C2

Key: 1.94.62.205 · Resolved IP: 1.94.62.205
Protocols: http · Ports: 8089, 8090
First view: 2025-12-23 00:11:04 CET · Last view: 2025-12-23 00:11:15 CET

Endpoints

ID	Protocole	Port	First view	Last view	SubmitURIs	Paths	URLs	Seen in
http:8089	http	8089	2025-12-23 00:11:13 CET	2025-12-23 00:11:15 CET	/submit.php	/push, /cm	3 Sample http://1.94.62.205:8089/push/submit.php http://1.94.62.205:8089/submit.php http://1.94.62.205:8089/cm/submit.php	2 hashes 55989f187a809143fcf535f2c8a40a5f1c0c1bc1f1fb3180acdeb22b9b706f1c 60ab8a74319940378f8563e0bc11ed3bacc4657954d197832775b85844e0e241
http:8090	http	8090	2025-12-23 00:11:04 CET	2025-12-23 00:11:05 CET	/submit.php	/dot.gif, /push	3 Sample http://1.94.62.205:8090/dot.gif/submit.php http://1.94.62.205:8090/submit.php http://1.94.62.205:8090/push/submit.php	2 hashes 30ca1eb71bce4aa072eff237610163fe2a7ecfdf1eff28a4a895b0be491cebe7 4ad764fd4a3dfc2f56f156a22c51dd24706e8cb8a21e8d679b8f31f1c49f5b65

{
  "Endpoints": {
    "http:8089": {
      "Firsttime": 1766445073.7923672,
      "lasttime": 1766445075.3825312,
      "paths": [
        "/push",
        "/cm"
      ],
      "port": "8089",
      "protocol": "http",
      "seen_in": [
        {
          "arch": "x64",
          "beacon_ip": "156.238.233.21",
          "beacon_port": "8089",
          "config_hash": "55989f187a809143fcf535f2c8a40a5f1c0c1bc1f1fb3180acdeb22b9b706f1c",
          "trial": false,
          "ts": 1766445075.3825312,
          "version": "Cobalt Strike 4.7 (Aug 17, 2022)",
          "watermark": 987654321
        },
        {
          "arch": "x86",
          "beacon_ip": "156.238.233.21",
          "beacon_port": "8089",
          "config_hash": "60ab8a74319940378f8563e0bc11ed3bacc4657954d197832775b85844e0e241",
          "trial": false,
          "ts": 1766445073.7923672,
          "version": "Cobalt Strike 4.7 (Aug 17, 2022)",
          "watermark": 987654321
        }
      ],
      "submituris": [
        "/submit.php"
      ],
      "urls": [
        "http://1.94.62.205:8089/push/submit.php",
        "http://1.94.62.205:8089/submit.php",
        "http://1.94.62.205:8089/cm/submit.php"
      ]
    },
    "http:8090": {
      "Firsttime": 1766445064.3205974,
      "lasttime": 1766445065.927646,
      "paths": [
        "/dot.gif",
        "/push"
      ],
      "port": "8090",
      "protocol": "http",
      "seen_in": [
        {
          "arch": "x64",
          "beacon_ip": "156.238.233.21",
          "beacon_port": "8090",
          "config_hash": "30ca1eb71bce4aa072eff237610163fe2a7ecfdf1eff28a4a895b0be491cebe7",
          "trial": false,
          "ts": 1766445065.927646,
          "version": "Cobalt Strike 4.7 (Aug 17, 2022)",
          "watermark": 987654321
        },
        {
          "arch": "x86",
          "beacon_ip": "156.238.233.21",
          "beacon_port": "8090",
          "config_hash": "4ad764fd4a3dfc2f56f156a22c51dd24706e8cb8a21e8d679b8f31f1c49f5b65",
          "trial": false,
          "ts": 1766445064.3205974,
          "version": "Cobalt Strike 4.7 (Aug 17, 2022)",
          "watermark": 987654321
        }
      ],
      "submituris": [
        "/submit.php"
      ],
      "urls": [
        "http://1.94.62.205:8090/dot.gif/submit.php",
        "http://1.94.62.205:8090/submit.php",
        "http://1.94.62.205:8090/push/submit.php"
      ]
    }
  },
  "Firsttime": 1766445064.3205974,
  "Host": "1.94.62.205",
  "IP": "1.94.62.205",
  "IPs": [
    "1.94.62.205"
  ],
  "Paths": [
    "/push",
    "/cm",
    "/dot.gif"
  ],
  "Ports": [
    "8089",
    "8090"
  ],
  "Protocols": [
    "http"
  ],
  "SubmitURIs": [
    "/submit.php"
  ],
  "URLs": [
    "http://1.94.62.205:8089/push/submit.php",
    "http://1.94.62.205:8089/submit.php",
    "http://1.94.62.205:8089/cm/submit.php",
    "http://1.94.62.205:8090/dot.gif/submit.php",
    "http://1.94.62.205:8090/submit.php",
    "http://1.94.62.205:8090/push/submit.php"
  ],
  "ip_enrichment": {
    "1.94.62.205": {
      "ASN": {
        "number": 55990,
        "org": "HWCSNET Huawei Cloud Service data center"
      },
      "GEO": {
        "country": "CN",
        "country_name": "China",
        "lat": 35.0,
        "lon": 105.0
      },
      "first": 1766445064.3205974,
      "last": 1766445075.3825312,
      "meta": {
        "build_db": "2025-10-14 12:06:54",
        "db_source": "GeoOpen-Country-ASN"
      },
      "source": "ip.circl.lu",
      "updated": 1767456638.685799
    }
  },
  "lasttime": 1766445075.3825312
}