Public Mosaic C2 indicators
confirmed host

42.51.44.173

OktosCobalt Strikecontrollers · :55555, :18888, :18443

On AS56005.

listed last confirmed feed checked TLP:CLEAR Suricata rules Show in the live feed

Relations

Values this address shares with other hosts in this archive, rarest first, watermarks last. A shared value says the hosts were set up alike, not that one operator runs them.

SharedValueOther hosts
Cobalt Strike server keyca1c5ee4c6f4451759972387cacad5ac32 other hosts · 32 listed
JA4X template2166164053c1_2166164053c1_30d204a01551420 other hosts · 417 listed
Cobalt Strike watermark66666666689 other hosts · 89 listed

A Cobalt Strike watermark is a weak link: cracked and leaked builds share one.

Not shared with any other host in this archive: 1 certificate.

Network context

SharedValueOther hosts
NetworkAS56005 · Zhengzhou Fastidc Technology3 other hosts · 3 listed

Hosts near this one, for context only.

Summary

First seen by the scanner2026-09-27
In this archive since2026-09-27
Ports3 · 3 listed
Evidence1 certificate · 2 beacon configurations · 2 files served
Look up elsewhereVirusTotal · Shodan · Censys
About this listingWhat a listing means · Is this your address?

Ports

This address answered on 3 ports, across 2 families. First seen and last confirmed dates are per row, by UTC day.

PortFamilyFirst seenLast confirmedStatusTLS certificateJA4XConfiguration
:55555Oktoslisted
:18888Cobalt Strikelistedbeacon 1
:18443Cobalt Strikelistedabe2d6c32d532166164053c1_2166164053c1_30d204a01551beacon 2

Observation history

Listed on 34 of the 63 days since this archive began recording, 2026-08-29 UTC.

  1. listed
  2. :55555
  3. :18888 and 1 more

2026-08-292026-10-30

  • first seen to last confirmed
  • listed after its last confirmation

A marked day is a UTC day the feed listed this address. The feed keeps a listener for up to 90 days after its last confirmation, so a listed day is not a confirmation. A listener no longer in the feed is drawn to its last confirmation.

Listed days as dates
  • 2026-09-27 – 2026-10-30 (34 days)

Evidence

Each certificate, configuration and file appears once, with the listeners that carried it.

TLS certificate abe2d6c32d53

On :18443.

tls certificateabe2d6c32d53a7edd5f39e7abdffa8306bcbcc1cd6ca9c48648a1750f72c5026
cert subjectGoogle Spider
cert subject orgAlphabet Inc
cert issuerGoogle Spider
cert issuer orgAlphabet Inc
cert validity2026-09-06 → 2027-09-06
cert typeself-signed
cert key2048-bit
cert serial (hex)737af65c
cert serial (decimal)1937438300

The names above are what the certificate claims, not proof that this host owns them. Treat a familiar name as a likely impersonation.

Beacon configurations

2 configurations on 2 listeners. Common to both:

callback42.51.44.173 · same as this host
cs versionCobalt Strike 4.9 (Sep 19, 2023)
getGET /api/v1/get
postPOST /api/v1/post
user-agentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sleep15s ±45%
watermark666666666
server key md5ca1c5ee4c6f4451759972387cacad5ac
inject stube781a4479f7c5a03b2dcfe4bd436366f
spawn to x86%allusersprofile%\CrashReport\CrashReport.exe
spawn to x64%allusersprofile%\CrashReport\CrashReport64.exe

Each configuration calls back on its own listener’s port. Where they differ:

Configurationbeacon type
Beacon 1 · :18888HTTP
Beacon 2 · :18443HTTPS

Listeners

Each listener below shows its status and what sets it apart. Dates are in Ports; certificates, configurations and files in Evidence. Common to all 3 listeners:

serviceip-port · tcp
networkAS56005 · Zhengzhou Fastidc Technology

42.51.44.173:55555 · Oktos

listed

confidence95 / 100

42.51.44.173:18888 · Cobalt Strike

listed · beacon 1

confidence98 / 100

42.51.44.173:18443 · Cobalt Strike

listed · certificate abe2d6c32d53 · beacon 2

confidence100 / 100
jarm2ad2ad16d2ad2ad00042d42d00042ddb04deffa1705e2edc44cae1ed24a4da

Hosts sharing a value with this one

453 other hosts in this archive share at least one value with this one. Each is listed once, under its first shared value in Relations order. Dates and status are from the records that share a value. Showing the 40 that rank first.

AddressFamilySharesLast confirmedStatus
Cobalt Strike server key · 32 other hosts · 32 listed

Every beacon carries its team server’s public key. Hosts sharing one were set up from the same server installation, or from a leaked or cracked copy that ships its key file, so it is not evidence of a single operator.

