https://github.com/fox-it/cobaltstrike-extraneous-space

Historical list of {Cobalt Strike,NanoHTTPD} servers
https://github.com/fox-it/cobaltstrike-extraneous-space

cobaltstrike iocs nanohttpd teamserver

Last synced: about 2 months ago
JSON representation

Historical list of {Cobalt Strike,NanoHTTPD} servers

• Host: GitHub
• URL: https://github.com/fox-it/cobaltstrike-extraneous-space
• Owner: fox-it
• Created: 2019-02-26T12:23:03.000Z (over 5 years ago)
• Default Branch: master
• Last Pushed: 2019-04-30T09:08:50.000Z (over 5 years ago)
• Last Synced: 2024-04-06T07:35:06.748Z (6 months ago)
• Topics: cobaltstrike, iocs, nanohttpd, teamserver
• Homepage: https://blog.fox-it.com/2019/02/26/identifying-cobalt-strike-team-servers-in-the-wild/
• Size: 195 KB
• Stars: 124
• Watchers: 13
• Forks: 48
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-security-collection - **102**星

README

        
# Historical list of {Cobalt Strike,NanoHTTPD} servers

This repository contains a historical list of Cobalt Strike (or NanoHTTPD) hosts that have been identified using the "extraneous space" fingerprint.

Read more about this technique in the following blog post:

 * https://blog.fox-it.com/2019/02/26/identifying-cobalt-strike-team-servers-in-the-wild/

The list is a CSV file with `ip, port, first_seen, last_seen` pairs, starting from 2014-01 till 2019-04-21 and can be found here:

 * [cobaltstrike-servers.csv](cobaltstrike-servers.csv) ([raw link](https://raw.githubusercontent.com/fox-it/cobaltstrike-extraneous-space/master/cobaltstrike-servers.csv))

The data is derived from Rapid7 Labs OpenData sets which has a historical archive of HTTP and HTTPS scan data: https://opendata.rapid7.com