{
	"id": "693fd89f-a126-4e48-861e-306e521fb83b",
	"created_at": "2026-10-25T02:58:47.135884Z",
	"updated_at": "2026-10-25T03:02:11.52598Z",
	"deleted_at": null,
	"sha1_hash": "125e89f8ce983a97af4de802c0377fc46c4aaa55",
	"title": "360网络空间测绘 — 因为看见，所以安全",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 2701040,
	"plain_text": "https://quake.360.cn/quake/#/reportDetail?id=5fc6fedd191038c3b25c4950\n\n360网络空间测绘 — 因为看见，所以安全\n\nArchived: 2026-10-25 02:42:39 UTC\n\n0x01 Preface\n\nAnalysis and discovery of cyberspace mapping data has always been a core objective of the Quake team.\n\nRecently, we noticed that some foreign security researchers have published a Cobalt Strike Beacon scanning tool\n\non github, which can extract the configuration information of the Beacon. With the concerted efforts of our Quake\n\nteammates, this feature was integrated into the Quake system, and after a short period of time the scanning was\n\nquite effective.\n\nIn the following we will explain in detail how Beacon Staging Server scanning works.\n\n0x02 What is a Beacon?\n\nThose of you who work in penetration testing, red team attack and defence will be familiar with this concept, but\n\nwe'll just use here an introduction from an article by the Gcow security team.\n\nBeacon is Cobalt Strike's payload running on the target host, Beacon is a service we provide on a covert\n\nchannel for long-term control of infected hosts.\n\nIt works in a similar way to the Metasploit Framework Payload. During the actual infiltration process we can\n\nembed it into an executable file, add it to a Word document or deliver Beacon by exploiting a host\n\nvulnerability.\n\nPage 1 of 12\n\nhttps://quake.360.cn/quake/#/reportDetail?id=5fc6fedd191038c3b25c4950\n\nA picture is worth a thousand words, and in this case it was the Beacon Listener in the team server that we\n\ndiscovered through active mapping.\n\n0x03 Beacon Staging Server\n\nThe purpose of the Beacon Staging Server is to prevent the payload from becoming too large or to adapt to\n\ndifferent attack scenarios by delivering the payload in stages.\n\nFirst by delivering a small payload called a stager, then by going to the Beacon staging server to download the\n\nlarger and more complex stage, and the URL to access the stage is verified by checksum8.\n\nWhen the staging server, which stores the Beacon configuration and payload, is exposed to the public web, it can\n\nbe discovered by means of active mapping.\n\nUnfortunately, access to the service is by default a disguised 404 page. This also results in various scanners, spatial\n\nmapping systems, threat intelligence platforms etc. not being able to make effective judgements based on page\n\nresponse information.\n\nPage 2 of 12\n\nhttps://quake.360.cn/quake/#/reportDetail?id=5fc6fedd191038c3b25c4950\n\nIf not specifically identified by a scan, a Beacon Staging Server should only return the information in the red box\n\nin the diagram below.\n\nIn order to get a specific Stage, it is necessary to know the URL generation algorithm. The algorithm is derived\n\nfrom publicly available NSE scripts, we use the following script for the generation of the check digits and can\n\ngenerate the check digits for a 32-bit or 64-bit payload depending on the input.\n\nPage 3 of 12\n\nhttps://quake.360.cn/quake/#/reportDetail?id=5fc6fedd191038c3b25c4950\n\nBy splicing the check digits to the URL, we can download directly to the Beacon's stage file, instead of a 404\n\npage.