154.201.68.191
C2 Infrastructure CobaltStrike Indicator 154.201.68.191 Type ip Category C2 Infrastructure Family CobaltStrike Hosting High Family Technology Co., Limited Confidence high VT Score 20/94 Source shodan First Seen 2026-05-24 00:00:05 UTC Last Seen 2026-07-01 00:00:55 UTC Shodan View on Shodan ↗
Raw JSON
{
"cobalt_strike_beacon": {
"x86": {
"beacon_type": "HTTP",
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)",
"http-post.client": [
"Content-Type: application/octet-stream",
"id"
],
"maxgetsize": 1048576,
"post-ex.spawnto_x86": "%windir%\\syswow64\\rundll32.exe",
"port": 14125,
"sleeptime": 60000,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"CreateThread",
"SetThreadContext",
"CreateRemoteThread",
"RtlCreateUserThread"
],
"process-inject.startrwx": 64,
"post-ex.spawnto_x64": "%windir%\\sysnative\\rundll32.exe",
"process-inject.stub": "04e0a11be59147a8d73d2b3e9fea832c",
"http-get.uri": "154.201.68.191,/match",
"watermark": 100000,
"dns-beacon.strategy_fail_seconds": -1,
"server.publickey_md5": "fd030ebb86e3a4b5da94943a9322cccb",
"dns-beacon.strategy_fail_x": -1,
"http-post.verb": "POST",
"http-post.uri": "/submit.php",
"process-inject.userwx": 64,
"http-get.verb": "GET",
"http-get.client": [
"Cookie"
]
},
"x64": {
"beacon_type": "HTTP",
"dns-beacon.strategy_rotate_seconds": -1,
"useragent_header": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)",
"http-post.client": [
"Content-Type: application/octet-stream",
"id"
],
"maxgetsize": 1048576,
"post-ex.spawnto_x86": "%windir%\\syswow64\\rundll32.exe",
"port": 14125,
"sleeptime": 60000,
"uses_cookies": 1,
"proxy.behavior": "2 (Use IE settings)",
"process-inject.execute": [
"CreateThread",
"SetThreadContext",
"CreateRemoteThread",
"RtlCreateUserThread"
],
"process-inject.startrwx": 64,
"post-ex.spawnto_x64": "%windir%\\sysnative\\rundll32.exe",
"process-inject.stub": "04e0a11be59147a8d73d2b3e9fea832c",
"http-get.uri": "154.201.68.191,/ptj",
"watermark": 100000,
"dns-beacon.strategy_fail_seconds": -1,
"server.publickey_md5": "fd030ebb86e3a4b5da94943a9322cccb",
"dns-beacon.strategy_fail_x": -1,
"http-post.verb": "POST",
"http-post.uri": "/submit.php",
"process-inject.userwx": 64,
"http-get.verb": "GET",
"http-get.client": [
"Cookie"
]
}
},
"ip": 2596881599,
"http": {
"status": 404,
"robots_hash": null,
"redirects": [],
"title_hash": null,
"securitytxt": null,
"title": null,
"sitemap_hash": null,
"robots": null,
"dom_hash": 0,
"headers_hash": -648363402,
"host": "154.201.68.191",
"html": "",
"server_hash": -1340961475,
"location": "/",
"components": {
"HSTS": {
"categories": [
"Security"
]
},
"Nginx": {
"categories": [
"Web servers",
"Reverse proxies"
]
}
},
"securitytxt_hash": null,
"server": "nginx",
"sitemap": null,
"html_hash": 0
},
"port": 443,
"transport": "tcp",
"location": {
"city": "Tseung Kwan O",
"region_code": "",
"area_code": null,
"longitude": 114.24992,
"latitude": 22.32789,
"country_code": "HK",
"country_name": "Hong Kong"
},
"product": "Cobalt Strike Beacon",
"hash": 921306776,
"timestamp": "2026-05-21T03:00:33.712633",
