Public Mosaic C2 indicators
confirmed host

101.43.31.60

Cobalt StrikeVShellcontrollers · :80, :443

On AS45090.

listed last confirmed feed checked TLP:CLEAR Suricata rules Show in the live feed

Relations

Values this address shares with other hosts in this archive, rarest first, watermarks last. A shared value says the hosts were set up alike, not that one operator runs them.

SharedValueOther hosts
Cobalt Strike server key6b4fb9180ea08670d3d822eb669b41f41 other host · 1 listed
Cobalt Strike watermark39114493842 other hosts · 42 listed

A Cobalt Strike watermark is a weak link: cracked and leaked builds share one.

Network context

SharedValueOther hosts
NetworkAS45090 · Shenzhen Tencent Computer Systems Com…538 other hosts · 493 listed

Hosts near this one, for context only.

Summary

First seen by the scanner2026-09-18
In this archive since2026-09-18
Ports2 · 2 listed
Evidence1 beacon configuration · 1 recovered configuration · 4 files served
Look up elsewhereVirusTotal · Shodan · Censys
About this listingWhat a listing means · Is this your address?

Ports

This address answered on 2 ports, across 2 families. First seen and last confirmed dates are per row, by UTC day.

PortFamilyFirst seenLast confirmedStatusConfiguration
:80Cobalt Strikelistedbeacon
:443 · HTTPSVShelllistedconfig 1

Observation history

Listed on 43 of the 63 days since this archive began recording, 2026-08-29 UTC.

  1. listed
  2. :80
  3. :443

2026-08-292026-10-30

  • first seen to last confirmed
  • listed after its last confirmation

A marked day is a UTC day the feed listed this address. The feed keeps a listener for up to 90 days after its last confirmation, so a listed day is not a confirmation. A listener no longer in the feed is drawn to its last confirmation.

Listed days as dates
  • 2026-09-18 – 2026-10-30 (43 days)

Evidence

Each certificate, configuration and file appears once, with the listeners that carried it.

Beacon configuration

On :80.

callback1.13.247.208 · set in the beacon by its builder; may be a redirector or a borrowed name
beacon port80
beacon typeHTTP
cs versionCobalt Strike 4.7 (Aug 17, 2022)
getGET /Read/v10.2/L6BTXOD63FJ
postPOST /def/v6.37/C643079LCX
user-agentMozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
sleep4s ±44%
watermark391144938
server key md56b4fb9180ea08670d3d822eb669b41f4
inject stub4044cc2fd581a10b920164b1f97997bd
spawn to x86%windir%\syswow64\getmac.exe /V
spawn to x64%windir%\sysnative\svchost.exe -k wksvc

Config 1 · VShell configuration

On :443.

Settings recovered from a captured sample whose configuration names this address. They describe the sample, not a live reading of this address.

c2 host101.43.31.60 · same as this host
c2 port443

Listeners

Each listener below shows its status and what sets it apart. Dates are in Ports; certificates, configurations and files in Evidence. Common to both listeners:

serviceip-port · tcp
networkAS45090 · Shenzhen Tencent Computer Systems Com…
confidence100 / 100

101.43.31.60:80 · Cobalt Strike

listed · beacon

101.43.31.60:443 · VShell

listed · config 1

Hosts sharing a value with this one

42 other hosts in this archive share at least one value with this one. Each is listed once, under its first shared value in Relations order. Dates and status are from the records that share a value. Showing the 40 that rank first.

AddressFamilySharesLast confirmedStatus
Cobalt Strike server key · 1 other host · 1 listed

Every beacon carries its team server’s public key. Hosts sharing one were set up from the same server installation, or from a leaked or cracked copy that ships its key file, so it is not evidence of a single operator.

43.143.13.146Cobalt Strikeserver key · watermarklisted
Cobalt Strike watermark · 42 other hosts · 42 listed

The watermark identifies the Cobalt Strike licence a beacon was built with. Cracked and leaked builds share watermarks widely, so it is not evidence of a single operator.

Of these, 1 is listed under an earlier value and 2 are past the 40 hosts shown.

123.249.100.226Cobalt Strikewatermarklisted
47.105.36.109Cobalt Strikewatermarklisted
47.95.201.24Cobalt Strikewatermarklisted
60.247.206.23Cobalt Strikewatermarklisted
39.100.66.238Cobalt Strikewatermarklisted
124.223.22.132Cobalt Strikewatermarklisted
39.100.64.125Cobalt Strikewatermarklisted
111.230.37.219Cobalt Strikewatermarklisted
39.96.201.230Cobalt Strikewatermarklisted
59.110.228.141Cobalt Strikewatermarklisted
47.98.124.244Cobalt Strikewatermarklisted
47.94.56.71Cobalt Strikewatermarklisted
60.217.23.146Cobalt Strikewatermarklisted
124.221.190.127Cobalt Strikewatermarklisted
62.234.75.12Cobalt Strikewatermarklisted
192.144.219.65Cobalt Strikewatermarklisted
103.117.136.32Cobalt Strikewatermarklisted
42.194.241.92Cobalt Strikewatermarklisted
154.219.101.56Cobalt Strikewatermarklisted
114.66.27.110Cobalt Strikewatermarklisted
80.97.160.149Cobalt Strikewatermarklisted
8.166.128.186Cobalt Strikewatermarklisted
47.108.25.113Cobalt Strikewatermarklisted
82.156.242.28Cobalt Strikewatermarklisted
167.17.47.252Cobalt Strikewatermarklisted
47.95.192.147Cobalt Strikewatermarklisted
39.97.57.155Cobalt Strikewatermarklisted
47.121.130.18Cobalt Strikewatermarklisted
180.76.141.175Cobalt Strikewatermarklisted
209.200.246.194Cobalt Strikewatermarklisted
8.129.25.140Cobalt Strikewatermarklisted
47.113.206.140Cobalt Strikewatermarklisted
8.146.207.128Cobalt Strikewatermarklisted
101.200.85.0Cobalt Strikewatermarklisted
154.221.25.38Cobalt Strikewatermarklisted
210.56.48.227Cobalt Strikewatermarklisted
106.75.249.202Cobalt Strikewatermarklisted
106.55.25.253Cobalt Strikewatermarklisted
117.72.159.96Cobalt Strikewatermarklisted

