Brute Ratel C4 Detected - 2[.]37[.]211[.]140:9002

The Information provided at the time of posting was detected as “Brute Ratel C4”. Depending on when you are viewing this article, it may no longer be the case and could be determined as being a false positive. Please do your own additional validation. – RedPacket Security

TimeStamp 2025-01-01T19:09:37.634548

Cloud Information

Provider
Region
Service
ASN	AS30722

Domain Information

Domains

dyndns.tv

HTTP Information

Redirects
Headers Hash	-915182599
Host	2[.]37[.]211[.]140
HTML	404 file not found
HTML Hash	-1957161625
Location	/
Robots	N/A
Robots Hash	N/A
Security TXT	N/A
Security TXT Hash	N/A
Server	N/A
Sitemap	N/A
Sitemap hash	N/A
Status	404
Title	N/A

Location Information

Area Code	N/A
City	Mestre
Country Code	IT
Country Name	Italy
Latitude	45.49167
Longitude	12.24538
Region Code	34

SSL Information

Cert Fingerprint SHA1	d65b5c6e61b5c10148fb97971bc659f8249b86c3
Cert Fingerprint SHA256	e5e78e03c3a09836b973bbb7011100af7cab8a38bd82dfd8cf46003dc4d20f74
Issuer	Let’s Encrypt
Subject CN	francodp.dyndns.tv
Expired	N/A
Cipher	TLS_AES_256_GCM_SHA384
Version

Tag Information

Tags	c2
Tags
Tags	N/A
Tags	N/A

Host Information

OS	N/A
Transport	tcp
Data	HTTP/1.1 404 Not Found X-Powered-By: Express Content-Type: text/html Date: Wed, 01 Jan 2025 19:08:36 GMT Connection: keep-alive Keep-Alive: timeout=5 Transfer-Encoding: chunked
Port	9002
IP	2[.]37[.]211[.]140

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below

Buy Me A Coffee

Patreon

To keep up to date follow us on the below channels.

Tags: Brute Ratel C4, OSINT, threatintel

Brute Ratel C4 Detected – 2[.]37[.]211[.]140:9002

Cloud Information

Domain Information

HTTP Information

Location Information

SSL Information

Tag Information

Host Information

Cobalt Strike Beacon Detected – 123[.]60[.]183[.]172:8088

Cobalt Strike Beacon Detected – 43[.]133[.]36[.]25:8088

Cobalt Strike Beacon Detected – 47[.]115[.]230[.]159:8088

Cobalt Strike Beacon Detected – 38[.]207[.]177[.]216:8443

Cobalt Strike Beacon Detected – 123[.]57[.]230[.]183:8891

Cloud Information

Domain Information

HTTP Information

Location Information

SSL Information

Tag Information

Host Information

You may have missed

Cobalt Strike Beacon Detected – 123[.]60[.]183[.]172:8088

Cobalt Strike Beacon Detected – 43[.]133[.]36[.]25:8088

Cobalt Strike Beacon Detected – 47[.]115[.]230[.]159:8088

Cobalt Strike Beacon Detected – 38[.]207[.]177[.]216:8443

Cobalt Strike Beacon Detected – 123[.]57[.]230[.]183:8891