\n\n0x04 Resolving Beacon configurations\n\nAfter a successful download from the Beacon staging server to the stage, we need to parse it, and JPCERT\n\nreleased a Volatility plugin cobaltstrikescan in 2018 to parse the Beacon configuration and payload.\n\nPage 4 of 12\n\nhttps://quake.360.cn/quake/#/reportDetail?id=5fc6fedd191038c3b25c4950\n\n0x05 Quake Active Mapping\n\nHaving clarified how the Beacon Staging Server works, we first identified a group of original targets using the\n\nfollowing Quake search syntax.\n\nresponse:\"HTTP/1.1 404 Not Found\" AND response:\"Content-Type: text/plain\" AND response:\"Content-Length:\n\n0\" AND NOT response:\"Server: \" AND NOT response:\"Connection: \"\n\nPage 5 of 12\n\nhttps://quake.360.cn/quake/#/reportDetail?id=5fc6fedd191038c3b25c4950\n\nThe IPs from the above results are then targeted and finally we append the extracted Beacon configuration\n\ninformation to the corresponding response port after.\n\nQueries can be made directly using the Quake search syntax： app:\"CobaltStrike-Beacon\"\n\nQuake has also carried out an in-depth analysis of the Beacon configuration, which can be viewed by clicking on\n\n`beacon protocols'.\n\n{\n\n\"x86\": {\n\n\"payloadtype\": \"Beacon 类型\",\n\n\"port\": \"端口\",\n\n\"sleeptime\": \"60000\", Beacon 默认心跳时间，每一分钟目标主机与teamserver通信一次。\n\n\"c2_server\": \"C2 server\",  C2服务器地址，以及URL路径\n\n\"user_agent\": \"ua\",\n\n\"post_uri\": \"/submit.php\",\n\n\"jitter\": \"0\", 针对睡眠时间的抖动率，随机睡眠。\n\n\"pipename\": \"smb beacon之间的通信的管道名称\" ,\n\n\"maxdns\": \"255\", 通过DNS上传数据时，主机名最大长度\n\n\"dns_idle\": \"0.0.0.0\",  表示改IP没有可用的任务,避免使用Bogon地址\n\n\"dns_sleep\": \"0\",每个单独的DNS请求前强制睡眠时间毫秒\n\nPage 6 of 12\n\nhttps://quake.360.cn/quake/#/reportDetail?id=5fc6fedd191038c3b25c4950\n\n\"method1\": \"GET\",\n\n\"method2\": \"POST\",\n\n\"usescookies\": \"1\",\n\n\"spawnto_x86\": \"x86默认打开并注入shellcode的进程\",\n\n\"spawnto_x64\": \"x64默认打开并注入shellcode的进程\",\n\n\"proxy_type\": \"IE settings\", 代理类型\n\n// 进程注入选项\n\n\"process_inject_start_rwx\": \"PAGE_EXECUTE_READWRITE\",   使用RWX作为注入内容的初始权限。另一种是RW。\n\n\"process_inject_use_rwx\": \"PAGE_EXECUTE_READWRITE\",  使用RWX作为注入内容的最终权限。替代是RX。\n\n\"process_inject_min_alloc\": \"0\",    进程注入请求的最小内存\n\n\"process_inject_transform_x86\": \"NULL\", 转换成x86\n\n\"process_inject_transform_x64\": \"NULL\",转换成x64\n\n\"process_inject_execute\": \"\\\\x01\\\\x02\\\\x03\\\\x04\",\n\n\"process_inject_allocation_method\": \"0\",\n\n\"process_inject_stub\": \"F\\\\xa0úã\\\\x03äÒmaÿÆ£G\\\\xadïV\",\n\n\"publickey\": \"\" 公钥\n\n},\n\n\"x64\": {\n\n\"payloadtype\": \"\",\n\n\"port\": \"8080\",\n\n\"sleeptime\": \"60000\",\n\n\"c2_server\": \"l\",\n\n\"user_agent\": \"\",\n\n\"post_uri\": \"/submit.php\",\n\n\"jitter\": \"0\",\n\n\"pipename\": \"NULL\",\n\n\"maxdns\": \"255\",\n\n\"dns_idle\": \"0.0.0.0\",\n\n\"dns_sleep\": \"0\",\n\n\"method1\": \"GET\",\n\n\"method2\": \"POST\",\n\n\"usescookies\": \"1\",\n\n\"spawnto_x86\": \"%windir%\\\\\\\\syswow64\\\\\\\\rundll32.exe\",\n\n\"spawnto_x64\": \"%windir%\\\\\\\\sysnative\\\\\\\\rundll32.exe\",\n\n\"proxy_type\": \"IE settings\",\n\n\"process_inject_start_rwx\": \"PAGE_EXECUTE_READWRITE\",\n\n\"process_inject_use_rwx\": \"PAGE_EXECUTE_READWRITE\",\n\n\"process_inject_min_alloc\": \"0\",\n\n\"process_inject_transform_x86\": \"NULL\",\n\n\"process_inject_transform_x64\": \"NULL\",\n\n\"process_inject_execute\": \"\\\\x01\\\\x02\\\\x03\\\\x04\",\n\n\"process_inject_allocation_method\": \"0\",\n\n\"process_inject_stub\": \"F\\\\xa0úã\\\\x03äÒmaÿÆ£G\\\\xadïV\",\n\n\"publickey\": \"\"\n\n}\n\n}\n\nPage 7 of 12\n\n** Up to this point, the Quake system has supported 2 product fingerprints in relation to Cobalt Strike.