How to Hunt Malicious Infrastructure Using Scan Data and TLS Certificates

Apr 21, 2026 · Original article ↗

Summary

A Hunt.io walkthrough shows how to pivot from an IP associated with AsyncRAT through domains, ports, protocol responses, TLS certificates, and JA4X fingerprints to identify potentially related malware infrastructure.

Key points

The investigation starts with 37.72.172[.]58, an IP associated with AsyncRAT activity in Hunt.io scans.
The IP had 14 resolving hostnames, many using dynamic DNS, and multiple ports with responses linked to AsyncRAT or Windows HTTP services.
A protocol-data query found 96 results containing the string “AsyncRAT,” which the article presents as a way to identify similar server responses.
Certificate analysis found a self-issued “AsyncRAT Server” certificate and two “Fennec RAT Server” certificates on the starting IP.
A pivot on the Fennec certificate issuer found three additional IP addresses; an AsyncRAT certificate and JA4X pivot returned 73 servers.
The walkthrough recommends correlating infrastructure patterns across multiple intelligence sources and validating leads rather than relying on isolated indicators.

Article Details

Defense Focus: Proactively identify and map suspected malware command-and-control infrastructure through internet scan data, protocol responses, certificate history, and structural TLS fingerprints.
Detection Methods: Inspect a seed IP's hosting provider, ASN, open ports, DNS associations, and service responses before expanding the investigation.
Pivot through domains resolving to the same IP, shared SSH keys, TLS certificates, and associated indicators.
Search captured protocol response data for the string AsyncRAT; the article's query returned 96 results.
Inspect TLS certificate subjects and issuers, self-issued certificates, validity periods, SHA-256 fingerprints, and certificate changes over time.
Search certificate records for issuer.common_name equal to Fennec RAT Server within the previous 30 days and group by IP and port; the article reports three additional IP addresses.
Search certificate records for subject.common_name equal to AsyncRAT Server and ja4x.full equal to 7022c563de38_7022c563de38_0147df7a0c11 within the previous 30 days; the article reports 73 servers.
Correlate findings with passive DNS, WHOIS records, and threat intelligence feeds rather than treating a shared fingerprint as proof of common ownership.
Data Sources: Internet scan data
IP hosting and ASN metadata
DNS resolution records and passive DNS
Open-port and protocol history
Captured service banners and HTTP responses
TLS handshake data
Historical TLS certificates and certificate metadata
Shared SSH key associations
Threat intelligence feeds and published indicators
SIEM alerts
Firewall logs and network traffic
WHOIS records
Rule Types: SQL-like protocol dataset queries using substring matching
SQL-like certificate dataset queries using issuer or subject common-name filters, JA4X matching, rolling time windows, and grouping
Defensive Actions: Record the seed IP, associated hostnames, certificate fingerprints, and structural TLS fingerprints for subsequent tracking.
Review ports 6066, 6606, 7000, 7707, 8088, and 8808 on the seed server, which the article identifies as exposing AsyncRAT-associated TLS responses.
Track certificate rotation and changes in malware-associated certificate common names on the same host.
Expand from a single indicator methodically using corroborating domain, port, protocol, and certificate evidence.
Validate candidate infrastructure across multiple intelligence sources before concluding that hosts share an operator.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`a7a[.]giize[.]com`	Hostname resolving to the suspected AsyncRAT C2 seed IP.
HOSTNAME	`angxo[.]kozow[.]com`	Hostname resolving to the suspected AsyncRAT C2 seed IP.
HOSTNAME	`boty[.]theworkpc[.]com`	Hostname resolving to the suspected AsyncRAT C2 seed IP.
HOSTNAME	`iinupdate[.]giize[.]com`	Hostname resolving to the suspected AsyncRAT C2 seed IP.
HOSTNAME	`milan[.]giize[.]com`	Hostname resolving to the suspected AsyncRAT C2 seed IP.
HOSTNAME	`mooma[.]ooguy[.]com`	Hostname resolving to the suspected AsyncRAT C2 seed IP.
HOSTNAME	`mosstre[.]theworkpc[.]com`	Hostname resolving to the suspected AsyncRAT C2 seed IP.
HOSTNAME	`nevbelo[.]giize[.]com`	Hostname resolving to the suspected AsyncRAT C2 seed IP.
HOSTNAME	`remvan[.]kozow[.]com`	Hostname resolving to the suspected AsyncRAT C2 seed IP.
HOSTNAME	`whatsupdate[.]ooguy[.]com`	Hostname resolving to the suspected AsyncRAT C2 seed IP.
IPV4	`104[.]243[.]248[.]63`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`107[.]172[.]10[.]190`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`107[.]172[.]31[.]101`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`107[.]172[.]31[.]102`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`109[.]115[.]66[.]21`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`115[.]75[.]66[.]68`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`118[.]99[.]99[.]72`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`130[.]12[.]181[.]114`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`136[.]116[.]198[.]124`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`138[.]252[.]132[.]58`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`144[.]126[.]149[.]104`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`144[.]126[.]159[.]54`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`144[.]172[.]91[.]208`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`15[.]235[.]151[.]217`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`151[.]241[.]113[.]151`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`154[.]38[.]185[.]247`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`155[.]94[.]128[.]2`	Listed as Fennec RAT-associated infrastructure identified through certificate pivoting.