8.163.59.20Cobalt Strikeserver key · JA4X template · watermarklisted
192.252.185.78Cobalt Strikeserver key · JA4X template · watermarklisted
47.109.23.77Cobalt Strikeserver key · JA4X template · watermarklisted
113.250.188.15Cobalt Strikeserver key · JA4X template · watermarklisted
8.152.212.104Cobalt Strikeserver key · JA4X template · watermarklisted
47.120.32.72Cobalt Strikeserver key · JA4X template · watermarklisted
43.136.92.170Cobalt Strikeserver key · JA4X template · watermarklisted
49.235.158.141Cobalt Strikeserver key · JA4X template · watermarklisted
137.220.194.15Cobalt Strikeserver key · JA4X template · watermarklisted
47.92.208.27Cobalt Strikeserver key · JA4X template · watermarklisted
104.143.204.78Cobalt Strikeserver key · JA4X template · watermarklisted
150.158.102.111Cobalt Strikeserver key · JA4X template · watermarklisted
43.138.116.60Cobalt Strikeserver key · JA4X template · watermarklisted
45.203.213.168Cobalt Strikeserver key · JA4X template · watermarklisted
149.30.232.29Cobalt Strikeserver key · JA4X template · watermarklisted
114.215.188.153Cobalt Strikeserver key · JA4X template · watermarklisted
191.223.41.183Cobalt Strikeserver key · JA4X template · watermarklisted
192.252.179.24Cobalt Strikeserver key · JA4X template · watermarklisted
47.94.224.229Cobalt Strikeserver key · JA4X template · watermarklisted
175.27.214.144Cobalt Strikeserver key · JA4X template · watermarklisted
102.134.35.205Cobalt Strikeserver key · watermarklisted
162.14.122.146Cobalt Strikeserver key · watermarklisted
43.167.177.224Cobalt Strikeserver key · watermarklisted
8.159.146.72Cobalt Strikeserver key · watermarklisted
47.236.149.142Cobalt Strikeserver key · watermarklisted
198.44.116.156Cobalt Strikeserver key · watermarklisted
103.236.84.103Cobalt Strikeserver key · watermarklisted
1.117.61.139Cobalt Strikeserver key · watermarklisted
117.72.125.206Cobalt Strikeserver key · watermarklisted
39.98.116.82Cobalt Strikeserver key · watermarklisted
39.102.125.11Cobalt Strikeserver key · watermarklisted
207.57.123.57Cobalt Strikeserver key · watermarklisted
JA4X template · 420 other hosts · 417 listed

These hosts’ certificates share one JA4X template, which points to the same certificate tooling. It is not evidence of a single operator.

Of these, 20 are listed under an earlier value and 392 are past the 40 hosts shown.

38.76.219.253Cobalt StrikeJA4X templatelisted
117.72.182.5Cobalt StrikeJA4X template · watermarklisted
49.232.42.116Cobalt StrikeJA4X templatelisted
156.239.252.191Cobalt StrikeJA4X templatelisted
47.105.36.109Cobalt StrikeJA4X templatelisted
85.175.101.203Cobalt StrikeJA4X templatelisted
47.251.177.187Cobalt StrikeJA4X templatelisted
101.42.255.92Cobalt StrikeJA4X template · watermarklisted
Cobalt Strike watermark · 89 other hosts · 89 listed

The watermark identifies the Cobalt Strike licence a beacon was built with. Cracked and leaked builds share watermarks widely, so it is not evidence of a single operator.

Of these, 34 are listed under an earlier value and 55 are past the 40 hosts shown.

Samples served · 2 files

Files this address was seen serving, each identified by running or analysing it. A widely distributed file can reach unrelated hosts.

FileConfirmedDelivered onFile last seen
6478ed24e474e20ba3769a0a3ee60a48e328bdbce70b09df068211fbc79fba66analysed:18443
713c94402801bfb16066c9a2cff85ac784147ffe73ca411c73554981df4a1b21analysed:18888

Deploy

Suricata rules and hunt queries for this address’s 3 listed listeners.

Suricata rules

Each query searches the last 30 days of your logs for connections to these listeners and for the 2 files this address served. Queries hold only addresses, ports and file hashes.

Microsoft Defender XDR (KQL)
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where (RemoteIP == "42.51.44.173" and RemotePort in (18443, 18888, 55555))
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in ("6478ed24e474e20ba3769a0a3ee60a48e328bdbce70b09df068211fbc79fba66", "713c94402801bfb16066c9a2cff85ac784147ffe73ca411c73554981df4a1b21")
Microsoft Sentinel (KQL)
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where (DestinationIP == "42.51.44.173" and DestinationPort in (18443, 18888, 55555))
Splunk (SPL, CIM data models)
| tstats summariesonly=false count min(_time) as first_time max(_time) as last_time
    from datamodel=Network_Traffic where earliest=-30d
    ((All_Traffic.dest_ip="42.51.44.173" (All_Traffic.dest_port=18443 OR All_Traffic.dest_port=18888 OR All_Traffic.dest_port=55555)))
    by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port
| tstats summariesonly=false count min(_time) as first_time max(_time) as last_time
    from datamodel=Endpoint.Filesystem where earliest=-30d
    (Filesystem.file_hash="6478ed24e474e20ba3769a0a3ee60a48e328bdbce70b09df068211fbc79fba66" OR Filesystem.file_hash="713c94402801bfb16066c9a2cff85ac784147ffe73ca411c73554981df4a1b21")
    by Filesystem.dest Filesystem.file_path Filesystem.file_hash
Elastic (EQL)
network where
  (destination.ip == "42.51.44.173" and destination.port in (18443, 18888, 55555))
file where file.hash.sha256 in ("6478ed24e474e20ba3769a0a3ee60a48e328bdbce70b09df068211fbc79fba66", "713c94402801bfb16066c9a2cff85ac784147ffe73ca411c73554981df4a1b21")

Cite this record

Plain text, for a ticket or a report
Address 42.51.44.173 Family Oktos, Cobalt Strike Ports :18443, :18888, :55555 Status listed (feed checked 2026-10-30 18:37 UTC) First seen 2026-09-27 Last confirmed 2026-10-05 Record https://publicmosaic.com/ip/42.51.44.173 Source Public Mosaic, TLP:CLEAR