{"Endpoints":{"http:9999":{"Firsttime":1766704280.9201412,"lasttime":1776780391.0411804,"paths":["/j.ad","/activity","/ga.js","/dot.gif","/en_US/all.js","/ca","/IE9CompatViewList.xml","/cm","/pixel","/__utm.gif"],"port":"9999","protocol":"http","seen_in":[{"arch":"x64","beacon_ip":"150.187.25.242","beacon_port":"9999","config_hash":"28ef0d2000d585a4cf1146b76dfcdbfe74e20332b81f9a4e4fc2a838886c8883","trial":false,"ts":1768403497.1787262,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321},{"arch":"x86","beacon_ip":"150.187.25.242","beacon_port":"9999","config_hash":"d02ce04c48fce1e9fa4947cfff42809fe6bcf076d61cde3fee916517b3be7501","trial":false,"ts":1768403492.313913,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321},{"arch":"x86","beacon_ip":"150.187.25.242","beacon_port":"9999","config_hash":"ddf6deb87901c1c3dcb37fb9117621eb3eb383d5e2ada09f520d39087f51d4a3","trial":false,"ts":1771686376.5501337,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321},{"arch":"x64","beacon_ip":"150.187.25.242","beacon_port":"9999","config_hash":"866bef0abb4a8478e174abbe85f3a413c7ed728404f745ac9b01ac43d352b68c","trial":false,"ts":1771686379.035728,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321},{"arch":"x86","beacon_ip":"150.187.25.242","beacon_port":"9999","config_hash":"6c83c0f0abf66fc0bbd902e1471b9db2c31109c45d8fc630cb72e7f098073c3b","trial":false,"ts":1774101213.720397,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321},{"arch":"x64","beacon_ip":"150.187.25.242","beacon_port":"9999","config_hash":"cce9cb20f4086ccd0f5348b0e9377d066105de83cf00a4b509d71a86d97efa1e","trial":false,"ts":1774101215.592347,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321},{"arch":"x86","beacon_ip":"150.187.25.242","beacon_port":"9999","config_hash":"5b2dc399c9cdf61903dd83b451a914df79138fedcf6b6c46d8daa3f09e8c110b","trial":false,"ts":1774537555.205787,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321},{"arch":"x64","beacon_ip":"150.187.25.242","beacon_port":"9999","config_hash":"b026f3042486f4d0e3c4d5e1abb2c3bf223605de1647eaea355d609e006bd926","trial":false,"ts":1774537566.700678,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321},{"arch":"x86","beacon_ip":"150.187.25.242","beacon_port":"9999","config_hash":"54529576879eb1ff0c189e1d31a1add7848f143e7ed0127d5d617f8b5b16ab84","trial":false,"ts":1775829921.2908418,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321},{"arch":"x64","beacon_ip":"150.187.25.242","beacon_port":"9999","config_hash":"8c4358d6b371514ef6bb727aad00097c3f90174a357b929e82de2eb66ae985b2","trial":false,"ts":1775829923.3385835,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321},{"arch":"x86","beacon_ip":"150.187.25.242","beacon_port":"9999","config_hash":"cf3847bf11d409684fc34aebdfd7a679e106cfe866b1e6f2bc6cea31f9b8240d","trial":false,"ts":1776780388.9939892,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321},{"arch":"x64","beacon_ip":"150.187.25.242","beacon_port":"9999","config_hash":"0d9813e3ccd8c0a547c091629e044602c91717b2e27e4d006809590149cd5038","trial":false,"ts":1776780391.0411804,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321}],"submituris":["/submit.php"],"urls":["http://116.203.31.207:9999/j.ad/submit.php","http://116.203.31.207:9999/submit.php","http://116.203.31.207:9999/activity/submit.php","http://116.203.31.207:9999/ga.js/submit.php","http://116.203.31.207:9999/dot.gif/submit.php","http://116.203.31.207:9999/en_US/all.js/submit.php","http://116.203.31.207:9999/ca/submit.php","http://116.203.31.207:9999/IE9CompatViewList.xml/submit.php","http://116.203.31.207:9999/cm/submit.php","http://116.203.31.207:9999/pixel/submit.php","http://116.203.31.207:9999/__utm.gif/submit.php"]}},"Firsttime":1766704280.9201412,"Host":"116.203.31.207","IP":"116.203.31.207","IPs":["116.203.31.207"],"Paths":["/j.ad","/activity","/ga.js","/dot.gif","/en_US/all.js","/ca","/IE9CompatViewList.xml","/cm","/pixel","/__utm.gif"],"Ports":["9999"],"Protocols":["http"],"SubmitURIs":["/submit.php"],"URLs":["http://116.203.31.207:9999/j.ad/submit.php","http://116.203.31.207:9999/submit.php","http://116.203.31.207:9999/activity/submit.php","http://116.203.31.207:9999/ga.js/submit.php","http://116.203.31.207:9999/dot.gif/submit.php","http://116.203.31.207:9999/en_US/all.js/submit.php","http://116.203.31.207:9999/ca/submit.php","http://116.203.31.207:9999/IE9CompatViewList.xml/submit.php","http://116.203.31.207:9999/cm/submit.php","http://116.203.31.207:9999/pixel/submit.php","http://116.203.31.207:9999/__utm.gif/submit.php"],"ip_enrichment":{"116.203.31.207":{"ASN":{"number":24940,"org":"HETZNER-AS"},"GEO":{"country":"DE","country_name":"Germany","lat":51.0,"lon":9.0},"first":1766704280.9201412,"last":1767423995.5879605,"meta":{"build_db":"2025-10-14 12:06:54","db_source":"GeoOpen-Country-ASN"},"source":"ip.circl.lu","updated":1767456638.717362}},"lasttime":1776780391.0411804}