Public Mosaic C2 indicators
confirmed host

1.117.61.139

Cobalt Strikecommand-and-control server · :8080

On AS45090.

listed last confirmed feed checked TLP:CLEAR Suricata rules Show in the live feed

Relations

Values this address shares with other hosts in this archive, rarest first, watermarks last. A shared value says the hosts were set up alike, not that one operator runs them.

SharedValueOther hosts
Cobalt Strike server keyca1c5ee4c6f4451759972387cacad5ac32 other hosts · 32 listed
Cobalt Strike watermark66666666689 other hosts · 89 listed

A Cobalt Strike watermark is a weak link: cracked and leaked builds share one.

Network context

SharedValueOther hosts
NetworkAS45090 · Shenzhen Tencent Computer Systems Com…538 other hosts · 493 listed

Hosts near this one, for context only.

Summary

First seen by the scanner2026-09-19
In this archive since2026-09-19
Evidence1 beacon configuration · 1 recovered configuration · 4 files served
Look up elsewhereVirusTotal · Shodan · Censys
About this listingWhat a listing means · Is this your address?

Observation history

Listed on 42 of the 63 days since this archive began recording, 2026-08-29 UTC.

  1. listed
  2. :8080

2026-08-292026-10-30

  • first seen to last confirmed
  • listed after its last confirmation

A marked day is a UTC day the feed listed this address. The feed keeps a listener for up to 90 days after its last confirmation, so a listed day is not a confirmation. A listener no longer in the feed is drawn to its last confirmation.

Listed days as dates
  • 2026-09-19 – 2026-10-30 (42 days)

This listener was relabelled. Its most recent earlier label is shown; the date of the change is not recorded.

1.117.61.139:8080 · Cobalt Strike

Last confirmed (15 days ago)

first seen2026-09-19 11:31 UTC
serviceip-port · tcp · alt-HTTP
earlier labelVShell
networkAS45090 · Shenzhen Tencent Computer Systems Com…
confidence100 / 100
cs watermark666666666

Beacon configuration

callback1.117.61.139 · same as this host
beacon typeHTTP
cs versionCobalt Strike 4.9 (Sep 19, 2023)
getGET /dot.gif
postPOST /submit.php
user-agentMozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; MDDCJS)
sleep60s ±0%
watermark666666666
server key md5ca1c5ee4c6f4451759972387cacad5ac
inject stub40ed048138df0b3e23a0ef24dc5efa1a
spawn to x86%windir%\syswow64\rundll32.exe
spawn to x64%windir%\sysnative\rundll32.exe

VShell configuration

Settings recovered from a captured sample whose configuration names this address. They describe the sample, not a live reading of this address.

c2 host1.117.61.139 · same as this host
c2 port8080

Hosts sharing a value with this one

89 other hosts in this archive share at least one value with this one. Each is listed once, under its first shared value in Relations order. Dates and status are from the records that share a value. Showing the 40 that rank first. Every host shown is labelled Cobalt Strike, as this one is.

AddressSharesLast confirmedStatus
Cobalt Strike server key · 32 other hosts · 32 listed

Every beacon carries its team server’s public key. Hosts sharing one were set up from the same server installation, or from a leaked or cracked copy that ships its key file, so it is not evidence of a single operator.

8.163.59.20server key · watermarklisted
192.252.185.78server key · watermarklisted
102.134.35.205server key · watermarklisted
47.109.23.77server key · watermarklisted
113.250.188.15server key · watermarklisted
8.152.212.104server key · watermarklisted
47.120.32.72server key · watermarklisted
162.14.122.146server key · watermarklisted
43.167.177.224server key · watermarklisted
43.136.92.170server key · watermarklisted
8.159.146.72server key · watermarklisted
49.235.158.141server key · watermarklisted
47.236.149.142server key · watermarklisted
198.44.116.156server key · watermarklisted
103.236.84.103server key · watermarklisted
137.220.194.15server key · watermarklisted
47.92.208.27server key · watermarklisted
117.72.125.206server key · watermarklisted
104.143.204.78server key · watermarklisted
150.158.102.111server key · watermarklisted
43.138.116.60server key · watermarklisted
42.51.44.173server key · watermarklisted
45.203.213.168server key · watermarklisted
39.98.116.82server key · watermarklisted
149.30.232.29server key · watermarklisted
114.215.188.153server key · watermarklisted
191.223.41.183server key · watermarklisted
192.252.179.24server key · watermarklisted
39.102.125.11server key · watermarklisted
47.94.224.229server key · watermarklisted
207.57.123.57server key · watermarklisted
175.27.214.144server key · watermarklisted
Cobalt Strike watermark · 89 other hosts · 89 listed

The watermark identifies the Cobalt Strike licence a beacon was built with. Cracked and leaked builds share watermarks widely, so it is not evidence of a single operator.

