Public Mosaic C2 indicators
confirmed host

175.124.145.102

Cobalt Strikecommand-and-control server · :50050, :443, :80

On AS9318. It presented 2 certificates; 53 other hosts share at least one of them.

listed last confirmed feed checked TLP:CLEAR Suricata rules Show in the live feed

Relations

Values this address shares with other hosts in this archive, rarest first, watermarks last. A shared value says the hosts were set up alike, not that one operator runs them.

SharedValueOther hosts
TLS certificate56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c37647853 other hosts · 53 listed
Issuance cohort2166164053c1_2166164053c1_30d204a01551_60e4afe8b719_4c8172b9dba553 other hosts · 53 listed
JA4X template2166164053c1_2166164053c1_30d204a01551420 other hosts · 417 listed
Cobalt Strike watermark66666666689 other hosts · 89 listed

A Cobalt Strike watermark is a weak link: cracked and leaked builds share one.

Not shared with any other host in this archive: 1 server key, 1 certificate.

Summary

First seen by the scanner2026-09-23
In this archive since2026-09-25
Ports3 · 3 listed
Evidence2 certificates · 2 beacon configurations · 269 files served
Look up elsewhereVirusTotal · Shodan · Censys
About this listingWhat a listing means · Is this your address?

Ports

This address answered on 3 ports. First seen and last confirmed dates are per row, by UTC day.

PortFirst seenLast confirmedStatusTLS certificateJA4XConfiguration
:50050 · Cobalt Strike team-server defaultlisted56a06a233bd32166164053c1_2166164053c1_30d204a01551
:443 · HTTPSlisted4246d9078efd2166164053c1_2166164053c1_30d204a01551beacon 1
:80listedbeacon 2

Observation history

Listed on 36 of the 63 days since this archive began recording, 2026-08-29 UTC.

  1. listed
  2. :50050
  3. :443
  4. :80

2026-08-292026-10-30

  • first seen to last confirmed
  • listed after its last confirmation

A marked day is a UTC day the feed listed this address. The feed keeps a listener for up to 90 days after its last confirmation, so a listed day is not a confirmation. A listener no longer in the feed is drawn to its last confirmation.

Listed days as dates
  • 2026-09-25 – 2026-10-30 (36 days)

Evidence

Each certificate, configuration and file appears once, with the listeners that carried it.

TLS certificate 56a06a233bd3

On :50050.

tls certificate56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478
cert subjectMajor Cobalt Strike
cert subject orgcobaltstrike
cert issuerMajor Cobalt Strike
cert issuer orgcobaltstrike
cert validity2022-08-30 → 2022-11-28
cert typeself-signed
cert key2048-bit
cert serial (hex)27530dfe
cert serial (decimal)659754494

The names above are what the certificate claims, not proof that this host owns them. Treat a familiar name as a likely impersonation.

TLS certificate 4246d9078efd

On :443.

tls certificate4246d9078efdb000da7370c071ec68734d48b24be14d8e9f5c0592b234d0dc20
cert subjectjquery.com
cert subject orgjQuery
cert issuerjquery.com
cert issuer orgjQuery
cert validity2026-09-23 → 2027-09-23
cert typeself-signed
cert key2048-bit
cert serial (hex)3a2bde2b
cert serial (decimal)975953451

The names above are what the certificate claims, not proof that this host owns them. Treat a familiar name as a likely impersonation.

