi8vZTcuaS5sZW5jci5vcmcvMBoGA1UdEQQT\nMBGCD2MyMi5tcy1jbmV0LmNvbTATBgNVHSAEDDAKMAgGBmeBDAECATAtBgNVHR8E\nJjAkMCKgIKAehhxodHRwOi8vZTcuYy5sZW5jci5vcmcvOTMuY3JsMIIBDQYKKwYB\nBAHWeQIEAgSB/gSB+wD5AHcAyKPEf8ezrbk1awE/anoSbeM6TkOlxkb5l605dZkd\nz5oAAAGeQIXnuwAABAMASDBGAiEA+sDRW5CtUn7tokG9qSb/y8OA2r+UVZYytoQc\nrsnk7kYCIQDew7y0IwZoOWSl5DGKBOrHappdZhlrnY+3y8nwURBAnwB+AEavhj07\nPuWfpXfeqCRdNrDZ7SKiI/Rhd0EilFLulVBfAAABnkCF6FIACAAABQAHC7gqBAMA\nRzBFAiEAqHPAOcoebeGlgluaFoOqeeaZbAT+l27yoQ53xA02NQwCID6tP8JhtWH6\nj1pV7BFYZc7/E68yaB7nc0Z88OZ+fpPqMAoGCCqGSM49BAMDA2gAMGUCMQC7pEJI\ne4GnOWIaIha1uzOX1Q0E29noTM01zeol1zTBskWxBRG0UedI9ME4g9m0uQ0CMBfa\n8GdnUHP2KKKRTRlHZA+IGC58IQwjjeILPY+J3tBZJ4w/OceqChwxkiMIfNq5gA==\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMIIEVzCCAj+gAwIBAgIRAKp18eYrjwoiCWbTi7/UuqEwDQYJKoZIhvcNAQELBQAw\nTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh\ncmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw\nWhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg\nRW5jcnlwdDELMAkGA1UEAxMCRTcwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAARB6AST\nCFh/vjcwDMCgQer+VtqEkz7JANurZxLP+U9TCeioL6sp5Z8VRvRbYk4P1INBmbef\nQHJFHCxcSjKmwtvGBWpl/9ra8HW0QDsUaJW2qOJqceJ0ZVFT3hbUHifBM/2jgfgw\ngfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD\nATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSuSJ7chx1EoG/aouVgdAR4\nwpwAgDAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB\nAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g\nBAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu\nY3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAjx66fDdLk5ywFn3CzA1w1qfylHUD\naEf0QZpXcJseddJGSfbUUOvbNR9N/QQ16K1lXl4VFyhmGXDT5Kdfcr0RvIIVrNxF\nh4lqHtRRCP6RBRstqbZ2zURgqakn/Xip0iaQL0IdfHBZr396FgknniRYFckKORPG\nyM3QKnd66gtMst8I5nkRQlAg/Jb+Gc3egIvuGKWboE1G89NTsN9LTDD3PLj0dUMr\nOIuqVjLB8pEC6yk9enrlrqjXQgkLEYhXzq7dLafv5Vkig6Gl0nuuqjqfp0Q1bi1o\nyVNAlXe6aUXw92CcghC9bNsKEO1+M52YY5+ofIXlS/SEQbvVYYBLZ5yeiglV6t3S\nM6H+vTG0aP9YHzLn/KVOHzGQfXDP7qM5tkf+7diZe7o2fw6O7IvN6fsQXEQQj8TJ\nUXJxv2/uJhcuy/tSDgXwHM8Uk34WNbRT7zGTGkQRX0gsbjAea/jYAoWv0ZvQRwpq\nPe79D/i7Cep8qWnA+7AE/3B3S/3dEEYmc0lpe1366A/6GEgk3ktr9PEoQrLChs6I\ntu3wnNLB2euC8IKGLQFpGtOO/2/hiAKjyajaBP25w1jF0Wl8Bbqne3uZ2q1GyPFJ\nYRmT7/OXpmOH/FVLtwS+8ng1cAmpCujPwteJZNcDG0sF2n/sc0+SQf49fdyUK0ty\n+VUwFj9tmWxyR/M=\n-----END CERTIFICATE-----\n"
],
"versions": [
"-TLSv1",
"-SSLv2",
"-SSLv3",
"-TLSv1.1",
"TLSv1.2",
"TLSv1.3"
],
"acceptable_cas": [],
"alpn": [],
"cert": {
"sig_alg": "ecdsa-with-SHA384",
"issued": "20260519125747Z",
"expires": "20260817125746Z",
"pubkey": {
"bits": 256,
"type": "dsa"
},
"version": 2,
"extensions": [
{
"critical": true,
"data": "\\x03\\x02\\x07\\x80",
"name": "keyUsage"
},
{
"data": "0\\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01",
"name": "extendedKeyUsage"
},
{
"critical": true,
"data": "0\\x00",
"name": "basicConstraints"
},
{
"data": "\\x04\\x14,M\\x81\\xbb8%\\x82\\xfbFn\\x7f\\xde$)\\x0eDC\\x11\\x7f\\xae",
"name": "subjectKeyIdentifier"
},
{
"data": "0\\x16\\x80\\x14\\xaeH\\x9e\\xdc\\x87\\x1dD\\xa0o\\xda\\xa2\\xe5`t\\x04x\\xc2\\x9c\\x00\\x80",
"name": "authorityKeyIdentifier"
},
{
"data": "0$0\"\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86\\x16http://e7.i.lencr.org/",
