{"Endpoints":{"http:18080":{"Firsttime":1769036766.5050068,"lasttime":1769209707.9373367,"paths":["/cm","/ca"],"port":"18080","protocol":"http","seen_in":[{"arch":"x86","beacon_ip":"8.130.191.106","beacon_port":"18080","config_hash":"66f24152c4e697c73b89a32bf85103981d1353d5033667a55b0917f1ea25c4b1","trial":false,"ts":1769209706.7484334,"version":"Cobalt Strike 4.7 (Aug 17, 2022)","watermark":391144938},{"arch":"x64","beacon_ip":"8.130.191.106","beacon_port":"18080","config_hash":"bd40a0da492a928b77f811f688d97316911103ea085f7625058b24cd4d548616","trial":false,"ts":1769209707.9373367,"version":"Cobalt Strike 4.7 (Aug 17, 2022)","watermark":391144938}],"submituris":["/submit.php"],"urls":["http://127.0.0.1:18080/cm/submit.php","http://127.0.0.1:18080/submit.php","http://127.0.0.1:18080/ca/submit.php"]},"http:6666":{"Firsttime":1766732857.3724566,"lasttime":1772745413.5776336,"paths":["/cx"],"port":"6666","protocol":"http","seen_in":[{"arch":"x64","beacon_ip":"47.120.70.161","beacon_port":"6666","config_hash":"8f0676a33dec637893713a63311f75ca3e5ecaab4d1646a19778920897eb4dd5","trial":false,"ts":1772745413.5776336,"version":"Cobalt Strike 4.8 (Feb 28, 2023)","watermark":987654321},{"arch":"x86","beacon_ip":"47.120.70.161","beacon_port":"6666","config_hash":"d3316b89cd9bd60cb0dd88eed35e9be5973115882ee2e46348d391d87539aefc","trial":false,"ts":1772745406.6134071,"version":"Cobalt Strike 4.8 (Feb 28, 2023)","watermark":987654321}],"submituris":["/submit.php"],"urls":["http://127.0.0.1:6666/cx/submit.php","http://127.0.0.1:6666/submit.php"]},"http:80":{"Firsttime":1767471118.199155,"lasttime":1767568328.8435545,"paths":["/gtag/js"],"port":"80","protocol":"http","seen_in":[{"arch":"x86","beacon_ip":"101.126.75.125","beacon_port":"80","config_hash":"e09e303f9b399aea937f1f4db747301715ff9f0787b1f379fcb8b4e06436621e","trial":false,"ts":1767568298.5590897,"version":"Cobalt Strike 4.8 (Feb 28, 2023)","watermark":987654321},{"arch":"x64","beacon_ip":"101.126.75.125","beacon_port":"80","config_hash":"c3311dabdf64d03ac1c4e8c42bf502db1f062c7aa4bd1dabe0817733176fbd3a","trial":false,"ts":1767568300.7797651,"version":"Cobalt Strike 4.8 (Feb 28, 2023)","watermark":987654321},{"arch":"x86","beacon_ip":"101.126.25.11","beacon_port":"80","config_hash":"e09e303f9b399aea937f1f4db747301715ff9f0787b1f379fcb8b4e06436621e","trial":false,"ts":1767568327.2440946,"version":"Cobalt Strike 4.8 (Feb 28, 2023)","watermark":987654321},{"arch":"x64","beacon_ip":"101.126.25.11","beacon_port":"80","config_hash":"c3311dabdf64d03ac1c4e8c42bf502db1f062c7aa4bd1dabe0817733176fbd3a","trial":false,"ts":1767568328.8435545,"version":"Cobalt Strike 4.8 (Feb 28, 2023)","watermark":987654321}],"submituris":["/analytics/collect","/measurement/collect"],"urls":["http://127.0.0.1:80/analytics/collect","http://127.0.0.1:80/gtag/js/analytics/collect","http://127.0.0.1:80/gtag/js/measurement/collect","http://127.0.0.1:80/measurement/collect"]},"http:8000":{"Firsttime":1778882738.9750443,"lasttime":1783606036.4760866,"paths":["/jquery-3.3.1.min.js","/Content/min.css","/extension/g43.css"],"port":"8000","protocol":"http","seen_in":[{"arch":"x86","beacon_ip":"47.236.91.172","beacon_port":"8000","config_hash":"25b486716de8f883aaae8eb0ad34b46e0c985782