Beacon configurations

2 configurations on 2 listeners. Common to both:

callbackbbb.0101011010010111001.com · set in the beacon by its builder; may be a redirector or a borrowed name
cs versionCobalt Strike 4.9 (Sep 19, 2023)
getGET /jquery-3.3.1.min.js
postPOST /jquery-3.3.2.min.js
user-agentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 OPR/111.0.0.0 (Edition Yx 03)
sleep5s ±25%
watermark666666666
server key md55a36284cd6c4fb5cffc67e8bb5875415
inject stub40ed048138df0b3e23a0ef24dc5efa1a
spawn to x86%windir%\syswow64\runonce.exe
spawn to x64%windir%\sysnative\runonce.exe

Each configuration calls back on its own listener’s port. Where they differ:

Configurationbeacon type
Beacon 1 · :443HTTPS
Beacon 2 · :80HTTP

Listeners

Each listener below shows its status and what sets it apart. Dates are in Ports; certificates, configurations and files in Evidence. Common to all 3 listeners:

serviceip-port · tcp
networkAS9318 · SK Broadband Co
confidence100 / 100

175.124.145.102:50050 · Cobalt Strike

listed · certificate 56a06a233bd3

cohortshared issuance template · 54 hosts

175.124.145.102:443 · Cobalt Strike

listed · certificate 4246d9078efd · beacon 1

observed hostjquery.com
jarm2ad2ad16d2ad2ad00042d42d00042ddb04deffa1705e2edc44cae1ed24a4da

175.124.145.102:80 · Cobalt Strike

listed · beacon 2

Hosts sharing a value with this one

453 other hosts in this archive share at least one value with this one. Each is listed once, under its first shared value in Relations order. Dates and status are from the records that share a value. Showing the 40 that rank first. Every host shown is labelled Cobalt Strike, as this one is.

AddressSharesLast confirmedStatus
TLS certificate · 53 other hosts · 53 listed

These hosts presented the same certificate. Leaked or resold profiles reuse certificates, so this is not evidence of a single operator.

Of these, 13 are past the 40 hosts shown.

113.250.188.15certificate · issuance cohort · JA4X template · watermarklisted
60.247.206.23certificate · issuance cohort · JA4X templatelisted
47.120.32.72certificate · issuance cohort · JA4X template · watermarklisted
43.136.19.18certificate · issuance cohort · JA4X templatelisted
192.3.251.109certificate · issuance cohort · JA4X templatelisted
192.253.229.133certificate · issuance cohort · JA4X templatelisted
139.196.201.58certificate · issuance cohort · JA4X templatelisted
134.122.204.168certificate · issuance cohort · JA4X templatelisted
107.148.237.76certificate · issuance cohort · JA4X templatelisted
124.223.22.132certificate · issuance cohort · JA4X templatelisted
111.228.5.127certificate · issuance cohort · JA4X template · watermarklisted
185.184.70.41certificate · issuance cohort · JA4X templatelisted
156.254.20.48certificate · issuance cohort · JA4X template · watermarklisted
156.254.20.47certificate · issuance cohort · JA4X template · watermarklisted
156.254.20.46certificate · issuance cohort · JA4X template · watermarklisted
120.48.18.226certificate · issuance cohort · JA4X templatelisted
8.137.169.91certificate · issuance cohort · JA4X templatelisted
47.93.243.161certificate · issuance cohort · JA4X templatelisted
114.215.190.105certificate · issuance cohort · JA4X templatelisted
123.56.124.3certificate · issuance cohort · JA4X templatelisted
47.98.124.244certificate · issuance cohort · JA4X templatelisted
106.12.61.28certificate · issuance cohort · JA4X templatelisted
43.243.73.187certificate · issuance cohort · JA4X templatelisted
103.12.148.37certificate · issuance cohort · JA4X templatelisted
139.196.111.118certificate · issuance cohort · JA4X template · watermarklisted
146.19.216.170certificate · issuance cohort · JA4X templatelisted
146.19.216.163certificate · issuance cohort · JA4X templatelisted
154.94.237.203certificate · issuance cohort · JA4X templatelisted
64.7.199.195certificate · issuance cohort · JA4X templatelisted
134.122.203.247certificate · issuance cohort · JA4X templatelisted
1.15.76.39certificate · issuance cohort · JA4X templatelisted
95.182.114.29certificate · issuance cohort · JA4X templatelisted
150.158.102.111certificate · issuance cohort · JA4X template · watermarklisted
111.230.37.219certificate · issuance cohort · JA4X templatelisted
42.194.241.92certificate · issuance cohort · JA4X templatelisted
82.156.242.28certificate · issuance cohort · JA4X templatelisted
154.219.101.56certificate · issuance cohort · JA4X templatelisted
8.148.201.210certificate · issuance cohort · JA4X templatelisted
121.40.37.49certificate · issuance cohort · JA4X templatelisted
47.95.192.147certificate · issuance cohort · JA4X templatelisted
Issuance cohort · 53 other hosts · 53 listed