"name": "authorityInfoAccess"
},
{
"data": "0\\x11\\x82\\x0fc22.ms-cnet.com",
"name": "subjectAltName"
},
{
"data": "0\\n0\\x08\\x06\\x06g\\x81\\x0c\\x01\\x02\\x01",
"name": "certificatePolicies"
},
{
"data": "0$0\"\\xa0 \\xa0\\x1e\\x86\\x1chttp://e7.c.lencr.org/93.crl",
"name": "crlDistributionPoints"
},
{
"data": "\\x04\\x81\\xfb\\x00\\xf9\\x00w\\x00\\xc8\\xa3\\xc4\\x7f\\xc7\\xb3\\xad\\xb95k\\x01?jz\\x12m\\xe3:NC\\xa5\\xc6F\\xf9\\x97\\xad9u\\x99\\x1d\\xcf\\x9a\\x00\\x00\\x01\\x9e@\\x85\\xe7\\xbb\\x00\\x00\\x04\\x03\\x00H0F\\x02!\\x00\\xfa\\xc0\\xd1[\\x90\\xadR~\\xed\\xa2A\\xbd\\xa9&\\xff\\xcb\\xc3\\x80\\xda\\xbf\\x94U\\x962\\xb6\\x84\\x1c\\xae\\xc9\\xe4\\xeeF\\x02!\\x00\\xde\\xc3\\xbc\\xb4#\\x06h9d\\xa5\\xe41\\x8a\\x04\\xea\\xc7j\\x9a]f\\x19k\\x9d\\x8f\\xb7\\xcb\\xc9\\xf0Q\\x10@\\x9f\\x00~\\x00F\\xaf\\x86=;>\\xe5\\x9f\\xa5w\\xde\\xa8$]6\\xb0\\xd9\\xed\"\\xa2#\\xf4awA\"\\x94R\\xee\\x95P_\\x00\\x00\\x01\\x9e@\\x85\\xe8R\\x00\\x08\\x00\\x00\\x05\\x00\\x07\\x0b\\xb8*\\x04\\x03\\x00G0E\\x02!\\x00\\xa8s\\xc09\\xca\\x1em\\xe1\\xa5\\x82[\\x9a\\x16\\x83\\xaay\\xe6\\x99l\\x04\\xfe\\x97n\\xf2\\xa1\\x0ew\\xc4\\r65\\x0c\\x02 >\\xad?\\xc2a\\xb5a\\xfa\\x8fZU\\xec\\x11Xe\\xce\\xff\\x13\\xaf2h\\x1e\\xe7sF|\\xf0\\xe6~~\\x93\\xea",
"name": "ct_precert_scts"
}
],
"fingerprint": {
"sha256": "d0aa9fed5aed8e01b07f9b4043d9532786f5fcd148776e4ef6713848922bef8d",
"sha1": "4b0f6458ba215f35230a301cdf698c3bd6186b60"
},
"serial": 6.015225977130363e+41,
"issuer": {
"C": "US",
"CN": "E7",
"O": "Let's Encrypt"
},
"expired": false,
"subject": {
"CN": "c22.ms-cnet.com"
}
},
"cipher": {
"version": "TLSv1.3",
"bits": 256,
"name": "TLS_AES_256_GCM_SHA384"
},
"trust": {
"revoked": false,
"browser": null
},
"handshake_states": [
"before SSL initialization",
"SSLv3/TLS write client hello",
"SSLv3/TLS read server hello",
"TLSv1.3 read encrypted extensions",
"SSLv3/TLS read server certificate",
"TLSv1.3 read server certificate verify",
"SSLv3/TLS read finished",
"SSLv3/TLS write change cipher spec",
"SSLv3/TLS write finished",
"SSL negotiation finished successfully"
],
"ja3s": "f03a69cfa3944d6d51bc52febd87a1a8",
"ocsp": {}
},
"hostnames": [
"c22.ms-cnet.com"
],
"org": "Microsoft Corporation",
"data": "HTTP/1.1 404 Not Found\r\nDate: Sat, 23 May 2026 14:00:36 GMT\r\nContent-Type: text/plain\r\nContent-Length: 0\r\nServer: Apache/2.2.36 (custom) mod_antiloris/0.4\r\nAccess-Control-Allow-Headers: X-PINGOTHER\r\nX-Content-Security-Policy: default-src 'self'\r\nX-Content-Type-Options: nosniff\r\nX-UA-Compatible: Chrome=1\r\nProxy-Connection: Keep-Alive\r\nContent-Security-Policy-Report-Only: default-src 'self'; report-uri /csp_report_parser;\r\nETag: E3A4\r\n\r\n",
"asn": "AS8075",
"cpe23": [
"cpe:2.3:a:apache:http_server:2.2.36",
"cpe:2.3:a:helpsystems:cobalt_strike"
],
"isp": "Microsoft Corporation",
"cpe": [
"cpe:/a:apache:http_server:2.2.36",
"cpe:/a:helpsystems:cobalt_strike"
],
"domains": [
"ms-cnet.com"
],
"ip_str": "20.81.139.12",
"os": null,
"_shodan": {
"region": "eu",
"module": "https",
"ptr": true,
"options": {},
"id": "232bc393-f22d-4a8d-b6fd-0753229fbe3a",
"crawler": "78039f81a0245caa8ab71c98182f0eff0ce52aab"
}
}