Of these, 32 are listed under an earlier value and 49 are past the 40 hosts shown.

36.93.147.195watermarklisted
117.72.182.5watermarklisted
101.42.255.92watermarklisted
154.12.86.154watermarklisted
82.156.186.185watermarklisted
49.232.21.222watermarklisted
111.228.5.127watermarklisted
106.53.168.218watermarklisted

Samples served · 4 files

Files this address was seen serving, each identified by running or analysing it. A widely distributed file can reach unrelated hosts.

3 of the 4 files are configured to connect to this address on :8080.

Every file here was served on :8080.

FileFamilyConfirmedFile last seen
701a170b1910c02c59cae749873a78ef04bec1b205b124f30a0fb084138e64d8Cobalt Strikeanalysed
fd6735f09bfbf06868561549dcca1115e4a62be79ec0af2788b151aafc69f01fVShellanalysed
ccaec004e2ecea853de39929781262c55afaaaa947834215a1e25af5ee45edc1VShellanalysed
9905bf18ee7d45b65c3b348dc5fbd320d813a6f1fe44099bf47444a1f18df7f9VShellanalysed

3 of the 4 files are VShell loaders whose configuration was read from the file. A VShell loader’s only configuration is the address and port it calls. The listener key (vkey) and the salt arrive from the listener when the loader connects, so only sandbox runs that reached a live listener show them.

Deploy

Suricata rules and hunt queries for this address’s 1 listed listener.

Suricata rules

Each query searches the last 30 days of your logs for connections to these listeners and for the 4 files this address served. Queries hold only addresses, ports and file hashes.

Microsoft Defender XDR (KQL)
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where (RemoteIP == "1.117.61.139" and RemotePort in (8080))
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in ("701a170b1910c02c59cae749873a78ef04bec1b205b124f30a0fb084138e64d8", "9905bf18ee7d45b65c3b348dc5fbd320d813a6f1fe44099bf47444a1f18df7f9", "ccaec004e2ecea853de39929781262c55afaaaa947834215a1e25af5ee45edc1", "fd6735f09bfbf06868561549dcca1115e4a62be79ec0af2788b151aafc69f01f")
Microsoft Sentinel (KQL)
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where (DestinationIP == "1.117.61.139" and DestinationPort in (8080))
Splunk (SPL, CIM data models)
| tstats summariesonly=false count min(_time) as first_time max(_time) as last_time
    from datamodel=Network_Traffic where earliest=-30d
    ((All_Traffic.dest_ip="1.117.61.139" (All_Traffic.dest_port=8080)))
    by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port
| tstats summariesonly=false count min(_time) as first_time max(_time) as last_time
    from datamodel=Endpoint.Filesystem where earliest=-30d
    (Filesystem.file_hash="701a170b1910c02c59cae749873a78ef04bec1b205b124f30a0fb084138e64d8" OR Filesystem.file_hash="9905bf18ee7d45b65c3b348dc5fbd320d813a6f1fe44099bf47444a1f18df7f9" OR Filesystem.file_hash="ccaec004e2ecea853de39929781262c55afaaaa947834215a1e25af5ee45edc1" OR Filesystem.file_hash="fd6735f09bfbf06868561549dcca1115e4a62be79ec0af2788b151aafc69f01f")
    by Filesystem.dest Filesystem.file_path Filesystem.file_hash
Elastic (EQL)
network where
  (destination.ip == "1.117.61.139" and destination.port in (8080))
file where file.hash.sha256 in ("701a170b1910c02c59cae749873a78ef04bec1b205b124f30a0fb084138e64d8", "9905bf18ee7d45b65c3b348dc5fbd320d813a6f1fe44099bf47444a1f18df7f9", "ccaec004e2ecea853de39929781262c55afaaaa947834215a1e25af5ee45edc1", "fd6735f09bfbf06868561549dcca1115e4a62be79ec0af2788b151aafc69f01f")

Cite this record

Plain text, for a ticket or a report
Address 1.117.61.139 Family Cobalt Strike (command-and-control server) Ports :8080 Status listed (feed checked 2026-10-30 18:37 UTC) First seen 2026-09-19 Last confirmed 2026-10-15 Record https://publicmosaic.com/ip/1.117.61.139 Source Public Mosaic, TLP:CLEAR