Brute Ratel C4 Detected – 213[.]199[.]35[.]149:443

The Information provided at the time of posting was detected as “Brute Ratel C4”. Depending on when you are viewing this article, it may no longer be the case and could be determined as being a false positive. Please do your own additional validation. – RedPacket Security

TimeStamp 2024-05-01T05:25:31.048106

Cloud Information

Provider
Region
Service
ASN	AS51167

Domain Information

Domains

prox-ima.it

HTTP Information

Redirects
Headers Hash	-723384840
Host	213[.]199[.]35[.]149
HTML	404 file not found
HTML Hash	-1957161625
Location	/
Robots	N/A
Robots Hash	N/A
Security TXT	N/A
Security TXT Hash	N/A
Server	nginx/1.18.0 (Ubuntu)
Sitemap	N/A
Sitemap hash	N/A
Status	200
Title	N/A

Location Information

Area Code	N/A
City	Düsseldorf
Country Code	DE
Country Name	Germany
Latitude	51.22172
Longitude	6.77616
Region Code	NW

SSL Information

Cert Fingerprint SHA1	15fe010a96bd049a7bebcb74f1ef098378cd4605
Cert Fingerprint SHA256	c5087f6eac850a32513e163a2494648fbe3fcdd82d57c5443969b724c7eb9b4a
Issuer	Let’s Encrypt
Subject CN	www.prox-ima.it
Expired	N/A
Cipher	TLS_AES_256_GCM_SHA384
Version

Tag Information

Tags	c2
Tags
Tags	N/A
Tags	N/A

Host Information

OS	Ubuntu
Transport	tcp
Data	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 01 May 2024 05:25:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive
Port	443
IP	213[.]199[.]35[.]149