Public Mosaic C2 indicators
confirmed host

47.108.225.4

Cobalt StrikeVShellcontrollers · :50050, :8084, :8080

On AS37963.

listed last confirmed feed checked TLP:CLEAR Suricata rules Show in the live feed

Relations

Values this address shares with other hosts in this archive, rarest first, watermarks last. A shared value says the hosts were set up alike, not that one operator runs them.

SharedValueOther hosts
Cobalt Strike watermark66666666689 other hosts · 89 listed

A Cobalt Strike watermark is a weak link: cracked and leaked builds share one.

Not shared with any other host in this archive: 1 server key.

Network context

SharedValueOther hosts
NetworkAS37963 · Hangzhou Alibaba Advertising431 other hosts · 430 listed

Hosts near this one, for context only.

Summary

First seen by the scanner2026-09-17
In this archive since2026-09-17
Ports3 · 3 listed
Evidence2 beacon configurations · 1 recovered configuration · 5 files served
Look up elsewhereVirusTotal · Shodan · Censys
About this listingWhat a listing means · Is this your address?

Ports

This address answered on 3 ports, across 2 families. First seen and last confirmed dates are per row, by UTC day.

PortFamilyFirst seenLast confirmedStatusConfiguration
:50050 · Cobalt Strike team-server defaultCobalt Strikelistedbeacon 1
:8084VShelllistedconfig 1
:8080 · alt-HTTPCobalt Strikelistedbeacon 2

Observation history

Listed on 44 of the 63 days since this archive began recording, 2026-08-29 UTC.

  1. listed
  2. :50050
  3. :8084
  4. :8080

2026-08-292026-10-30

  • first seen to last confirmed

A marked day is a UTC day the feed listed this address. The feed keeps a listener for up to 90 days after its last confirmation, so a listed day is not a confirmation. A listener no longer in the feed is drawn to its last confirmation.

Listed days as dates
  • 2026-09-17 – 2026-10-30 (44 days)

Evidence

Each certificate, configuration and file appears once, with the listeners that carried it.

Beacon configurations

2 configurations on 2 listeners. Common to both:

beacon typeHTTP
cs versionCobalt Strike 4.9 (Sep 19, 2023)
getGET /link/v4.42/XWFZH1JA
postPOST /Forge/mysql/TJ8A38EX
user-agentMozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4
sleep20s ±41%
watermark666666666
server key md5d0f979f3904f7833b51fe06331c9f372
inject stube781a4479f7c5a03b2dcfe4bd436366f
spawn to x86%windir%\syswow64\grpconv.exe
spawn to x64%windir%\sysnative\svchost.exe -k wksvc

Each configuration calls back on its own listener’s port. Where they differ:

Configurationcallback
Beacon 1 · :5005047.108.225.4 · same as this host
Beacon 2 · :8080192.168.1.133 · set in the beacon by its builder; may be a redirector or a borrowed name

Config 1 · VShell configuration

On :8084.

Settings recovered from a captured sample whose configuration names this address. They describe the sample, not a live reading of this address.

c2 host47.108.225.4 · same as this host
c2 port8084

Listeners

Each listener below shows its status and what sets it apart. Dates are in Ports; certificates, configurations and files in Evidence. Common to all 3 listeners:

serviceip-port · tcp
networkAS37963 · Hangzhou Alibaba Advertising
confidence100 / 100

47.108.225.4:50050 · Cobalt Strike

listed · beacon 1

47.108.225.4:8084 · VShell

listed · config 1

47.108.225.4:8080 · Cobalt Strike

listed · beacon 2

Hosts sharing a value with this one

89 other hosts in this archive share at least one value with this one. Each is listed once, under its first shared value in Relations order. Dates and status are from the records that share a value. Showing the 40 that rank first.

AddressFamilySharesLast confirmedStatus
Cobalt Strike watermark · 89 other hosts · 89 listed

The watermark identifies the Cobalt Strike licence a beacon was built with. Cracked and leaked builds share watermarks widely, so it is not evidence of a single operator.

Of these, 49 are past the 40 hosts shown.

36.93.147.195Cobalt Strikewatermarklisted
8.163.59.20Cobalt Strikewatermarklisted
117.72.182.5Cobalt Strikewatermarklisted
192.252.185.78Cobalt Strikewatermarklisted
102.134.35.205Cobalt Strikewatermarklisted
47.109.23.77Cobalt Strikewatermarklisted
113.250.188.15Cobalt Strikewatermarklisted
101.42.255.92Cobalt Strikewatermarklisted
8.152.212.104Cobalt Strikewatermarklisted
154.12.86.154Cobalt Strikewatermarklisted
47.120.32.72Cobalt Strikewatermarklisted
82.156.186.185Cobalt Strikewatermarklisted
49.232.21.222Cobalt Strikewatermarklisted
111.228.5.127Cobalt Strikewatermarklisted
106.53.168.218Cobalt Strikewatermarklisted
85.11.182.104Cobalt Strikewatermarklisted
156.254.20.48Cobalt Strikewatermarklisted
156.254.20.47Cobalt Strikewatermarklisted
162.14.122.146Cobalt Strikewatermarklisted
156.254.20.46Cobalt Strikewatermarklisted
1.117.74.144Cobalt Strikewatermarklisted
124.220.22.82Cobalt Strikewatermarklisted
154.219.115.123Cobalt Strikewatermarklisted
43.167.177.224Cobalt Strikewatermarklisted
43.136.92.170Cobalt Strikewatermarklisted
8.159.146.72Cobalt Strikewatermarklisted
106.75.7.239Cobalt Strikewatermarklisted
49.235.158.141Cobalt Strikewatermarklisted
1.92.135.168Cobalt Strikewatermarklisted
47.236.149.142Cobalt Strikewatermarklisted
198.44.116.156Cobalt Strikewatermarklisted
139.196.111.118Cobalt Strikewatermarklisted
43.142.137.169Cobalt Strikewatermarklisted
47.109.103.59VShellwatermarklisted
118.25.147.157Cobalt Strikewatermarklisted
175.124.145.102Cobalt Strikewatermarklisted
103.236.84.103Cobalt Strikewatermarklisted
8.156.80.127Cobalt Strikewatermarklisted
137.220.194.15Cobalt Strikewatermarklisted
116.62.44.146Cobalt Strikewatermarklisted