A shared value says the hosts were set up alike, not that one operator runs them.

Of these, 40 are listed under an earlier value and 13 are past the 40 hosts shown.

JA4X template · 420 other hosts · 417 listed

These hosts’ certificates share one JA4X template, which points to the same certificate tooling. It is not evidence of a single operator.

Of these, 40 are listed under an earlier value and 380 are past the 40 hosts shown.

Cobalt Strike watermark · 89 other hosts · 89 listed

The watermark identifies the Cobalt Strike licence a beacon was built with. Cracked and leaked builds share watermarks widely, so it is not evidence of a single operator.

Of these, 8 are listed under an earlier value and 81 are past the 40 hosts shown.

Samples served · 269 files

Files this address was seen serving, each identified by running or analysing it. A widely distributed file can reach unrelated hosts.

FileConfirmedDelivered onFile last seen
e5eff814ddd757de471c7a2fac88d63c0934ea9d2317ad3f86e8a312ea34c33canalysed:443
9a33974f06e08a1d30da39bfa910f9941d0972fc3e4661ebce2d612289374b48analysed:80
422c3aafc901fedbdc3413b3b275aace0c338d27bb21bb6c3833d767e7d9ad5banalysed:443
bc7aa695e488cd793cac385fc52909d99068dbefc46da1efc8280443e1614ff7analysed:80
e0fd495ae8048f8b30fbeea7fa43cb6c7b971e2fc492e168c381c34041845df8analysed:443
cc65af0bf2238e993b3c671bb0f51ea55ecc756ab5f1b078578be08f2eeab874analysed:80
3c1843a67072c8243a2ce5342f07d45cd05d8eef9e4bd92a0223d5155df11f20analysed:443
09481a9f465d1a72d29b96da1ed42b41e723b5a6a783a4be36fe16cc2d5ae790analysed:80
e6230753499d4b409eda6492d63d1baca40e719f9bd8798b71616069b6348456analysed:443
827e66f570534b0d8807a53dd573c4246102627ed57730531b2a0aed723b791canalysed:80
4b5877edf210789e85a86768a0283d42b162094ddebf189539162811a8caf8c3analysed:443
af12732f4204a1044ba70e8393f2c0650c2307575b931375b4c7934277003bdeanalysed:80
2bb3264957843a13f24b5447e55487017bee080e3dcc64ce8b33e1d368bb8ebaanalysed:443
ac0ef966bafbc35ed67b382910af0e34b77d05296b6ec229c3910c9540dd2dddanalysed:80
e170a231dab7762d6d9bea017e8b317a480b7425e90b923184019523c208e9d6analysed:443
419f699ab83290aded85db4458d1d8d8e0d5338c7797c9062298ca5ce7b2a36aanalysed:80
9a79e859bf30beb14d29afa17fcda6e711399ea9637953e612ba0bce165b4d77analysed:80
5880e8609ec91a38c602ccaef80b849f2ba2da1db1932d089e4a8dff455bcdaaanalysed:443
e9ed9c63e02586ce6b3da475ad5e21f5e315139d169a8d8a87d16716d723bc0eanalysed:80
f9fb6d79ac2e45fef342ace50c1f7a3c55fffe99b0dfd6ff47be6141ab52474danalysed:443
0ab424660c84f5b1a264afe17c368aea3eca71411e0427265f6a37f913b6db03analysed:80
84c697a6e224a565df1cf1fe1ecc95e06641a0a95da732b23308cf4f6f3aaf80analysed:443
3d619562f6bac440e318825d730ff4fc1f44f61c673b1cdb6d5376f3f2d2c360analysed:80
ad40fa725b9aa02da1c8a52abfb584e411499afc55f1b96fe73d7a40784a4aa7analysed:443
ca9ed0dc15cc25625aa5c62429f43303d50a97224466323d8a073902819d1c20analysed:80
