Public Mosaic C2 indicators
confirmed host

8.146.227.247

VShellCobalt Strikecontrollers · :8084, :8092, :8090, :80

On AS37963.

listed last confirmed feed checked TLP:CLEAR Suricata rules Show in the live feed

Relations

Values this address shares with other hosts in this archive, rarest first, watermarks last. A shared value says the hosts were set up alike, not that one operator runs them.

SharedValueOther hosts
Cobalt Strike watermark987654321166 other hosts · 166 listed

A Cobalt Strike watermark is a weak link: cracked and leaked builds share one.

Not shared with any other host in this archive: 1 server key.

Network context

SharedValueOther hosts
NetworkAS37963 · Hangzhou Alibaba Advertising431 other hosts · 430 listed

Hosts near this one, for context only.

Summary

First seen by the scanner2026-09-17
In this archive since2026-09-17
Ports4 · 4 listed
Evidence2 beacon configurations · 2 recovered configurations · 8 files served
Look up elsewhereVirusTotal · Shodan · Censys
About this listingWhat a listing means · Is this your address?

Ports

This address answered on 4 ports, across 2 families. First seen and last confirmed dates are per row, by UTC day.

PortFamilyFirst seenLast confirmedStatusConfiguration
:8084VShelllistedconfig 1
:8092VShelllistedconfig 2
:8090Cobalt Strikelistedbeacon 1
:80Cobalt Strikelistedbeacon 2

Observation history

Listed on 44 of the 63 days since this archive began recording, 2026-08-29 UTC.

  1. listed
  2. :8084 and 1 more
  3. :8090 and 1 more

2026-08-292026-10-30

  • first seen to last confirmed

A marked day is a UTC day the feed listed this address. The feed keeps a listener for up to 90 days after its last confirmation, so a listed day is not a confirmation. A listener no longer in the feed is drawn to its last confirmation.

Listed days as dates
  • 2026-09-17 – 2026-10-30 (44 days)

Evidence

Each certificate, configuration and file appears once, with the listeners that carried it.

Beacon configurations

2 configurations on 2 listeners. Common to both:

callback8.146.227.247 · same as this host
beacon typeHTTP
cs versionCobalt Strike 4.9 (Sep 19, 2023)
postPOST /submit.php
sleep60s ±0%
watermark987654321
server key md547bcfc91048627e25d209e3c1c3ce28f
inject stubae5afcfee8026674dc8f3b4f2da46c7f
spawn to x86%windir%\syswow64\rundll32.exe
spawn to x64%windir%\sysnative\rundll32.exe

Each configuration calls back on its own listener’s port. Where they differ:

Configurationgetuser-agent
Beacon 1 · :8090GET /activityMozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)
Beacon 2 · :80GET /ptjMozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MASB)

VShell configurations

Settings recovered from a captured sample whose configuration names this address. They describe the sample, not a live reading of this address.

2 configurations on 2 listeners. Common to both:

c2 host8.146.227.247 · same as this host

Where they differ:

Configurationc2 port
Config 1 · :80848084
Config 2 · :80928092

Listeners

Each listener below shows its status and what sets it apart. Dates are in Ports; certificates, configurations and files in Evidence. Common to all 4 listeners:

serviceip-port · tcp
networkAS37963 · Hangzhou Alibaba Advertising
confidence100 / 100

8.146.227.247:8084 · VShell

listed · config 1

8.146.227.247:8092 · VShell

listed · config 2

8.146.227.247:8090 · Cobalt Strike

listed · beacon 1

8.146.227.247:80 · Cobalt Strike

listed · beacon 2

Hosts sharing a value with this one

166 other hosts in this archive share at least one value with this one. Each is listed once, under its first shared value in Relations order. Dates and status are from the records that share a value. Showing the 40 that rank first.

AddressFamilySharesLast confirmedStatus
Cobalt Strike watermark · 166 other hosts · 166 listed

The watermark identifies the Cobalt Strike licence a beacon was built with. Cracked and leaked builds share watermarks widely, so it is not evidence of a single operator.

Of these, 126 are past the 40 hosts shown.

101.200.193.211Cobalt Strikewatermarklisted
119.45.160.160Cobalt Strikewatermarklisted
85.175.101.203Cobalt Strikewatermarklisted
111.231.116.164Cobalt Strikewatermarklisted
165.154.225.239Cobalt Strikewatermarklisted
43.108.51.124Cobalt Strikewatermarklisted
222.255.215.42Cobalt Strikewatermarklisted
179.43.186.214Cobalt Strikewatermarklisted
111.170.148.141Cobalt Strikewatermarklisted
106.13.189.138Cobalt Strikewatermarklisted
82.158.89.75Cobalt Strikewatermarklisted
82.158.89.214Cobalt Strikewatermarklisted
49.51.230.17Cobalt Strikewatermarklisted
38.76.183.197Cobalt Strikewatermarklisted
23.238.82.42Cobalt Strikewatermarklisted
183.60.226.2Cobalt Strikewatermarklisted
124.223.188.23Cobalt Strikewatermarklisted
8.163.98.217Cobalt Strikewatermarklisted
46.19.140.50Cobalt Strikewatermarklisted
43.203.112.69Cobalt Strikewatermarklisted
38.76.190.209Cobalt Strikewatermarklisted
20.109.163.207Cobalt Strikewatermarklisted
175.178.126.48Cobalt Strikewatermarklisted
118.126.95.117Cobalt Strikewatermarklisted
117.72.220.70Cobalt Strikewatermarklisted
106.55.253.229Cobalt Strikewatermarklisted
101.35.217.145Cobalt Strikewatermarklisted
14.225.212.124Cobalt Strikewatermarklisted
154.37.218.73Cobalt Strikewatermarklisted
115.190.250.28Cobalt Strikewatermarklisted
120.55.93.58Cobalt Strikewatermarklisted
101.34.208.175Cobalt Strikewatermarklisted
45.192.248.45Cobalt Strikewatermarklisted
118.89.79.131Cobalt Strikewatermarklisted
43.139.108.161Cobalt Strikewatermarklisted
101.42.136.73Cobalt Strikewatermarklisted
192.255.248.153Cobalt Strikewatermarklisted
150.187.25.242Cobalt Strikewatermarklisted
217.194.133.89Cobalt Strikewatermarklisted
114.215.184.158Cobalt Strikewatermarklisted

