Domain > blog.cobaltstrike.com

This indicator is referenced in AlienVault OTX pulse ""

Reports

https://foxitsecurity.files.wordpress.com/2016/06/...

https://github.com/fox-it/mofang

https://foxitsecurity.files.wordpress.com/2016/06/...

Whois

Property	Value
Email	MBTGQYKCP@WHOISPRIVACYPROTECT.COM
NameServer	MAX.NS.CLOUDFLARE.COM
Created	2012-01-22 00:00:00
Changed	2016-01-15 00:00:00
Expires	2017-01-22 00:00:00
Registrar	ENOM, INC.

DNS Resolutions

Date	IP Address
2014-07-01	108.162.199.182 (ClassC)
2014-07-02	108.162.198.182 (ClassC)
2014-08-07	104.28.0.4 (ClassC)
2014-08-09	104.28.1.4 (ClassC)
2014-09-21	199.27.134.65 (ClassC)
2014-09-21	199.27.135.65 (ClassC)
2019-10-04	192.0.78.12 (ClassC)
2019-10-08	192.0.78.13 (ClassC)
2022-11-10	104.18.15.56 (ClassC)
2025-10-28	104.18.3.157 (ClassC)
2025-11-22	104.18.2.157 (ClassC)

HTTP/1.1 200 OKServer: nginxDate: Fri, 14 Jun 2019 07:26:45 GMTContent-Type: text/html; charsetUTF-8Transfer-Encoding: chunkedConnection: keep-aliveStrict-Transport-Security: max-age86400Vary: Accept-

!DOCTYPE html PUBLIC -//W3C//DTD XHTML 1.0 Transitional//EN http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd>html xmlnshttp://www.w3.org/1999/xhtml langen>head profilehttp://gmpg.org/xfn/11>	meta http-equivContent-Type contenttext/html; charsetUTF-8 />	title>Strategic Cyber LLC | A blog about Armitage, Cobalt Strike, and Red Teaming/title>	link relpingback hrefhttps://blog.cobaltstrike.com/xmlrpc.php />	!-- Async WordPress.com Remote Login -->script idwpcom_remote_login_js>var wpcom_remote_login_extra_auth  ;function wpcom_remote_login_remove_dom_node_id( element_id ) {	var dom_node  document.getElementById( element_id );	if ( dom_node ) { dom_node.remove(); }}function wpcom_remote_login_remove_dom_node_classes( class_name ) {	var dom_nodes  document.querySelectorAll( . + class_name );	for ( var i  0; i  dom_nodes.length; i++ ) {		dom_nodesi.remove();	}}function wpcom_remote_login_final_cleanup() {	wpcom_remote_login_remove_dom_node_classes( wpcom_remote_login_msg );	wpcom_remote_login_remove_dom_node_id( wpcom_remote_login_key );	wpcom_remote_login_remove_dom_node_id( wpcom_remote_login_validate );	wpcom_remote_login_remove_dom_node_id( wpcom_remote_login_js );	wpcom_remote_login_remove_dom_node_id( wpcom_request_access_iframe );	wpcom_remote_login_remove_dom_node_id( wpcom_request_access_styles );}// Watch for messages back from the remote loginwindow.addEventListener( message, function( e ) {	if ( e.origin  https://r-login.wordpress.com ) {		var data  {};		try {			data  JSON.parse( e.data );		} catch( e ) {			wpcom_remote_login_final_cleanup();			return;		}		if ( data.msg  LOGIN ) {			// Clean up the login check iframe			wpcom_remote_login_remove_dom_node_id( wpcom_remote_login_key );			var id_regex  new RegExp( /^0-9+$/ );			var token_regex  new RegExp( /^.*|.*|.*$/ );			if (				token_regex.test( data.token )				&& id_regex.test( data.wpcomid )			) {				// We have everything we need to ask for a login				var script  document.createElement( script );				script.setAttribute( id, wpcom_remote_login_valida

Subdomains

Date	Domain	IP
blog2.cobaltstrike.com	2025-05-21	104.18.2.157
blog.cobaltstrike.com	2014-07-02	108.162.198.182

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]

Domain > blog.cobaltstrike.com

Is this malicious?

Reports

Whois

DNS Resolutions

Port 80

Port 443

Subdomains