{"Endpoints":{"http:1991":{"Firsttime":1771772715.943934,"lasttime":1775152572.9101658,"paths":["/mail/u/0/view-tl"],"port":"1991","protocol":"http","seen_in":[{"arch":"x86","beacon_ip":"104.238.24.28","beacon_port":"1991","config_hash":"c3c341a52cc6cbfeed8964316e9ff1123ad99e7f9db9f397e78b1fc2942d2225","trial":false,"ts":1771859184.437938,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321},{"arch":"x64","beacon_ip":"104.238.24.28","beacon_port":"1991","config_hash":"7e200f8c3de0c080f44a932939a5d1006f1173748809cd1a0025aa419dd075a7","trial":false,"ts":1771859185.6367056,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321},{"arch":"x86","beacon_ip":"104.238.24.28","beacon_port":"1991","config_hash":"1c137b1679e8555997385aa163842a70282ecda6e7025bc609a9222c98716058","trial":false,"ts":1775152572.013958,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321},{"arch":"x64","beacon_ip":"104.238.24.28","beacon_port":"1991","config_hash":"38c81f46792c568d913078df501233c9218dd29ab90ee005408e5c0b8759c213","trial":false,"ts":1775152572.9101658,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321}],"submituris":["/mail/u/0/upload"],"urls":["http://104.238.24.28:1991/mail/u/0/upload","http://104.238.24.28:1991/mail/u/0/view-tl/mail/u/0/upload"]}},"Firsttime":1771772715.943934,"Host":"104.238.24.28","IP":"104.238.24.28","IPs":["104.238.24.28"],"Paths":["/mail/u/0/view-tl"],"Ports":["1991"],"Protocols":["http"],"SubmitURIs":["/mail/u/0/upload"],"URLs":["http://104.238.24.28:1991/mail/u/0/upload","http://104.238.24.28:1991/mail/u/0/view-tl/mail/u/0/upload"],"ip_enrichment":{"104.238.24.28":{"ASN":{"number":49791,"org":"AS-3HCLOUD"},"GEO":{"country":"US","country_name":"United States","lat":38.0,"lon":-97.0},"first":1771772715.943934,"last":1771772717.4073164,"meta":{"build_db":"2025-10-14 12:06:54","db_source":"GeoOpen-Country-ASN"},"source":"ip.circl.lu","updated":1771772767.7438977}},"lasttime":1775152572.9101658}