OTX-686e3088b20516568235f7ed
high
📛 Threat Title
Hak5 Cloud - C2 IP/Domain Tracker
Description
This pulse contains IOCs related to Hak5 Cloud Infrastructure. Additions are automatically added based on several sources like: OTX sandboxes samples, internal tools, through the use of Shodan or Censys queries, shared intel from LevelBlue partners or external feeds. Pulse contains 12 indicator(s) (IOCs). View on OTX to inspect.
Indicators of Compromise (40)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
ipv4
209.145.50.30
IOC database
- Type
- ipv4
- Value
209.145.50.30- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
186.105.23.178
VT 0 / 91
IOC database
- Type
- ipv4
- Value
186.105.23.178- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
Basic Properties
| Network | 186.104.0.0/14 |
| Country | CL |
| AS owner | TELEFONICA CHILE S.A. |
| ASN | 7418 |
| Regional registry | LACNIC |
History
| Last modified on VirusTotal | 2021-06-02 10:54 UTC |
| WHOIS record date | 2021-06-02 10:54 UTC |
ipv4
198.58.195.98
VT 2 / 91
IOC database
- Type
- ipv4
- Value
198.58.195.98- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 2 of 91 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| AlphaSOC | malicious | malware |
| Cluster25 | malicious | malicious |
Details From VirusTotal
Basic Properties
| Network | 198.58.128.0/17 |
| Country | CA |
| AS owner | EBOX |
| ASN | 1403 |
| Regional registry | ARIN |
History
| Last analysis | 2026-07-24 20:36 UTC |
| Last modified on VirusTotal | 2026-07-24 20:36 UTC |
| WHOIS record date | 2026-07-12 05:49 UTC |
ipv4
217.154.11.108
VT 1 / 91
IOC database
- Type
- ipv4
- Value
217.154.11.108- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 1 of 91 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| Cluster25 | malicious | malicious |
Details From VirusTotal
Basic Properties
| Network | 217.154.8.0/22 |
| Country | FR |
| AS owner | IONOS SE |
| ASN | 8560 |
| Regional registry | RIPE NCC |
History
| Last analysis | 2026-07-22 21:39 UTC |
| Last modified on VirusTotal | 2026-07-22 21:40 UTC |
| WHOIS record date | 2026-07-03 12:14 UTC |
ipv4
85.215.197.9
VT 0 / 91
IOC database
- Type
- ipv4
- Value
85.215.197.9- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
Basic Properties
| Network | 85.215.192.0/19 |
| Country | DE |
| AS owner | IONOS SE |
| ASN | 8560 |
| Regional registry | RIPE NCC |
History
| Last analysis | 2026-07-20 20:05 UTC |
| Last modified on VirusTotal | 2026-07-20 20:11 UTC |
| WHOIS record date | 2026-07-19 17:45 UTC |
ipv4
64.201.116.97
IOC database
- Type
- ipv4
- Value
64.201.116.97- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
178.128.185.61
IOC database
- Type
- ipv4
- Value
178.128.185.61- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
185.213.27.138
IOC database
- Type
- ipv4
- Value
185.213.27.138- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
147.182.241.212
IOC database
- Type
- ipv4
- Value
147.182.241.212- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
91.239.118.157
IOC database
- Type
- ipv4
- Value
91.239.118.157- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
107.172.243.124
IOC database
- Type
- ipv4
- Value
107.172.243.124- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
78.17.71.164
IOC database
- Type
- ipv4
- Value
78.17.71.164- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
37.97.208.234
IOC database
- Type
- ipv4
- Value
37.97.208.234- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
139.59.250.147
IOC database
- Type
- ipv4
- Value
139.59.250.147- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
64.201.116.163
IOC database
- Type
- ipv4
- Value
64.201.116.163- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
157.230.176.57
IOC database
- Type
- ipv4
- Value
157.230.176.57- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
67.217.245.71
IOC database
- Type
- ipv4
- Value
67.217.245.71- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
45.79.252.167
IOC database
- Type
- ipv4
- Value
45.79.252.167- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
45.55.87.77
IOC database
- Type
- ipv4
- Value
45.55.87.77- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
140.238.168.101
IOC database
- Type
- ipv4
- Value
140.238.168.101- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
152.254.155.35
IOC database
- Type
- ipv4
- Value
152.254.155.35- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
217.154.160.119
IOC database
- Type
- ipv4
- Value
217.154.160.119- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
67.176.72.155
IOC database
- Type
- ipv4
- Value
67.176.72.155- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
95.179.135.253
IOC database
- Type
- ipv4
- Value
95.179.135.253- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
157.230.48.240
IOC database
- Type
- ipv4
- Value
157.230.48.240- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
