C2

Key: 121.4.92.72 · Resolved IP: 121.4.92.72
Protocols: http · Ports: 5000, 1111
First view: 2026-01-22 08:05:12 CET · Last view: 2026-03-10 16:07:06 CET

Endpoints

ID	Protocole	Port	First view	Last view	SubmitURIs	Paths	URLs	Seen in
http:1111	http	1111	2026-01-31 00:07:05 CET	2026-03-05 22:56:54 CET	/submit.php	/IE9CompatViewList.xml	2 Sample http://121.4.92.72:1111/IE9CompatViewList.xml/submit.php http://121.4.92.72:1111/submit.php	2 hashes 06fc7a55decea42239a42b893f02393e025df2fc8a0ce7b9e029bd79b761e183 6769d74299a8a3193d4e3e7542367afd7a18c9752e7f2c4ec9282aade8a64046
http:5000	http	5000	2026-01-22 08:05:12 CET	2026-03-10 16:07:06 CET	/submit.php	/dot.gif, /match	3 Sample http://121.4.92.72:5000/dot.gif/submit.php http://121.4.92.72:5000/submit.php http://121.4.92.72:5000/match/submit.php	2 hashes 46c141904eeee1c9e6b9f971e9d007cb34b1902caea05673486a8d8bc53c8d28 bb85d1588efc2a445dee4a2e11315bf0071499321d003c22910f750bad9099db

{
  "Endpoints": {
    "http:1111": {
      "Firsttime": 1769814425.843273,
      "lasttime": 1772747814.1433566,
      "paths": [
        "/IE9CompatViewList.xml"
      ],
      "port": "1111",
      "protocol": "http",
      "seen_in": [
        {
          "arch": "x86",
          "beacon_ip": "121.4.92.72",
          "beacon_port": "1111",
          "config_hash": "06fc7a55decea42239a42b893f02393e025df2fc8a0ce7b9e029bd79b761e183",
          "trial": false,
          "ts": 1772747809.761652,
          "version": "Cobalt Strike 4.8 (Feb 28, 2023)",
          "watermark": 987654321
        },
        {
          "arch": "x64",
          "beacon_ip": "121.4.92.72",
          "beacon_port": "1111",
          "config_hash": "6769d74299a8a3193d4e3e7542367afd7a18c9752e7f2c4ec9282aade8a64046",
          "trial": false,
          "ts": 1772747814.1433566,
          "version": "Cobalt Strike 4.8 (Feb 28, 2023)",
          "watermark": 987654321
        }
      ],
      "submituris": [
        "/submit.php"
      ],
      "urls": [
        "http://121.4.92.72:1111/IE9CompatViewList.xml/submit.php",
        "http://121.4.92.72:1111/submit.php"
      ]
    },
    "http:5000": {
      "Firsttime": 1769065512.3573089,
      "lasttime": 1773155226.7452826,
      "paths": [
        "/dot.gif",
        "/match"
      ],
      "port": "5000",
      "protocol": "http",
      "seen_in": [
        {
          "arch": "x86",
          "beacon_ip": "121.4.92.72",
          "beacon_port": "5000",
          "config_hash": "46c141904eeee1c9e6b9f971e9d007cb34b1902caea05673486a8d8bc53c8d28",
          "trial": false,
          "ts": 1773155224.6623945,
          "version": "Cobalt Strike 4.8 (Feb 28, 2023)",
          "watermark": 987654321
        },
        {
          "arch": "x64",
          "beacon_ip": "121.4.92.72",
          "beacon_port": "5000",
          "config_hash": "bb85d1588efc2a445dee4a2e11315bf0071499321d003c22910f750bad9099db",
          "trial": false,
          "ts": 1773155226.7452826,
          "version": "Cobalt Strike 4.8 (Feb 28, 2023)",
          "watermark": 987654321
        }
      ],
      "submituris": [
        "/submit.php"
      ],
      "urls": [
        "http://121.4.92.72:5000/dot.gif/submit.php",
        "http://121.4.92.72:5000/submit.php",
        "http://121.4.92.72:5000/match/submit.php"
      ]
    }
  },
  "Firsttime": 1769065512.3573089,
  "Host": "121.4.92.72",
  "IP": "121.4.92.72",
  "IPs": [
    "121.4.92.72"
  ],
  "Paths": [
    "/dot.gif",
    "/match",
    "/IE9CompatViewList.xml"
  ],
  "Ports": [
    "5000",
    "1111"
  ],
  "Protocols": [
    "http"
  ],
  "SubmitURIs": [
    "/submit.php"
  ],
  "URLs": [
    "http://121.4.92.72:5000/dot.gif/submit.php",
    "http://121.4.92.72:5000/submit.php",
    "http://121.4.92.72:5000/match/submit.php",
    "http://121.4.92.72:1111/IE9CompatViewList.xml/submit.php",
    "http://121.4.92.72:1111/submit.php"
  ],
  "ip_enrichment": {
    "121.4.92.72": {
      "ASN": {
        "number": 45090,
        "org": "TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited"
      },
      "GEO": {
        "country": "CN",
        "country_name": "China",
        "lat": 35.0,
        "lon": 105.0
      },
      "first": 1769065512.3573089,
      "last": 1769065520.2098145,
      "meta": {
        "build_db": "2025-10-14 12:06:54",
        "db_source": "GeoOpen-Country-ASN"
      },
      "source": "ip.circl.lu",
      "updated": 1769066080.1578653
    }
  },
  "lasttime": 1773155226.7452826
}