Samples served · 4 files

Files this address was seen serving, each identified by running or analysing it. A widely distributed file can reach unrelated hosts.

3 of the 4 files are configured to connect to this address on :443.

FileFamilyConfirmedDelivered onFile last seen
abb4ccdf76d8ddd35380019ec0a72b35ea7ad6d8ebb7f168cb8951b7fde02cb8VShellanalysed:443
270c4111b05b1081a866ae4fcea367cd1075af67040b4145df8f6d8467fae816VShellanalysed:443
7e5012aec65d3fa11e06a49537ff92b9220a1f37a5a2493d61a8dd82f17e7323VShellanalysed:443
d7c1ed25468ecdfb5933ef69d49fba2e89b47d9bc04b8c41d5898054d319032dCobalt Strikeanalysed:80

3 of the 4 files are VShell loaders whose configuration was read from the file. A VShell loader’s only configuration is the address and port it calls. The listener key (vkey) and the salt arrive from the listener when the loader connects, so only sandbox runs that reached a live listener show them.

Deploy

Suricata rules and hunt queries for this address’s 2 listed listeners.

Suricata rules

Each query searches the last 30 days of your logs for connections to these listeners and for the 4 files this address served. Queries hold only addresses, ports and file hashes.

Microsoft Defender XDR (KQL)
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where (RemoteIP == "101.43.31.60" and RemotePort in (80, 443))
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in ("270c4111b05b1081a866ae4fcea367cd1075af67040b4145df8f6d8467fae816", "7e5012aec65d3fa11e06a49537ff92b9220a1f37a5a2493d61a8dd82f17e7323", "abb4ccdf76d8ddd35380019ec0a72b35ea7ad6d8ebb7f168cb8951b7fde02cb8", "d7c1ed25468ecdfb5933ef69d49fba2e89b47d9bc04b8c41d5898054d319032d")
Microsoft Sentinel (KQL)
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where (DestinationIP == "101.43.31.60" and DestinationPort in (80, 443))
Splunk (SPL, CIM data models)
| tstats summariesonly=false count min(_time) as first_time max(_time) as last_time
    from datamodel=Network_Traffic where earliest=-30d
    ((All_Traffic.dest_ip="101.43.31.60" (All_Traffic.dest_port=80 OR All_Traffic.dest_port=443)))
    by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port
| tstats summariesonly=false count min(_time) as first_time max(_time) as last_time
    from datamodel=Endpoint.Filesystem where earliest=-30d
    (Filesystem.file_hash="270c4111b05b1081a866ae4fcea367cd1075af67040b4145df8f6d8467fae816" OR Filesystem.file_hash="7e5012aec65d3fa11e06a49537ff92b9220a1f37a5a2493d61a8dd82f17e7323" OR Filesystem.file_hash="abb4ccdf76d8ddd35380019ec0a72b35ea7ad6d8ebb7f168cb8951b7fde02cb8" OR Filesystem.file_hash="d7c1ed25468ecdfb5933ef69d49fba2e89b47d9bc04b8c41d5898054d319032d")
    by Filesystem.dest Filesystem.file_path Filesystem.file_hash
Elastic (EQL)
network where
  (destination.ip == "101.43.31.60" and destination.port in (80, 443))
file where file.hash.sha256 in ("270c4111b05b1081a866ae4fcea367cd1075af67040b4145df8f6d8467fae816", "7e5012aec65d3fa11e06a49537ff92b9220a1f37a5a2493d61a8dd82f17e7323", "abb4ccdf76d8ddd35380019ec0a72b35ea7ad6d8ebb7f168cb8951b7fde02cb8", "d7c1ed25468ecdfb5933ef69d49fba2e89b47d9bc04b8c41d5898054d319032d")

Cite this record

Plain text, for a ticket or a report
Address 101.43.31.60 Family Cobalt Strike, VShell Ports :80, :443 Status listed (feed checked 2026-10-30 18:37 UTC) First seen 2026-09-18 Last confirmed 2026-09-21 Record https://publicmosaic.com/ip/101.43.31.60 Source Public Mosaic, TLP:CLEAR