Public Mosaic C2 indicators
confirmed host

154.36.183.100

VShellcommand-and-control server · :15082, :8443, :443, :18089

On AS979.

listed last confirmed feed checked TLP:CLEAR Suricata rules Show in the live feed

Relations

Not shared with any other host in this archive: 1 configuration value.

Network context

SharedValueOther hosts
NetworkAS979 · NetLab Global18 other hosts · 17 listed

Hosts near this one, for context only.

Summary

First seen by the scanner2026-09-28
In this archive since2026-09-28
Rolemalware distribution host — observed serving samples
Ports4 · 4 listed
Evidence1 recovered configuration · 4 files served
Look up elsewhereVirusTotal · Shodan · Censys
About this listingWhat a listing means · Is this your address?

Ports

This address answered on 4 ports. First seen and last confirmed dates are per row, by UTC day.

PortFirst seenLast confirmedStatusConfiguration
:15082listed
:8443 · alt-HTTPSlisted
:443 · HTTPSlisted
:18089listedconfig 1

Observation history

Listed on 33 of the 63 days since this archive began recording, 2026-08-29 UTC.

  1. listed
  2. :15082
  3. :8443 and 1 more
  4. :18089

2026-08-292026-10-30

  • first seen to last confirmed

A marked day is a UTC day the feed listed this address. The feed keeps a listener for up to 90 days after its last confirmation, so a listed day is not a confirmation. A listener no longer in the feed is drawn to its last confirmation.

Listed days as dates
  • 2026-09-28 – 2026-10-30 (33 days)

Evidence

Each certificate, configuration and file appears once, with the listeners that carried it.

Config 1 · VShell configuration

On :18089.

Settings recovered from a captured sample whose configuration names this address. They describe the sample, not a live reading of this address.

c2 host154.36.183.100 · same as this host
c2 port18089

Listeners

Each listener below shows its status and what sets it apart. Dates are in Ports; certificates, configurations and files in Evidence. Common to all 4 listeners:

serviceip-port · tcp
networkAS979 · NetLab Global
confidence100 / 100

154.36.183.100:15082 · VShell

listed

154.36.183.100:8443 · VShell

listed

154.36.183.100:443 · VShell

listed

154.36.183.100:18089 · VShell

listed · config 1

rolemalware distribution host — observed serving samples

Samples served · 4 files

Files this address was seen serving, each identified by running or analysing it. A widely distributed file can reach unrelated hosts.

All 4 files are configured to connect to this address on :18089.

Every file here was served on :18089.

FileConfirmedFile last seen
3b81ec985941cc4f22fd3392f7eb8e3fc141f271ec4dca4671ed6fe45c011873analysed
e70c07e05908126bcd375e0c8e2cb1a48d4cf1d376bb98202bf04161916f57eeanalysed
3daf0cc943b58bf80dba59e89a41ba080fab4a380a1d5c2923013575278b7628analysed
81227a5d97555430885d7f19b907e0b990625a218848975ccadf8972642b0846detonated

Clustering values from these files’ configurations.

vkey = saltqwe123qwe@2026 · 1 file

3 of the 4 files are VShell loaders whose configuration was read from the file. A VShell loader’s only configuration is the address and port it calls. The listener key (vkey) and the salt arrive from the listener when the loader connects, so only sandbox runs that reached a live listener show them.

Browse recurring values: vkey · salt

Deploy

Suricata rules and hunt queries for this address’s 4 listed listeners.

Suricata rules

Each query searches the last 30 days of your logs for connections to these listeners and for the 4 files this address served. Queries hold only addresses, ports and file hashes.

Microsoft Defender XDR (KQL)
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where (RemoteIP == "154.36.183.100" and RemotePort in (443, 8443, 15082, 18089))
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in ("3b81ec985941cc4f22fd3392f7eb8e3fc141f271ec4dca4671ed6fe45c011873", "3daf0cc943b58bf80dba59e89a41ba080fab4a380a1d5c2923013575278b7628", "81227a5d97555430885d7f19b907e0b990625a218848975ccadf8972642b0846", "e70c07e05908126bcd375e0c8e2cb1a48d4cf1d376bb98202bf04161916f57ee")
Microsoft Sentinel (KQL)
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where (DestinationIP == "154.36.183.100" and DestinationPort in (443, 8443, 15082, 18089))
Splunk (SPL, CIM data models)
| tstats summariesonly=false count min(_time) as first_time max(_time) as last_time
    from datamodel=Network_Traffic where earliest=-30d
    ((All_Traffic.dest_ip="154.36.183.100" (All_Traffic.dest_port=443 OR All_Traffic.dest_port=8443 OR All_Traffic.dest_port=15082 OR All_Traffic.dest_port=18089)))
    by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port
| tstats summariesonly=false count min(_time) as first_time max(_time) as last_time
    from datamodel=Endpoint.Filesystem where earliest=-30d
    (Filesystem.file_hash="3b81ec985941cc4f22fd3392f7eb8e3fc141f271ec4dca4671ed6fe45c011873" OR Filesystem.file_hash="3daf0cc943b58bf80dba59e89a41ba080fab4a380a1d5c2923013575278b7628" OR Filesystem.file_hash="81227a5d97555430885d7f19b907e0b990625a218848975ccadf8972642b0846" OR Filesystem.file_hash="e70c07e05908126bcd375e0c8e2cb1a48d4cf1d376bb98202bf04161916f57ee")
    by Filesystem.dest Filesystem.file_path Filesystem.file_hash
Elastic (EQL)
network where
  (destination.ip == "154.36.183.100" and destination.port in (443, 8443, 15082, 18089))
file where file.hash.sha256 in ("3b81ec985941cc4f22fd3392f7eb8e3fc141f271ec4dca4671ed6fe45c011873", "3daf0cc943b58bf80dba59e89a41ba080fab4a380a1d5c2923013575278b7628", "81227a5d97555430885d7f19b907e0b990625a218848975ccadf8972642b0846", "e70c07e05908126bcd375e0c8e2cb1a48d4cf1d376bb98202bf04161916f57ee")

Cite this record

Plain text, for a ticket or a report
Address 154.36.183.100 Family VShell (command-and-control server) Role malware distribution host Ports :443, :8443, :15082, :18089 Status listed (feed checked 2026-10-30 18:37 UTC) First seen 2026-09-28 Last confirmed 2026-10-30 Record https://publicmosaic.com/ip/154.36.183.100 Source Public Mosaic, TLP:CLEAR