\n\napp:\"Cobalt Strik\"\n\napp:\"CobaltStrike-Beacon\"\n\nQuake's search results page will also be marked.\n\n0x06 C2 node extraction and analysis\n\nAfter being able to parse Beacon's configuration file properly, we could see that the  c2_server  field is the\n\naddress of the C2 server and its URL, so we extracted and analysed it and found the following.\n\ndomain names.\n\nhttps://quake.360.cn/quake/#/reportDetail?id=5fc6fedd191038c3b25c4950\n\n1. the vast majority of C2 addresses are Cobalt Strike's own IP, but some C2 nodes are connected using\n\n2. different ports with the same IP and different C2 node configurations, e.g.  103.138.12[...] 53 . This\n\nimage can be used to find the real C2 IP. it may also indicate that the Cobalt Strike has multiple C2 nodes\n\nconfigured.\n\nPage 8 of 12\n\nhttps://quake.360.cn/quake/#/reportDetail?id=5fc6fedd191038c3b25c4950\n\n3. the presence of several different Cobalt Strike IPs using the same C2 address. After analysis, it can be\n\ndetermined that the Cobalt Strike team server has multiple IP addresses or that there are multiple team\n\nservers.\n\n4. the existence of a Cobalt Strike IP using a different C2 image, e.g. search for  app: \"CobaltStrike-Beacon\" AND\n\nresponse: \"153.92.127.212\"\n\n5. Most C2 nodes use domain names that are new IoC and are hardly ever judged black in platforms such as\n\nVirusTotal.\n\n0x07 IoC\n\nextraction analysis.\n\nstandalone domain names of its**).\n\nSome of the IoCs are as follows.\n\nBy the time this article was edited, we had identified the following C2 addresses in the Beacon configuration for\n\nTotal of 777 CobaltStrike standalone IPs and 781 **Beacon C2 addresses (580 standalone IPs and **201\n\nPage 9 of 12\n\nCobaltStrikeBeacon IP\n\n83.242.96.163\n\n47.242.148.4\n\n218.253.251.118\n\n5.34.181.12\n\n47.105.180.183\n\n185.244.149.152\n\n23.224.41.132\n\n46.148.26.246\n\n185.150.117.50\n\n49.234.94.85\n\n47.95.231.140\n\n176.121.14.249\n\n144.217.207.21\n\n185.212.47.171\n\n114.118.5.108\n\n39.100.224.129\n\n49.232.42.92\n\n103.39.18.167\n\n39.102.52.75\n\n89.46.86.160\n\n118.24.85.85\n\n47.95.119.10\n\n45.153.243.215\n\n47.98.166.253\n\n47.244.13.36\n\n185.225.19.125\n\nhttps://quake.360.cn/quake/#/reportDetail?id=5fc6fed\n\nCobaltStrikeBeacon Port\n\n80\n\n80\n\n8443\n\n5985\n\n80\n\n443\n\n80\n\n443\n\n443\n\n8081\n\n8080\n\n80\n\n443\n\n443\n\n443\n\n8888\n\n443\n\n443\n\n81\n\n80\n\n3306\n\n8080\n\n443\n\n80\n\n80\n\n443\n\nPage 10 of 12\n\nd191038c3b25c4950\n\nBeacon C2 Address\n\n83.242.96.163\n\n47.242.148.4\n\n218.253.251.118\n\n5.34.181.12\n\nkinging.ysan.ml\n\nyambanetsdev.net\n\n23.224.41.132\n\n199.217.117.184\n\n185.150.117.50\n\n49.234.94.85\n\n47.95.231.140\n\n176.121.14.249\n\n52.188.209.63\n\nskyler.shacknet.biz\n\n114.118.5.108\n\n39.100.224.129\n\n49.232.42.92\n\n156.226.191.234\n\n39.102.52.75\n\n89.46.86.160\n\n118.24.85.85\n\n47.95.119.10\n\namajai-technologies.support\n\n47.98.166.253\n\n47.244.13.36\n\nnguyenlieu.gratekey.com\n\nCobaltStrikeBeacon