c2d4f14faa82bafd381600e3","trial":false,"ts":1778940330.6359491,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321},{"arch":"x64","beacon_ip":"47.236.91.172","beacon_port":"8000","config_hash":"dcc56062d1e711dfa7dadca73d775bcce1f519f328eec33c7377cc6c80cd2d14","trial":false,"ts":1778940332.85383,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321},{"arch":"x86","beacon_ip":"47.236.91.172","beacon_port":"8000","config_hash":"6774e5ea0e4a32661d125c40f0faf90c1d92b546b1ad861b1c0d966d459ed3bc","trial":false,"ts":1783606035.0179298,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321},{"arch":"x64","beacon_ip":"47.236.91.172","beacon_port":"8000","config_hash":"20bc29fc1732f7d7cfa67e2ebd92b3e0ba5c9393a6413076b8a0920cae3e4fe5","trial":false,"ts":1783606036.4760866,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321}],"submituris":["/jquery-3.3.2.min.js","/Bootstrap/styling-min.css","/laravel/hybrid.css"],"urls":["http://127.0.0.1:8000/jquery-3.3.1.min.js/jquery-3.3.2.min.js","http://127.0.0.1:8000/jquery-3.3.2.min.js","http://127.0.0.1:8000/Bootstrap/styling-min.css","http://127.0.0.1:8000/Content/min.css/Bootstrap/styling-min.css","http://127.0.0.1:8000/extension/g43.css/laravel/hybrid.css","http://127.0.0.1:8000/laravel/hybrid.css"]},"http:8080":{"Firsttime":1782943542.4646177,"lasttime":1785938768.53536,"paths":["/g.pixel","/pixel"],"port":"8080","protocol":"http","seen_in":[{"arch":"x86","beacon_ip":"82.157.78.201","beacon_port":"8080","config_hash":"db6c3022cd7516abfcca9439dfd56fdcef48a7480772fd5f27c850668edf1996","trial":false,"ts":1785938766.3009684,"version":"Cobalt Strike 4.5 (Dec 14, 2021)","watermark":100000},{"arch":"x64","beacon_ip":"82.157.78.201","beacon_port":"8080","config_hash":"11cf417b5568065c985ea520a52f75b6c17f836a70636e60f3122a0942b6e0ae","trial":false,"ts":1785938768.53536,"version":"Unknown","watermark":100000}],"submituris":["/submit.php"],"urls":["http://127.0.0.1:8080/g.pixel/submit.php","http://127.0.0.1:8080/submit.php","http://127.0.0.1:8080/pixel/submit.php"]},"http:8081":{"Firsttime":1780668305.4425707,"lasttime":1781446135.1566157,"paths":["/__utm.gif","/updates.rss"],"port":"8081","protocol":"http","seen_in":[{"arch":"x86","beacon_ip":"47.122.47.221","beacon_port":"8081","config_hash":"c14ce6e85044b04d46a2b77b4e549229c45c926722ef85f89f7289ba6045c639","trial":false,"ts":1781446132.5419455,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":666666666},{"arch":"x64","beacon_ip":"47.122.47.221","beacon_port":"8081","config_hash":"8782a4b5f27acf62f397806f642a43f3549aa2b799672a47164c92817a68f54c","trial":false,"ts":1781446135.1566157,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":666666666}],"submituris":["/submit.php"],"urls":["http://127.0.0.1:8081/__utm.gif/submit.php","http://127.0.0.1:8081/submit.php","http://127.0.0.1:8081/updates.rss/submit.php"]},"http:9999":{"Firsttime":1768287969.1647136,"lasttime":1768287970.7872345,"paths":["/ptj","/ga.js"],"port":"9999","protocol":"http","seen_in":[{"arch":"x86","beacon_ip":"47.93.141.98","beacon_port":"9999","config_hash":"cc9f9ebd0d5ad072898e8a9ccd63834070eb593a15324b20885873d6eca99a22","trial":false,"ts":1768287969.1647136,"version":"Cobalt Strike 4.8 (Feb 28, 