"ssl": {
"chain_sha256": [
"935deda4c688c0bbaf891f5394e87767347caf98410070e9c09d76f02db03e94",
"aeb1fd7410e83bc96f5da3c6a7c2c1bb836d1fa5cb86e708515890e428a8770b"
],
"jarm": "1dd40d40d00040d00042d43d0000007d20e9b9a3e87aa1ec17cb4d646ce9a5",
"tlsext": [
{
"id": 43,
"name": "supported_versions"
},
{
"id": 51,
"name": "key_share"
},
{
"id": 0,
"name": "server_name"
}
],
"chain": [
"-----BEGIN CERTIFICATE-----\nMIIDjDCCAxKgAwIBAgISBaVM78dQPqqyf/61I4MOSlFmMAoGCCqGSM49BAMDMDIx\nCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF\nNzAeFw0yNjA0MTIwOTE3MDlaFw0yNjA3MTEwOTE3MDhaMBsxGTAXBgNVBAMTEGxp\ndWVybGlmZS5vbmxpbmUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARWQSoOaVR1\nr4UKuMsJel4JgMWPSCstDuGdzLVetrn2MBKUTsmI/PYrluxop8GQWv8Ux8zouhzY\nNq5oLDBgNoLJo4ICHTCCAhkwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsG\nAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFDdd41S43Cd0NwwJqz6MIpeJ\ni9QTMB8GA1UdIwQYMBaAFK5IntyHHUSgb9qi5WB0BHjCnACAMDIGCCsGAQUFBwEB\nBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL2U3LmkubGVuY3Iub3JnLzAbBgNVHREE\nFDASghBsaXVlcmxpZmUub25saW5lMBMGA1UdIAQMMAowCAYGZ4EMAQIBMC4GA1Ud\nHwQnMCUwI6AhoB+GHWh0dHA6Ly9lNy5jLmxlbmNyLm9yZy8xMDMuY3JsMIIBDAYK\nKwYBBAHWeQIEAgSB/QSB+gD4AHcA1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMX\nwMjFaXcAAAGdgTCcaQAABAMASDBGAiEArJRi7nBwocA97wQmLO6c9keufhSDa84Z\n5jHTJU0sbIUCIQDA0+MToldLcGxYn5K5dGcOy4BYLST3A1xGBLRGo3ZVSQB9ABqL\nnWsP/r+BtHk5xtIxCobW0QLU8EbiGCyd419eJiXvAAABnYEwn5wACAAABQAIiB+X\nBAMARjBEAiB/J2WmVeLUSxJ/Roz16jtJKcD+f/t3YXJesc78IBBaqgIgCsCD3wui\nVMjRXmI/dV1cjUVS7Tv6vns37Db5jfzk6+wwCgYIKoZIzj0EAwMDaAAwZQIwJ1Y0\nDpy5b919k1XOwhookTMdLzhvBBOqkdCBOERz8gLqf/++94qs8jwh5W+tnG79AjEA\nn1YTraSY1IRPiK4nbsulfStOU4uzrZwKbelAwlKxwMkPMxIwxv8fdvIzdzJc7fKD\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMIIEVzCCAj+gAwIBAgIRAKp18eYrjwoiCWbTi7/UuqEwDQYJKoZIhvcNAQELBQAw\nTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh\ncmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw\nWhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg\nRW5jcnlwdDELMAkGA1UEAxMCRTcwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAARB6AST\nCFh/vjcwDMCgQer+VtqEkz7JANurZxLP+U9TCeioL6sp5Z8VRvRbYk4P1INBmbef\nQHJFHCxcSjKmwtvGBWpl/9ra8HW0QDsUaJW2qOJqceJ0ZVFT3hbUHifBM/2jgfgw\ngfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD\nATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSuSJ7chx1EoG/aouVgdAR4\nwpwAgDAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB\nAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g\nBAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu\nY3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAjx66fDdLk5ywFn3CzA1w1qfylHUD\naEf0QZpXcJseddJGSfbUUOvbNR9N/QQ16K1lXl4VFyhmGXDT5Kdfcr0RvIIVrNxF\nh4lqHtRRCP6RBRstqbZ2zURgqakn/Xip0iaQL0IdfHBZr396FgknniRYFckKORPG\nyM3QKnd66gtMst8I5nkRQlAg/Jb+Gc3egIvuGKWboE1G89NTsN9LTDD3PLj0dUMr\nOIuqVjLB8pEC6yk9enrlrqjXQgkLEYhXzq7dLafv5Vkig6Gl0nuuqjqfp0Q1bi1o\nyVNAlXe6aUXw92CcghC9bNsKEO1+M52YY5+ofIXlS/SEQbvVYYBLZ5yeiglV6t3S\nM6H+vTG0aP9YHzLn/KVOHzGQfXDP7qM5tkf+7diZe7o2fw6O7IvN6fsQXEQQj8TJ\nUXJxv2/uJhcuy/tSDgXwHM8Uk34WNbRT7zGTGkQRX0gsbjAea/jYAoWv0ZvQRwpq\nPe79D/i7Cep8qWnA+7AE/3B3S/3dEEYmc0lpe1366A/6GEgk3ktr9PEoQrLChs6I\ntu3wnNLB2euC8IKGLQFpGtOO/2/hiAKjyajaBP25w1jF0Wl8Bbqne3uZ2q1GyPFJ\nYRmT7/OXpmOH/FVLtwS+8ng1cAmpCujPwteJZNcDG0sF2n/sc0+SQf49fdyUK0ty\n+VUwFj9tmWxyR/M=\n-----END CERTIFICATE-----\n"
