Brute Ratel C4 Detected - 211[.]76[.]170[.]240:443

The Information provided at the time of posting was detected as “Brute Ratel C4”. Depending on when you are viewing this article, it may no longer be the case and could be determined as being a false positive. Please do your own additional validation. – RedPacket Security

TimeStamp 2024-01-08T12:37:41.776671

Cloud Information

Provider
Region
Service
ASN	AS18181

Domain Information

Domains

nhri.edu.tw

HTTP Information

Redirects	[object Object]
Headers Hash	-7868837
Host	tamtp[.]nhri[.]edu[.]tw
HTML	404 file not found
HTML Hash	-1957161625
Location	/
Robots	N/A
Robots Hash	N/A
Security TXT	N/A
Security TXT Hash	N/A
Server	N/A
Sitemap	N/A
Sitemap hash	N/A
Status	403
Title	N/A

Location Information

Area Code	N/A
City	Taipei
Country Code	TW
Country Name	Taiwan
Latitude	25.04776
Longitude	121.53185
Region Code	04

SSL Information

Cert Fingerprint SHA1	8bf0e69baa422d402d693bd1229794ffc75aed25
Cert Fingerprint SHA256	4bb39efba37795c2815f9e341433d54bf4f0df6fb5471e38bae938706e3efb58
Issuer	TAIWAN-CA
Subject CN	*.nhri.edu.tw
Expired	N/A
Cipher	ECDHE-RSA-AES128-GCM-SHA256
Version

Tag Information

Tags	c2
Tags
Tags	N/A
Tags	N/A

Host Information

OS	N/A
Transport	tcp
Data	HTTP/1.1 403 Forbidden Date: Mon, 08 Jan 2024 12:37:43 GMT Content-Length: 18 Content-Type: text/html; charset=iso-8859-1
Port	443
IP	211[.]76[.]170[.]240

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below

Buy Me A Coffee

Patreon

To keep up to date follow us on the below channels.

Tags: Brute Ratel C4, OSINT, threatintel

Brute Ratel C4 Detected – 211[.]76[.]170[.]240:443

Cloud Information

Domain Information

HTTP Information

Location Information

SSL Information

Tag Information

Host Information

[MEDUSA] – Ransomware Victim: Albion College

[FUNKSEC] – Ransomware Victim: 10M israeli data for sell

[FUNKSEC] – Ransomware Victim: asiapacfish[.]org

[FOG] – Ransomware Victim: Gallade Chemical (galladechem[.]com)

[AKIRA] – Ransomware Victim: Billet Precision

Cloud Information

Domain Information

HTTP Information

Location Information

SSL Information

Tag Information

Host Information

You may have missed

[MEDUSA] – Ransomware Victim: Albion College

[FUNKSEC] – Ransomware Victim: 10M israeli data for sell

[FUNKSEC] – Ransomware Victim: asiapacfish[.]org

[FOG] – Ransomware Victim: Gallade Chemical (galladechem[.]com)

[AKIRA] – Ransomware Victim: Billet Precision