139.99.171.5
IOC database
- Type
- ipv4
- Value
139.99.171.5- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
59.152.125.24
IOC database
- Type
- ipv4
- Value
59.152.125.24- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
157.173.198.174
IOC database
- Type
- ipv4
- Value
157.173.198.174- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
51.91.110.244
IOC database
- Type
- ipv4
- Value
51.91.110.244- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
51.195.102.205
IOC database
- Type
- ipv4
- Value
51.195.102.205- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
82.118.20.170
IOC database
- Type
- ipv4
- Value
82.118.20.170- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
46.124.99.248
IOC database
- Type
- ipv4
- Value
46.124.99.248- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
46.124.108.243
IOC database
- Type
- ipv4
- Value
46.124.108.243- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
37.27.13.155
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/37.27.13.155
IOC database
- Type
- ipv4
- Value
37.27.13.155- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/37.27.13.155
ipv4
76.131.47.120
IOC database
- Type
- ipv4
- Value
76.131.47.120- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
82.165.184.142
IOC database
- Type
- ipv4
- Value
82.165.184.142- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
104.163.167.187
IOC database
- Type
- ipv4
- Value
104.163.167.187- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
82.208.22.216
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/82.208.22.216
IOC database
- Type
- ipv4
- Value
82.208.22.216- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/82.208.22.216
ipv4
45.33.81.150
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/45.33.81.150
IOC database
- Type
- ipv4
- Value
45.33.81.150- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/45.33.81.150
ipv4
43.133.13.81
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/43.133.13.81
IOC database
- Type
- ipv4
- Value
43.133.13.81- First seen
- Last seen
- Attached to this threat
- Appears in
- 3 threats
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/43.133.13.81
References (1)
-
OTX pulse
AlienVaulkt OTX
This pulse contains IOCs related to Hak5 Cloud Infrastructure. Additions are automatically added based on several sources like: OTX sandboxes samples, internal tools, through the use of Shodan or Censys queries, shared intel from LevelBlue partners or external feeds.
Remediations (8)
-
web:bobmckay.com
Scroll down to IPv6 networking and either disable it or configure the same ports as for IPv4 (depends on if you plan to setup DNS address for IPv6 for your domain name). Setup your Domain Name Point your domain name at the Public IP address for your instance (the Static IP provided if you created one). Configuring the Cloud C2 AWS Server Update the OS Update your instance by running the ...
-
web:cyberarsenal.org
Hello everyone, today I want to share an analysis of the Hak5 Cloud C2 tool. What's Hak5 Cloud C2 ? As stated on their website: SHIP HAK5 GEAR. GET ON-SITE RESULTS. PENTEST ANYWHERE, RIGHT FROM THE WEB Cloud C² makes it easy for pentesters and security teams to deploy and manage Hak5 gear...
-
web:docs.hak5.org
Cloud C² makes it easy for pen testers and IT security teams to deploy and manage fleets of Hak5 gear from a simple cloud dashboard. Getting Started link Cloud C² Basics Licensing and Downloads Installation and Setup
-
web:github.com
Automatically created C2 Feeds. Contribute to drb-ra/C2IntelFeeds development by creating an account on GitHub.
-
web:hunt.io
Hak5 Cloud C² is a self-hosted command and control ( C2 ) platform from Hak5 to manage your devices from a single cloud interface. While designed for penetration testers and IT security teams, its power has been misused by malicious actors to get persistent access to compromised systems.
-
web:subproject9.com
Securely deploy the Hak5 C2 server in Google Cloud to control all your deployed Hak5 devices remotely.
-
web:wiki.elvis.science
Cloud C² is a software developed by Hak5 that gives us a remote connection with Hak5 products like Shark Jack. After this short installation guide, you will be able to connect your devices to your own Cloud C² instance.
-
web:www.microsoft.com
Customers can also refer to our Tech community blog post for guidance on validating functionality and more information on C2 detection and remediation . In addition to enabling network protection C2 blocking, it's recommended to follow the general best practices to defend your network against human-operated ransomware attacks.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Reputation of linked indicators
DomScan scores the domains, AbuseIPDB + GreyNoise score the IPs. Verdicts are per-indicator — this is a roll-up, so no lookup is triggered by opening this page.