],
"versions": [
"-TLSv1",
"-SSLv2",
"-SSLv3",
"-TLSv1.1",
"TLSv1.2",
"TLSv1.3"
],
"acceptable_cas": [],
"alpn": [],
"cert": {
"sig_alg": "ecdsa-with-SHA384",
"issued": "20260412091709Z",
"expires": "20260711091708Z",
"pubkey": {
"bits": 256,
"type": "dsa"
},
"version": 2,
"extensions": [
{
"critical": true,
"data": "\\x03\\x02\\x07\\x80",
"name": "keyUsage"
},
{
"data": "0\\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01",
"name": "extendedKeyUsage"
},
{
"critical": true,
"data": "0\\x00",
"name": "basicConstraints"
},
{
"data": "\\x04\\x147]\\xe3T\\xb8\\xdc\\'t7\\x0c\\t\\xab>\\x8c\"\\x97\\x89\\x8b\\xd4\\x13",
"name": "subjectKeyIdentifier"
},
{
"data": "0\\x16\\x80\\x14\\xaeH\\x9e\\xdc\\x87\\x1dD\\xa0o\\xda\\xa2\\xe5`t\\x04x\\xc2\\x9c\\x00\\x80",
"name": "authorityKeyIdentifier"
},
{
"data": "0$0\"\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86\\x16http://e7.i.lencr.org/",
"name": "authorityInfoAccess"
},
{
"data": "0\\x12\\x82\\x10liuerlife.online",
"name": "subjectAltName"
},
{
"data": "0\\n0\\x08\\x06\\x06g\\x81\\x0c\\x01\\x02\\x01",
"name": "certificatePolicies"
},
{
"data": "0%0#\\xa0!\\xa0\\x1f\\x86\\x1dhttp://e7.c.lencr.org/103.crl",
"name": "crlDistributionPoints"
},
{
"data": "\\x04\\x81\\xfa\\x00\\xf8\\x00w\\x00\\xd7m}\\x10\\xd1\\xa7\\xf5w\\xc2\\xc7\\xe9_\\xd7\\x00\\xbf\\xf9\\x82\\xc93Ze\\xe1\\xd0\\xb3\\x01s\\x17\\xc0\\xc8\\xc5iw\\x00\\x00\\x01\\x9d\\x810\\x9ci\\x00\\x00\\x04\\x03\\x00H0F\\x02!\\x00\\xac\\x94b\\xeepp\\xa1\\xc0=\\xef\\x04&,\\xee\\x9c\\xf6G\\xae~\\x14\\x83k\\xce\\x19\\xe61\\xd3%M,l\\x85\\x02!\\x00\\xc0\\xd3\\xe3\\x13\\xa2WKplX\\x9f\\x92\\xb9tg\\x0e\\xcb\\x80X-$\\xf7\\x03\\\\F\\x04\\xb4F\\xa3vUI\\x00}\\x00\\x1a\\x8b\\x9dk\\x0f\\xfe\\xbf\\x81\\xb4y9\\xc6\\xd21\\n\\x86\\xd6\\xd1\\x02\\xd4\\xf0F\\xe2\\x18,\\x9d\\xe3_^&%\\xef\\x00\\x00\\x01\\x9d\\x810\\x9f\\x9c\\x00\\x08\\x00\\x00\\x05\\x00\\x08\\x88\\x1f\\x97\\x04\\x03\\x00F0D\\x02 \\x7f\\'e\\xa6U\\xe2\\xd4K\\x12\\x7fF\\x8c\\xf5\\xea;I)\\xc0\\xfe\\x7f\\xfbwar^\\xb1\\xce\\xfc \\x10Z\\xaa\\x02 \\n\\xc0\\x83\\xdf\\x0b\\xa2T\\xc8\\xd1^b?u]\\\\\\x8dER\\xed;\\xfa\\xbe{7\\xec6\\xf9\\x8d\\xfc\\xe4\\xeb\\xec",
"name": "ct_precert_scts"
}
],
"fingerprint": {
"sha256": "935deda4c688c0bbaf891f5394e87767347caf98410070e9c09d76f02db03e94",
"sha1": "3cfde8920984bf36d9419d7f332d175f9255357e"
},
"serial": 4.918102865299421e+41,
"issuer": {
"C": "US",
"CN": "E7",
"O": "Let's Encrypt"
},
"expired": false,
"subject": {
"CN": "liuerlife.online"
}
},
"cipher": {
"version": "TLSv1.3",
"bits": 256,
"name": "TLS_AES_256_GCM_SHA384"
},
"trust": {
"revoked": false,
"browser": null
},
"handshake_states": [
"before SSL initialization",
"SSLv3/TLS write client hello",
"SSLv3/TLS read server hello",
"TLSv1.3 read encrypted extensions",