bf2db12e9ad2aa04d1e6f6e578042a8d3cbcfacaa979bf91964c1a28c86d1961analysed:443
95e71373bc744f91badb91d30c8905f88c62100fbdb77906511ab58df1199421analysed:80
6d6f359668a4243f8abedacd4d75b439e3c76d80bb24f5fe13e71de02b7f966canalysed:443
89f20d184832d4ab80eb1829e8b28c1e87b05e3c9f8ad770064c0b35febd6bd3analysed:80
b867bff0b8addfaaa8f8ea102c245fa6ea5f752cc59f98d25f9077be2874d2e1analysed:443
f4cad79d5fea2e5f2e8a8eeedfd7636bf32566cc93fe7a7d935a06f23f8274d9analysed:80
dc0b8ae7d26b6735aaf341dee3d248e3d84c0216c96648bac6932a92c6cd5adaanalysed:443
333418422b7dbd0a587b72b5a3f3eba2579c473cc24574bb4bc16d1b44c40e3danalysed:80
29334e0b8ff71a22c2950579da147e88a53b5596a111a10078e63f153ee980f7analysed:443
243fe720bcd53ff84f00236cbd46491f07f63af67cbfee3154e15553ee67010canalysed:80
891cd23ed14955f5897969e15271b81ee4e49b73af7fd0657d5784596be5630aanalysed:443
269f22f440e0632a04bb07a05900adb5ec414d8b3c1c04e708090332ff75b9efanalysed:80
c10c1e9e6fd4df87ffb698f9f1589e7b185e0177cb056ca8a23d664a162b33dfanalysed:443
bb2661eee1142f93b23fd1227fb9f96a63ac830f254bd715cae2a94563e4d9bcanalysed:80
f15418cf8169ef13df17354985e10750ad7697b2d77f2bf1af73296f9f906e82analysed:443
7cdfa3be6aa5f0ae47479e7ef93bfe23421ecedb014a63eca76940c01784c56danalysed:80
5ad305b8a05258f58d466345e7d8aaca54709f10040e99b895096e4e5eaac672analysed:443
2a8df68974218fbee63945065024b9bd83fa754ffa06f7e6dae3112ddb9f041eanalysed:80
1d0e7b7fb13923f16120deadad24c742835123919ff6c5af60ae73f7f6f5780canalysed:443
0186996c0c161011e9da6537b82468a4270b749e5450c5f5db51f089d50b47e0analysed:80
fc0e5d8544da07e2c17a330e18ab3536a7ad06783b89f370b9ca09dfa837714banalysed:443
2ad08775556a928d984f66231ff7037aa897cdb3d239107bb09aa156d7eafef6analysed:80
03465eef454d469969c5d80ab23a481930087034ea246767abf785ac6114bca6analysed:443
5cecc3abd9af8756aad41ed8cafddccbdb1a7f3ea4bc117cbb559a9afe8a0791analysed:80
fee59d594e95c06f3bf69537b439131a5152489e7cb5e39f9783a824814f529aanalysed:443
80ddc91c99a9d05b4228e391ebc65168dab41d1d07bdf57b7a80cb1f6be4abb9analysed:80
890f88878c9a3d4e2a74eb818c9e858af5bad00325fe1c0b0297696aadbfc150analysed:443
9f1d4d42aedb4e33795ed8d7638b78dbf6d93993ea6b10409681d0aeeb5b22f2analysed:80
3c16e39f80bbb7dad7986b20aaefc5b5194a6d5f78283fb4eeb994c9e23eba10analysed:443
a4b4c36b00b0437daa8b0062c880803788f4ed5026fdcdb2e819597a953ad9e7analysed:80
6ce79c509b20bae3c7a41bc647ad841493b5eff9193ccaa2ca2b78eec8fc5d9fanalysed:443
94d7e86558a145a58646be3bba2aded6b9e73211a8d37664dd4525d8ec82bdb7analysed:80
5e004fb3d119b0ed958fad8ea288d2e99b12b92a5639677fbd69a33e853a137fanalysed:443
58674fddc7ec9b0dedcaca03782f2f36a4594e8c01700bd801d22d2edfa9ae1fanalysed:80
2926c00f53ac2005c1ab390bba51b32dfedc908e1a0565746ee7f265b26e82c7analysed:443
2f0ed3e2111215bf7e4ea9893955f5ced6803bb7f2478f5bf5a204d96576c4b0analysed:80
757f916b03a8dc2973ccd0aa7e9663c3809460a3c3354afaed5a790df04a144aanalysed:443
532047e250539d001b5dcc700f0a366f110be79b41101d96c78bf9d4047bfdb5analysed:80
