Cobalt Strike
581 hosts convicted as Cobalt Strike command-and-control servers: 580 still listed, 1 archived. First seen 2026-08-22.
About
Cobalt Strike is commercial adversary-simulation software, created by Raphael Mudge in 2012 and acquired in 2020 by HelpSystems, now Fortra. Its Beacon implant was the malware family Mandiant observed most often for five years, until 2025. The scanner identifies the servers Beacon reports to — team servers, or redirectors in front of them — never the implant itself. Most were identified from a payload stage they served or from their certificate. A hostname read from a stage or certificate can be listed too, at whatever address it resolved to, possibly a CDN's shared edge. A stage carries a watermark meant to identify the licence, though cracked builds often share the same few values. An authorised engagement and an intrusion can stand a server up identically, so a listing does not establish who runs it, whether its copy was licensed or its use authorised.
Ports
The 8 ports with the most hosts, of 282.
Observed changes
Relabelled: 4 hosts earlier labelled Quasar; 2 hosts earlier labelled Sliver; 1 host earlier labelled VShell. Only the most recent earlier label is kept.
New networks for this family in this archive, last 7 days: AS395904 on 2026-10-27 (1 host); AS12876 on 2026-10-26 (1 host); AS967 on 2026-10-26 (1 host); AS47447 on 2026-10-26 (1 host); AS214927 on 2026-10-26 (1 host); AS153371 on 2026-10-26 (1 host). Showing the 6 newest of 11.
Estimated moves of this family toward AS8075 on 2026-10-12 (fewer than 10 hosts); toward AS37963 on 2026-10-12 (10–99 hosts); toward AS45090 on 2026-10-12 (10–99 hosts); toward AS45102 on 2026-10-12 (fewer than 10 hosts). These are the scanner’s estimates from passive search data, shown only where this archive also holds a host of this family. Showing the 4 newest of at least 10.
Detection packs
Rules for this hub's 580 still-listed hosts, across all 6 pages of the list, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Files
Recurring server keys · 19 keys
Team-server keys seen on more than one host here. A Cobalt Strike team server creates its key pair once, at setup, so hosts sharing a key come from one installation, or from a leaked or cracked copy that ships its key file. Each key links its most recently seen host, which lists the rest.
Hosts · page 5 of 6
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.