Research Scanner

You are probably here because 212.47.64.50 (research.certstream.dev) appeared in your logs.

What this host does

This server runs a threat intelligence scanner that looks for command-and-control (C2) servers, such as malware and red-team framework panels, in selected hosting and cloud provider networks. Findings are used to warn about malicious infrastructure.

What it sends

• TCP connection attempts to ports 80, 443, 2087, 3443, 4443, 5555, 7443, 8000, 8080, 8084, 8443, 8834, 13443, 50050.
• On open ports: a standard TLS handshake, an HTTP GET for /, at most one same-host redirect, the favicon, and JARM TLS fingerprinting.

It does not send exploits, attempt logins, brute-force anything, or send C2 protocol commands. Connections are rate limited and spread out in random order, so a single network sees only occasional connections.

Opt out

To have your addresses excluded from future scans, email research@certstream.dev with the IP ranges (CIDR) you want excluded. We add them to our exclusion list and do not scan them again.

You can also block 212.47.64.50 at your firewall.