2c2353027b4aa0b61ed360ea92a7de58fe5b2288c0422bd859a7022551d87da3analysed:80
31ad43b04f0dad4ced9e2349e565974556859070d487abe44b44acdfd0c4290eanalysed:443
58487d974115251eec864a721388e0394515c58dd1c110f98cbf625f009b6530analysed:80
32a0ec262b59a466b06a73abbaa69212cd280058494c788c01e413ce66f427ffanalysed:443
6248c27666c71ad75ca440b5f89e65fecba7b47ace991287ad0ce7d12c22b287analysed:80
762a4124c09d4b3324321da1517f6d4294d317bd914057f29a8d28628cb71cb2analysed:443
6edd5796d90729961941e07bcd26ff9a0d7b1ee848d9284278fe7e76d854eb84analysed:80
6ad8afef667eb69657af27f9088dabfe21606ebb0d8bfd61c4d9118c731e9b7banalysed:443
6af85038d81dc90e82acad4164aa3cae12891fde8f63e0d997481e1b6f3243eaanalysed:80
bd30a820726b05f6e15f30a1db0fcd37cb21b91276014350be31a9aa46903594analysed:443
455a086e0cbfac3406aff8680a22dbc740b22ada9de25640d7725a0ff6e2ff5danalysed:80
223d655d855c6e0bdcdb87b7eb2542b792f9ecb833c83ed4ccc10816fd4793a0analysed:443
7b10f05f9b612ecb3c75265ecf551196e9b7448b28cc1deace7a0268fd8aff10analysed:80
58f5eceb83ca82053a84e72057d9943b859000cd3952fadf1c02edd44640f171analysed:443
b33730d7f65d8b553b32783f72a7df1f84dd4ab8f1100c301e2136b5817e824eanalysed:80
c8da5518e63bfadeacfdb5e3da9a0d9c7559ce84e3d23320b9baaf97341be82eanalysed:443
23581fc5b54186060f5b959fad4816de029a85e8a5829ee614d80568a4195154analysed:80
3d0541e03d090c274ff1039704f5e55f3aacc848286f55ec94176798b9c84e22analysed:443
5ed6c9200accee6432bf50225f4abfaab759fcb3bd312a73c6714b830c985212analysed:80
c7b91ccf800b47257db90bf44b7a171d3dd77bd97e019bcd18508ce5a9177501analysed:443
dc886987f18ca3238d762ef1b60b8187e23247c882200ae35ff16a6c3a318989analysed:80
4e26d5a50eb98832797dbb655ba7086397ad756f6c3991795d371b87bd9a5f21analysed:443
d09fc5b7af82f93ac16340d9d6dbac225366a840ff852c952c829f9d194a7bd4analysed:80
6c615992e47f672fadc825dcb8f8c67edc6c9ca2765ff62ec9133622e5f349f1analysed:80
95d55aad5d25fe869eff5e855dbe2975ff1148c700ca42de62dafe11c0820f81analysed:443
fd32253ed91185106176a931a8831c77590e818f7aad36981ae1304f7aed04bdanalysed:80
9051957412eee79b0333279bb72e7ac468337726e5fcb5396aa91da650938de0analysed:443
12706d682b6595a1eed3a2503b22abfdca84b476a0e621e17b956ceec5e9953aanalysed:80
d21943b782d1630c7123bfdd15a9ce23a1799dd237d064588058da278c131202analysed:443
936a8294837b8cda3429639098730f74fb83b0200eb60b4edf0be0fa61f9698aanalysed:80
386cebfa8dc4987574c1be23152abbd17dddc57952e459ac708f9ed108fe4d6banalysed:443
c4f9a89748de8978a132387e794dbbfbfb3b0de8504a45f4fbf08fe0fbbdf49eanalysed:80
3a775c226d2b9ed18d9990ec78e4bd6384d4e1362b0689e10b5c8a9bca837b6eanalysed:443
0c302c829ac77df357295297c283ea9c4db5867858caf7e140e5d87491d3d553analysed:80
2478d0ec37292650ca365ed184275483b91c089294cbc77328fe9e44f607c2a5analysed:443
fc9336064e9f2abf892a00bb04fe547415df48e192f1551115c80f526b5b1e47analysed:80
3d0df11f65db9cdf3ac30b273d98348e5fa9d6eeb3c5d258209f89a681b1b143analysed:443