2023)","watermark":987654321},{"arch":"x64","beacon_ip":"47.93.141.98","beacon_port":"9999","config_hash":"386f9d04db0d056629b7d10fc62f89604a104f2b93b177ace07eac799b6096b3","trial":false,"ts":1768287970.7872345,"version":"Cobalt Strike 4.8 (Feb 28, 2023)","watermark":987654321}],"submituris":["/submit.php"],"urls":["http://127.0.0.1:9999/ptj/submit.php","http://127.0.0.1:9999/submit.php","http://127.0.0.1:9999/ga.js/submit.php"]},"https:8080":{"Firsttime":1790863507.1458905,"lasttime":1790949999.7007952,"paths":["/load","/push"],"port":"8080","protocol":"https","seen_in":[{"arch":"x86","beacon_ip":"141.255.166.178","beacon_port":"8080","config_hash":"6b75a19ad1944e542a7a700731dd75390b7939b26329955aba0cc4f5be5e1146","trial":false,"ts":1790949999.4428325,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321},{"arch":"x64","beacon_ip":"141.255.166.178","beacon_port":"8080","config_hash":"f7a4b84888b9100bfdeb5142b74e3adbc75d43a8ee9ed05d6e8f4ceb19676a40","trial":false,"ts":1790949999.7007952,"version":"Cobalt Strike 4.9 (Sep 19, 2023)","watermark":987654321}],"submituris":["/submit.php"],"urls":["https://127.0.0.1:8080/load/submit.php","https://127.0.0.1:8080/submit.php","https://127.0.0.1:8080/push/submit.php"]}},"Firsttime":1766732857.3724566,"Host":"127.0.0.1","IP":"127.0.0.1","IPs":["127.0.0.1"],"Paths":["/cx","/gtag/js","/ptj","/ga.js","/cm","/ca","/jquery-3.3.1.min.js","/__utm.gif","/updates.rss","/Content/min.css","/extension/g43.css","/g.pixel","/pixel","/load","/push"],"Ports":["6666","80","9999","18080","8000","8081","8080"],"Protocols":["http","https"],"SubmitURIs":["/submit.php","/analytics/collect","/measurement/collect","/jquery-3.3.2.min.js","/Bootstrap/styling-min.css","/laravel/hybrid.css"],"URLs":["http://127.0.0.1:6666/cx/submit.php","http://127.0.0.1:6666/submit.php","http://127.0.0.1:80/analytics/collect","http://127.0.0.1:80/gtag/js/analytics/collect","http://127.0.0.1:80/gtag/js/measurement/collect","http://127.0.0.1:80/measurement/collect","http://127.0.0.1:9999/ptj/submit.php","http://127.0.0.1:9999/submit.php","http://127.0.0.1:9999/ga.js/submit.php","http://127.0.0.1:18080/cm/submit.php","http://127.0.0.1:18080/submit.php","http://127.0.0.1:18080/ca/submit.php","http://127.0.0.1:8000/jquery-3.3.1.min.js/jquery-3.3.2.min.js","http://127.0.0.1:8000/jquery-3.3.2.min.js","http://127.0.0.1:8081/__utm.gif/submit.php","http://127.0.0.1:8081/submit.php","http://127.0.0.1:8081/updates.rss/submit.php","http://127.0.0.1:8000/Bootstrap/styling-min.css","http://127.0.0.1:8000/Content/min.css/Bootstrap/styling-min.css","http://127.0.0.1:8000/extension/g43.css/laravel/hybrid.css","http://127.0.0.1:8000/laravel/hybrid.css","http://127.0.0.1:8080/g.pixel/submit.php","http://127.0.0.1:8080/submit.php","http://127.0.0.1:8080/pixel/submit.php","https://127.0.0.1:8080/load/submit.php","https://127.0.0.1:8080/submit.php","https://127.0.0.1:8080/push/submit.php"],"ip_enrichment":{"127.0.0.1":{"ASN":{"number":0,"org":"Not routed"},"GEO":{"country":"None","country_name":null,"lat":null,"lon":null},"first":1766732857.3724566,"last":1767453062.2156885,"meta":{"build_db":"2025-10-14 12:06:54","db_source":"GeoOpen-Country-ASN"},"source":"ip.circl.lu","updated":1767456638.9440777}},"lasttime":1790949999.7007952}