Public Mosaic C2 indicators
confirmed host

144.172.68.200

Cobalt Strikecommand-and-control server · :8443

On AS30823.

listed last confirmed feed checked TLP:CLEAR Suricata rules Show in the live feed

Relations

Values this address shares with other hosts in this archive, rarest first. A shared value says the hosts were set up alike, not that one operator runs them.

SharedValueOther hosts
JA4X templatedc020972a4a8_9fb583da09a2_fb02ba79e16427 other hosts · 27 listed

Not shared with any other host in this archive: 1 server key, 1 certificate, 1 watermark.

Network context

SharedValueOther hosts
NetworkAS30823 · aurologic2 other hosts · 2 listed

Hosts near this one, for context only.

Summary

First seen by the scanner2026-10-03
In this archive since2026-10-03
Evidence1 certificate · 1 beacon configuration · 1 file served
Look up elsewhereVirusTotal · Shodan · Censys
About this listingWhat a listing means · Is this your address?

Observation history

Listed on 28 of the 63 days since this archive began recording, 2026-08-29 UTC.

  1. listed
  2. :8443

2026-08-292026-10-30

  • first seen to last confirmed
  • listed after its last confirmation

A marked day is a UTC day the feed listed this address. The feed keeps a listener for up to 90 days after its last confirmation, so a listed day is not a confirmation. A listener no longer in the feed is drawn to its last confirmation.

Listed days as dates
  • 2026-10-03 – 2026-10-30 (28 days)

144.172.68.200:8443 · Cobalt Strike

Last confirmed (25 days ago)

first seen2026-10-03 12:28 UTC
serviceip-port · tcp · alt-HTTPS
observed hostcloudfiledisk.com
networkAS30823 · aurologic
confidence100 / 100
tls certificate34af7ae47bc1e55a7c23902171ef303af6f0f33f5cdf84bf9d5fc15b800d1fbe
cert subjectCloudFlare Origin Certificate
cert subject orgCloudFlare, Inc.
cert issuer orgCloudFlare, Inc.
cert validity2026-07-24 → 2041-07-20
cert typeissuer-signed
cert key2048-bit
cert serial (hex)47f2f844078c0aac6e650229aef9b26474fed61b
cert serial (decimal)410756752062680778201983476132465492791803172379
cert names*.cloudfiledisk.com cloudfiledisk.com

The names above are what the certificate asserts, signed by the issuer it names, which may be a public certificate authority, a private one, or one a builder ships. This site verifies none of it, so treat a name here as a lead to investigate, never an attribution.

ja4xdc020972a4a8_9fb583da09a2_fb02ba79e164
jarm07d14d16d21d21d00042d41d00041d47e4e0ae17960b2a5b4fd6107fbb0926
cs watermark1

Beacon configuration

callbackagent.cloudfiledisk.com · set in the beacon by its builder; may be a redirector or a borrowed name
beacon typeHTTPS
cs versionCobalt Strike 4.2 (Nov 06, 2020)
getGET /jquery-3.3.1.min.js
postPOST /jquery-3.3.2.min.js
user-agentMoilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36a
sleep10s ±37%
watermark1
server key md50b56e17f78d8c3f1d3389c66df64e172
inject stub3d58c5b8f765f0548a182ac136419f9e
spawn to x86%windir%\syswow64\dllhost.exe
spawn to x64%windir%\sysnative\dllhost.exe

Hosts sharing a value with this one

27 other hosts in this archive share at least one value with this one. Each is listed once, under its first shared value in Relations order. Dates and status are from the records that share a value.

AddressFamilySharesLast confirmedStatus
JA4X template · 27 other hosts · 27 listed

These hosts’ certificates share one JA4X template, which points to the same certificate tooling. It is not evidence of a single operator.

154.205.145.109HavocJA4X templatelisted
41.216.189.153HavocJA4X templatelisted
111.229.4.108Cobalt StrikeJA4X templatelisted
165.154.225.239Cobalt StrikeJA4X templatelisted
82.158.89.75Cobalt StrikeJA4X templatelisted
82.158.89.214Cobalt StrikeJA4X templatelisted
43.203.112.69Cobalt StrikeJA4X templatelisted
41.216.189.62AdaptixJA4X templatelisted
177.3.92.247VShellJA4X templatelisted
216.238.54.156BTMOBJA4X templatelisted
124.220.216.115AdaptixJA4X templatelisted
101.33.202.134AdaptixJA4X templatelisted
151.236.21.109HavocJA4X templatelisted
193.239.85.15HavocJA4X templatelisted
45.87.53.6Cobalt StrikeJA4X templatelisted
210.2.169.213HavocJA4X templatelisted
87.232.84.18AdaptixJA4X templatelisted
31.56.209.245Chaos RATJA4X templatelisted
47.83.3.103Cobalt StrikeJA4X templatelisted
167.172.142.69HavocJA4X templatelisted
23.148.212.86Cobalt StrikeJA4X templatelisted
23.148.212.123Cobalt StrikeJA4X templatelisted
154.94.224.35Cobalt StrikeJA4X templatelisted
155.117.155.141AdaptixJA4X templatelisted
43.155.169.245Cobalt StrikeJA4X templatelisted
107.172.217.220Cobalt StrikeJA4X templatelisted
154.12.90.231Cobalt StrikeJA4X templatelisted

Samples served · 1 file

Files this address was seen serving, each identified by running or analysing it. A widely distributed file can reach unrelated hosts.

Every file here was served on :8443.

FileConfirmedFile last seen
e87eef18fab37ac5d95feea42f9cbe4e6b98c267c9e5213d1f42078a3a020123analysed

Deploy

Suricata rules and hunt queries for this address’s 1 listed listener.

Suricata rules

Each query searches the last 30 days of your logs for connections to these listeners and for the 1 file this address served. Queries hold only addresses, ports and file hashes.

Microsoft Defender XDR (KQL)
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where (RemoteIP == "144.172.68.200" and RemotePort in (8443))
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in ("e87eef18fab37ac5d95feea42f9cbe4e6b98c267c9e5213d1f42078a3a020123")
Microsoft Sentinel (KQL)
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where (DestinationIP == "144.172.68.200" and DestinationPort in (8443))
Splunk (SPL, CIM data models)
| tstats summariesonly=false count min(_time) as first_time max(_time) as last_time
    from datamodel=Network_Traffic where earliest=-30d
    ((All_Traffic.dest_ip="144.172.68.200" (All_Traffic.dest_port=8443)))
    by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port
| tstats summariesonly=false count min(_time) as first_time max(_time) as last_time
    from datamodel=Endpoint.Filesystem where earliest=-30d
    (Filesystem.file_hash="e87eef18fab37ac5d95feea42f9cbe4e6b98c267c9e5213d1f42078a3a020123")
    by Filesystem.dest Filesystem.file_path Filesystem.file_hash
Elastic (EQL)
network where
  (destination.ip == "144.172.68.200" and destination.port in (8443))
file where file.hash.sha256 in ("e87eef18fab37ac5d95feea42f9cbe4e6b98c267c9e5213d1f42078a3a020123")

Cite this record

Plain text, for a ticket or a report
Address 144.172.68.200 Family Cobalt Strike (command-and-control server) Ports :8443 Status listed (feed checked 2026-10-30 18:37 UTC) First seen 2026-10-03 Last confirmed 2026-10-05 Record https://publicmosaic.com/ip/144.172.68.200 Source Public Mosaic, TLP:CLEAR