IP address 45.139.104.226

45.139.104.226:49001 · PureRAT

Last confirmed 2026-09-13 06:15 UTC (2 days ago)

The certificate names above are what the certificate ASSERTS, not proof this host owns them — a self-signed certificate can claim any subject, so treat a familiar name here as an impersonation attempt rather than an identity.

45.139.104.226:443 · PureRAT

Last confirmed 2026-09-15 09:03 UTC (today)

The certificate names above are what the certificate ASSERTS, not proof this host owns them — a self-signed certificate can claim any subject, so treat a familiar name here as an impersonation attempt rather than an identity.

The payload hash is the SHA-256 of the file this listener served when it was scanned. A host can change what it serves at any time, so this identifies a sample to look up or analyse rather than describing what it serves now. Only the response’s Content-Type claimed a download — no executable magic bytes were seen — so the bytes behind this hash are unverified.

Shared JA4X issuance template · 67 hosts

These hosts issued certificates from the same template — the same distinguished-name fields hashed in the same order. It links tooling, not necessarily an operator.

Showing 24 of 67. The rest are reachable from any of them.

Neighbourhood · 45.139.104.0/24 · 2 hosts

2 other confirmed hosts in the same /24. Adjacent addresses under one operator are a different signal from a shared certificate — they suggest a block, not a build.

Pivots & lookups