"SSLv3/TLS read server certificate",
"TLSv1.3 read server certificate verify",
"SSLv3/TLS read finished",
"SSLv3/TLS write change cipher spec",
"SSLv3/TLS write finished",
"SSL negotiation finished successfully"
],
"ja3s": "574866101f64002c6421cc329e4d5458",
"ocsp": {}
},
"hostnames": [
"liuerlife.online"
],
"org": "High Family Technology Co., Limited",
"data": "HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Thu, 21 May 2026 03:00:33 GMT\r\nContent-Type: text/plain\r\nContent-Length: 0\r\nConnection: keep-alive\r\nX-Frame-Options: DENY\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: strict-origin-when-cross-origin\r\nPermissions-Policy: camera=(), microphone=(), geolocation=()\r\nStrict-Transport-Security: max-age=31536000\r\n\r\n\nCobalt Strike Beacon:\n x86:\n beacon_type: HTTP\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n Cookie\n http-get.uri: 154.201.68.191,/match\n http-get.verb: GET\n http-post.client:\n Content-Type: application/octet-stream\n id\n http-post.uri: /submit.php\n http-post.verb: POST\n maxgetsize: 1048576\n port: 14125\n post-ex.spawnto_x64: %windir%\\sysnative\\rundll32.exe\n post-ex.spawnto_x86: %windir%\\syswow64\\rundll32.exe\n process-inject.execute:\n CreateThread\n SetThreadContext\n CreateRemoteThread\n RtlCreateUserThread\n process-inject.startrwx: 64\n process-inject.stub: 04e0a11be59147a8d73d2b3e9fea832c\n process-inject.userwx: 64\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: fd030ebb86e3a4b5da94943a9322cccb\n sleeptime: 60000\n useragent_header: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)\n uses_cookies: 1\n watermark: 100000\n x64:\n beacon_type: HTTP\n dns-beacon.strategy_fail_seconds: -1\n dns-beacon.strategy_fail_x: -1\n dns-beacon.strategy_rotate_seconds: -1\n http-get.client:\n Cookie\n http-get.uri: 154.201.68.191,/ptj\n http-get.verb: GET\n http-post.client:\n Content-Type: application/octet-stream\n id\n http-post.uri: /submit.php\n http-post.verb: POST\n maxgetsize: 1048576\n port: 14125\n post-ex.spawnto_x64: %windir%\\sysnative\\rundll32.exe\n post-ex.spawnto_x86: %windir%\\syswow64\\rundll32.exe\n process-inject.execute:\n CreateThread\n SetThreadContext\n CreateRemoteThread\n RtlCreateUserThread\n process-inject.startrwx: 64\n process-inject.stub: 04e0a11be59147a8d73d2b3e9fea832c\n process-inject.userwx: 64\n proxy.behavior: 2 (Use IE settings)\n server.publickey_md5: fd030ebb86e3a4b5da94943a9322cccb\n sleeptime: 60000\n useragent_header: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)\n uses_cookies: 1\n watermark: 100000\n",
"asn": "AS137899",
"cpe23": [
"cpe:2.3:a:f5:nginx",
"cpe:2.3:a:helpsystems:cobalt_strike"
],
"isp": "I LAYER LIMITED",
"cpe": [
"cpe:/a:f5:nginx",
"cpe:/a:helpsystems:cobalt_strike"
],
"domains": [
"liuerlife.online"
],
"ip_str": "154.201.68.191",
"os": null,
"_shodan": {
"region": "na",
"module": "https",
"ptr": true,
"options": {
"referrer": "37626cc2-b8eb-4855-8b49-2bc2cb638bf4"
},
"id": "3b1357d0-8dc1-40cb-adf1-2793ebab3e9c",
"crawler": "7feb2bc96fdd1b4aa5c2dd5f98dd62c39e5ab445"
}
}