IP\n\n192.144.234.207\n\n51.195.35.0\n\n119.23.184.235\n\n152.32.252.47\n\n142.54.188.26\n\n45.147.229.199\n\n106.55.153.204\n\n49.233.155.141\n\n100.26.209.220\n\n103.73.97.119\n\n114.116.33.191\n\n176.123.8.228\n\n153.92.127.204\n\n95.179.228.227\n\n185.202.0.111\n\n45.76.247.184\n\n159.69.156.245\n\n81.70.9.64\n\n89.45.4.135\n\n185.52.3.205\n\n49.232.217.171\n\n78.128.113.14\n\n88.99.89.152\n\nPlease note that as C2 nodes are manually configured by the attacker, there is no guarantee that all are 100%\n\nblacklisted (e.g. if C2 is an intranet IP\n\n0x08 Conclusion\n\nhttps://quake.360.cn/quake/#/reportDetail?id=5fc6fedd191038c3b25c4950\n\nCobaltStrikeBeacon Port\n\n80\n\n8888\n\n7777\n\n8080\n\n443\n\n8080\n\n443\n\n7001\n\n443\n\n443\n\n8888\n\n8000\n\n443\n\n443\n\n80\n\n80\n\n80\n\n80\n\n8080\n\n443\n\n80\n\n443\n\n80\n\nor a whitelisted domain name).\n\nPage 11 of 12\n\nBeacon C2 Address\n\n192.144.234.207\n\n51.195.35.0\n\n119.23.184.235\n\n152.32.252.47\n\nagturnfa.com\n\n45.147.229.199\n\n106.55.153.204\n\n49.233.155.141\n\ncdn.az.gov\n\n103.73.97.119\n\n114.116.33.191\n\n176.123.8.228\n\nio.amscloud.xyz\n\n95.179.228.227\n\n185.202.0.111\n\n45.76.247.184\n\n159.69.156.245\n\n81.70.9.64\n\n89.45.4.135\n\n185.52.3.205\n\n49.232.217.171\n\n78.128.113.14\n\n88.99.89.152\n\nhttps://quake.360.cn/quake/#/reportDetail?id=5fc6fedd191038c3b25c4950\n\nAs Quake said at the product launch and at this year's ISC Spatial Mapping sub-forum.\n\n*Cyberspace mapping starts with assets, but goes beyond them. *\n\nWe believe that active mapping data will be an important source of future cyber security big data \u0026 threat\n\nintelligence data, along with sample endpoint behaviour data and network traffic communication data. Active\n\nmapping data and the knowledge generated from the analysis of mapping data will greatly complement our vision,\n\nopening up even more attack surfaces and areas.\n\nStay tuned for more research in the field of cyberspace mapping~!\n\n0x09 Reference\n\nhttps://blog.cobaltstrike.com/2016/06/22/talk-to-your-children-about-payload-staging/\n\nhttps://research.nccgroup.com/2020/06/15/striking-back-at-retired-cobalt-strike-a-look-at-a-legacy-\n\nvulnerability\n\nhttps://github.com/rapid7/metasploit-\n\nframework/blob/7a6a124272b7c52177a540317c710f9a3ac925aa/lib/rex/payloads/meterpreter/uri_checksum.rb\n\nhttps://blogs.jpcert.or.jp/en/2018/08/volatility-plugin-for-detecting-cobalt-strike-beacon.html\n\nhttps://www.cobaltstrike.com/help-malleable-c2\n\nhttps://blog.cobaltstrike.com/2019/02/19/cobalt-strike-team-server-population-study/\n\nhttps://github.com/Sentinel-One/CobaltStrikeParser/blob/master/parse_beacon_config.py\n\nhttps://github.com/whickey-r7/grab_beacon_config/blob/main/grab_beacon_config.nse\n\nhttps://blog.cobaltstrike.com/2016/06/15/what-is-a-stageless-payload-artifact/\n\nhttp://blog.leanote.com/post/snowming/62ec1132a2c9\n\nSource: https://quake.360.cn/quake/#/reportDetail?id=5fc6fedd191038c3b25c4950\n\nPage 12 of 12",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://quake.360.cn/quake/#/reportDetail?id=5fc6fedd191038c3b25c4950"
	],
	"report_names": [
		"reportDetail?id=5fc6fedd191038c3b25c4950"
	],
	"threat_actors": [],
	"ts_created_at": 1792897127,
	"ts_updated_at": 1792897331,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/125e89f8ce983a97af4de802c0377fc46c4aaa55.pdf",
		"text": "https://archive.orkl.eu/125e89f8ce983a97af4de802c0377fc46c4aaa55.txt",
		"img": "https://archive.orkl.eu/125e89f8ce983a97af4de802c0377fc46c4aaa55.jpg"
	}
}