Showing the 100 most recently seen of 269 files.

Deploy

Suricata rules and hunt queries for this address’s 3 listed listeners.

Suricata rules

Each query searches the last 30 days of your logs for connections to these listeners and for the 12 most recently seen of the 269 files this address served. Queries hold only addresses, ports and file hashes.

Microsoft Defender XDR (KQL)
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where (RemoteIP == "175.124.145.102" and RemotePort in (80, 443, 50050))
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in ("09481a9f465d1a72d29b96da1ed42b41e723b5a6a783a4be36fe16cc2d5ae790", "3c1843a67072c8243a2ce5342f07d45cd05d8eef9e4bd92a0223d5155df11f20", "422c3aafc901fedbdc3413b3b275aace0c338d27bb21bb6c3833d767e7d9ad5b", "4b5877edf210789e85a86768a0283d42b162094ddebf189539162811a8caf8c3", "827e66f570534b0d8807a53dd573c4246102627ed57730531b2a0aed723b791c", "9a33974f06e08a1d30da39bfa910f9941d0972fc3e4661ebce2d612289374b48", "af12732f4204a1044ba70e8393f2c0650c2307575b931375b4c7934277003bde", "bc7aa695e488cd793cac385fc52909d99068dbefc46da1efc8280443e1614ff7", "cc65af0bf2238e993b3c671bb0f51ea55ecc756ab5f1b078578be08f2eeab874", "e0fd495ae8048f8b30fbeea7fa43cb6c7b971e2fc492e168c381c34041845df8", "e5eff814ddd757de471c7a2fac88d63c0934ea9d2317ad3f86e8a312ea34c33c", "e6230753499d4b409eda6492d63d1baca40e719f9bd8798b71616069b6348456")
Microsoft Sentinel (KQL)
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where (DestinationIP == "175.124.145.102" and DestinationPort in (80, 443, 50050))
Splunk (SPL, CIM data models)
| tstats summariesonly=false count min(_time) as first_time max(_time) as last_time
    from datamodel=Network_Traffic where earliest=-30d
    ((All_Traffic.dest_ip="175.124.145.102" (All_Traffic.dest_port=80 OR All_Traffic.dest_port=443 OR All_Traffic.dest_port=50050)))
    by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port
| tstats summariesonly=false count min(_time) as first_time max(_time) as last_time
    from datamodel=Endpoint.Filesystem where earliest=-30d