Samples served · 5 files

Files this address was seen serving, each identified by running or analysing it. A widely distributed file can reach unrelated hosts.

3 of the 5 files are configured to connect to this address on :8084.

FileFamilyConfirmedDelivered onFile last seen
8664c6ff078d8d4c2ac1c943b94323de2aa6c7ac2a6045b708ffc18acb437bcaCobalt Strikeanalysed:8080
c963bd1c1c0d4f75aeb13140ca2c91e9f9d0b2eabf9222a08e9bd103f77c6c52Cobalt Strikeanalysed:50050
b4d4dac158d2bde5b0de97bf33dfdbacda9b075ff21dee2458718d5071718868VShellanalysed:8084
26fdd0a4532cda467feb798265ee52e2545f351d4e4da3b03d441d5434c51ef1VShellanalysed:8084
83c6c46bc60cb3a7e9e24df539a5afff7d0ad0c89d9c516f0d39370f67a1fa42VShellanalysed:8084

3 of the 5 files are VShell loaders whose configuration was read from the file. A VShell loader’s only configuration is the address and port it calls. The listener key (vkey) and the salt arrive from the listener when the loader connects, so only sandbox runs that reached a live listener show them.

Deploy

Suricata rules and hunt queries for this address’s 3 listed listeners.

Suricata rules

Each query searches the last 30 days of your logs for connections to these listeners and for the 5 files this address served. Queries hold only addresses, ports and file hashes.

Microsoft Defender XDR (KQL)
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where (RemoteIP == "47.108.225.4" and RemotePort in (8080, 8084, 50050))
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in ("26fdd0a4532cda467feb798265ee52e2545f351d4e4da3b03d441d5434c51ef1", "83c6c46bc60cb3a7e9e24df539a5afff7d0ad0c89d9c516f0d39370f67a1fa42", "8664c6ff078d8d4c2ac1c943b94323de2aa6c7ac2a6045b708ffc18acb437bca", "b4d4dac158d2bde5b0de97bf33dfdbacda9b075ff21dee2458718d5071718868", "c963bd1c1c0d4f75aeb13140ca2c91e9f9d0b2eabf9222a08e9bd103f77c6c52")
Microsoft Sentinel (KQL)
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where (DestinationIP == "47.108.225.4" and DestinationPort in (8080, 8084, 50050))
Splunk (SPL, CIM data models)
| tstats summariesonly=false count min(_time) as first_time max(_time) as last_time
    from datamodel=Network_Traffic where earliest=-30d
    ((All_Traffic.dest_ip="47.108.225.4" (All_Traffic.dest_port=8080 OR All_Traffic.dest_port=8084 OR All_Traffic.dest_port=50050)))
    by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port
| tstats summariesonly=false count min(_time) as first_time max(_time) as last_time
    from datamodel=Endpoint.Filesystem where earliest=-30d
    (Filesystem.file_hash="26fdd0a4532cda467feb798265ee52e2545f351d4e4da3b03d441d5434c51ef1" OR Filesystem.file_hash="83c6c46bc60cb3a7e9e24df539a5afff7d0ad0c89d9c516f0d39370f67a1fa42" OR Filesystem.file_hash="8664c6ff078d8d4c2ac1c943b94323de2aa6c7ac2a6045b708ffc18acb437bca" OR Filesystem.file_hash="b4d4dac158d2bde5b0de97bf33dfdbacda9b075ff21dee2458718d5071718868" OR Filesystem.file_hash="c963bd1c1c0d4f75aeb13140ca2c91e9f9d0b2eabf9222a08e9bd103f77c6c52")
    by Filesystem.dest Filesystem.file_path Filesystem.file_hash
Elastic (EQL)
network where
  (destination.ip == "47.108.225.4" and destination.port in (8080, 8084, 50050))
file where file.hash.sha256 in ("26fdd0a4532cda467feb798265ee52e2545f351d4e4da3b03d441d5434c51ef1", "83c6c46bc60cb3a7e9e24df539a5afff7d0ad0c89d9c516f0d39370f67a1fa42", "8664c6ff078d8d4c2ac1c943b94323de2aa6c7ac2a6045b708ffc18acb437bca", "b4d4dac158d2bde5b0de97bf33dfdbacda9b075ff21dee2458718d5071718868", "c963bd1c1c0d4f75aeb13140ca2c91e9f9d0b2eabf9222a08e9bd103f77c6c52")

Cite this record

Plain text, for a ticket or a report
Address 47.108.225.4 Family Cobalt Strike, VShell Ports :8080, :8084, :50050 Status listed (feed checked 2026-10-30 20:07 UTC) First seen 2026-09-17 Last confirmed 2026-10-30 Record https://publicmosaic.com/ip/47.108.225.4 Source Public Mosaic, TLP:CLEAR