IPV4	`157[.]20[.]182[.]24`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`157[.]20[.]182[.]25`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`158[.]94[.]208[.]111`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`158[.]94[.]208[.]206`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`162[.]243[.]20[.]131`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`162[.]243[.]28[.]13`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`165[.]227[.]115[.]71`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`169[.]40[.]135[.]7`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`172[.]111[.]151[.]97`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`173[.]211[.]46[.]18`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`176[.]65[.]132[.]128`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`178[.]16[.]54[.]125`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`178[.]16[.]54[.]184`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`178[.]16[.]55[.]108`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`178[.]16[.]55[.]142`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`178[.]173[.]247[.]44`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`185[.]196[.]9[.]158`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`185[.]203[.]240[.]170`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`185[.]241[.]211[.]23`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`185[.]44[.]66[.]103`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`188[.]137[.]176[.]37`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`188[.]227[.]197[.]38`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`191[.]93[.]118[.]254`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`193[.]142[.]146[.]179`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`193[.]26[.]115[.]183`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`194[.]164[.]96[.]98`	Listed as Fennec RAT-associated infrastructure identified through certificate pivoting.
IPV4	`195[.]66[.]215[.]248`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`196[.]251[.]107[.]104`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`203[.]188[.]171[.]16`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`207[.]231[.]111[.]146`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`209[.]54[.]101[.]176`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`211[.]197[.]94[.]135`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`213[.]152[.]161[.]48`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`216[.]126[.]224[.]83`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`217[.]216[.]32[.]194`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`23[.]95[.]106[.]22`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`3[.]234[.]97[.]76`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`37[.]72[.]172[.]58`	Listed as Fennec RAT-associated infrastructure in the certificate-pivot table; the same seed host also exposed AsyncRAT-associated services.
IPV4	`38[.]255[.]58[.]201`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`45[.]55[.]159[.]168`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`45[.]84[.]198[.]55`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`45[.]9[.]156[.]30`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`50[.]114[.]206[.]110`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`51[.]89[.]110[.]168`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`62[.]182[.]80[.]175`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`64[.]89[.]163[.]73`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`66[.]165[.]255[.]14`	Listed as Fennec RAT-associated infrastructure identified through certificate pivoting.
IPV4	`67[.]210[.]97[.]27`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`67[.]211[.]213[.]203`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`74[.]81[.]49[.]18`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`75[.]69[.]164[.]4`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`83[.]243[.]122[.]167`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`84[.]200[.]73[.]102`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`85[.]17[.]54[.]227`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`85[.]209[.]120[.]47`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`91[.]231[.]222[.]220`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`91[.]92[.]241[.]103`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`91[.]92[.]241[.]142`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
IPV4	`94[.]154[.]35[.]73`	Listed as AsyncRAT-associated infrastructure identified through certificate pivoting.
SHA256	`136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe`	SHA-256 fingerprint of the self-issued AsyncRAT Server TLS certificate observed on the seed infrastructure.
SHA256	`49f0e51f391ad0e8c2571d70a9d95d835ca70a71f4d0ae6d4e0ea7d9ae68ab80`	Fingerprint of a Fennec RAT Server certificate observed on the seed server's port 443, issued 2026-03-04.
SHA256	`708717ba69df5a4ac91a7358c2d0316a7f047af8b5332febc9fe9c892458e025`	Fingerprint of a Fennec RAT Server certificate observed on the seed server's port 443, issued 2026-02-25.