    (Filesystem.file_hash="09481a9f465d1a72d29b96da1ed42b41e723b5a6a783a4be36fe16cc2d5ae790" OR Filesystem.file_hash="3c1843a67072c8243a2ce5342f07d45cd05d8eef9e4bd92a0223d5155df11f20" OR Filesystem.file_hash="422c3aafc901fedbdc3413b3b275aace0c338d27bb21bb6c3833d767e7d9ad5b" OR Filesystem.file_hash="4b5877edf210789e85a86768a0283d42b162094ddebf189539162811a8caf8c3" OR Filesystem.file_hash="827e66f570534b0d8807a53dd573c4246102627ed57730531b2a0aed723b791c" OR Filesystem.file_hash="9a33974f06e08a1d30da39bfa910f9941d0972fc3e4661ebce2d612289374b48" OR Filesystem.file_hash="af12732f4204a1044ba70e8393f2c0650c2307575b931375b4c7934277003bde" OR Filesystem.file_hash="bc7aa695e488cd793cac385fc52909d99068dbefc46da1efc8280443e1614ff7" OR Filesystem.file_hash="cc65af0bf2238e993b3c671bb0f51ea55ecc756ab5f1b078578be08f2eeab874" OR Filesystem.file_hash="e0fd495ae8048f8b30fbeea7fa43cb6c7b971e2fc492e168c381c34041845df8" OR Filesystem.file_hash="e5eff814ddd757de471c7a2fac88d63c0934ea9d2317ad3f86e8a312ea34c33c" OR Filesystem.file_hash="e6230753499d4b409eda6492d63d1baca40e719f9bd8798b71616069b6348456")
    by Filesystem.dest Filesystem.file_path Filesystem.file_hash
Elastic (EQL)
network where
  (destination.ip == "175.124.145.102" and destination.port in (80, 443, 50050))
file where file.hash.sha256 in ("09481a9f465d1a72d29b96da1ed42b41e723b5a6a783a4be36fe16cc2d5ae790", "3c1843a67072c8243a2ce5342f07d45cd05d8eef9e4bd92a0223d5155df11f20", "422c3aafc901fedbdc3413b3b275aace0c338d27bb21bb6c3833d767e7d9ad5b", "4b5877edf210789e85a86768a0283d42b162094ddebf189539162811a8caf8c3", "827e66f570534b0d8807a53dd573c4246102627ed57730531b2a0aed723b791c", "9a33974f06e08a1d30da39bfa910f9941d0972fc3e4661ebce2d612289374b48", "af12732f4204a1044ba70e8393f2c0650c2307575b931375b4c7934277003bde", "bc7aa695e488cd793cac385fc52909d99068dbefc46da1efc8280443e1614ff7", "cc65af0bf2238e993b3c671bb0f51ea55ecc756ab5f1b078578be08f2eeab874", "e0fd495ae8048f8b30fbeea7fa43cb6c7b971e2fc492e168c381c34041845df8", "e5eff814ddd757de471c7a2fac88d63c0934ea9d2317ad3f86e8a312ea34c33c", "e6230753499d4b409eda6492d63d1baca40e719f9bd8798b71616069b6348456")

Cite this record

Plain text, for a ticket or a report
Address 175.124.145.102 Family Cobalt Strike (command-and-control server) Ports :80, :443, :50050 Status listed (feed checked 2026-10-30 18:37 UTC) First seen 2026-09-23 Last confirmed 2026-10-26 Record https://publicmosaic.com/ip/175.124.145.102 Source Public Mosaic, TLP:CLEAR