Samples served · 8 files

Files this address was seen serving, each identified by running or analysing it. A widely distributed file can reach unrelated hosts.

These files are configured to connect to this address: 3 files on :8084, 3 files on :8092. A file naming two ports counts under each.

FileFamilyConfirmedDelivered onFile last seen
403d943bb97915668a79cc5c3c4170c7f3dbddc4aed50b9dc72b851495fe8644Cobalt Strikeanalysed:8090
fe1d45c2c4a4c088d29cf686656ab514df50b21441cfdb2515cf91fe50cc13d5Cobalt Strikeanalysed:80
462ed62b2baaac9ab5e0a412e7f4d0bae95a0a6f963e553874219438220ccd63VShellanalysed:8092
0c3a67c118b16ee5d3b09ae004d629f92a9638a5e90dda955f05a41f39843142VShellanalysed:8084
46c2b4e86dcdd9b10dc272a4e0118fa93f66693eca579776cfbe03c4b3e20eacVShellanalysed:8092
a3d8be36fa3f9be1bdc56225761de3f6f687d5def41dd75d184dd38ceb8f6c14VShellanalysed:8084
2a02c3ec1d198c0b81301b47173a72a64a0472e8bc031df3f92e8ca48cc07c85VShellanalysed:8084
aa50d9298eec17e0e072c06b07a7e5c4ba341258e6575c6b4f110344986dd82dVShellanalysed:8092

6 of the 8 files are VShell loaders whose configuration was read from the file. A VShell loader’s only configuration is the address and port it calls. The listener key (vkey) and the salt arrive from the listener when the loader connects, so only sandbox runs that reached a live listener show them.

Deploy

Suricata rules and hunt queries for this address’s 4 listed listeners.

Suricata rules

Each query searches the last 30 days of your logs for connections to these listeners and for the 8 files this address served. Queries hold only addresses, ports and file hashes.

Microsoft Defender XDR (KQL)
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where (RemoteIP == "8.146.227.247" and RemotePort in (80, 8084, 8090, 8092))
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in ("0c3a67c118b16ee5d3b09ae004d629f92a9638a5e90dda955f05a41f39843142", "2a02c3ec1d198c0b81301b47173a72a64a0472e8bc031df3f92e8ca48cc07c85", "403d943bb97915668a79cc5c3c4170c7f3dbddc4aed50b9dc72b851495fe8644", "462ed62b2baaac9ab5e0a412e7f4d0bae95a0a6f963e553874219438220ccd63", "46c2b4e86dcdd9b10dc272a4e0118fa93f66693eca579776cfbe03c4b3e20eac", "a3d8be36fa3f9be1bdc56225761de3f6f687d5def41dd75d184dd38ceb8f6c14", "aa50d9298eec17e0e072c06b07a7e5c4ba341258e6575c6b4f110344986dd82d", "fe1d45c2c4a4c088d29cf686656ab514df50b21441cfdb2515cf91fe50cc13d5")
Microsoft Sentinel (KQL)
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where (DestinationIP == "8.146.227.247" and DestinationPort in (80, 8084, 8090, 8092))
Splunk (SPL, CIM data models)
| tstats summariesonly=false count min(_time) as first_time max(_time) as last_time
    from datamodel=Network_Traffic where earliest=-30d
    ((All_Traffic.dest_ip="8.146.227.247" (All_Traffic.dest_port=80 OR All_Traffic.dest_port=8084 OR All_Traffic.dest_port=8090 OR All_Traffic.dest_port=8092)))
    by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port
| tstats summariesonly=false count min(_time) as first_time max(_time) as last_time
    from datamodel=Endpoint.Filesystem where earliest=-30d
    (Filesystem.file_hash="0c3a67c118b16ee5d3b09ae004d629f92a9638a5e90dda955f05a41f39843142" OR Filesystem.file_hash="2a02c3ec1d198c0b81301b47173a72a64a0472e8bc031df3f92e8ca48cc07c85" OR Filesystem.file_hash="403d943bb97915668a79cc5c3c4170c7f3dbddc4aed50b9dc72b851495fe8644" OR Filesystem.file_hash="462ed62b2baaac9ab5e0a412e7f4d0bae95a0a6f963e553874219438220ccd63" OR Filesystem.file_hash="46c2b4e86dcdd9b10dc272a4e0118fa93f66693eca579776cfbe03c4b3e20eac" OR Filesystem.file_hash="a3d8be36fa3f9be1bdc56225761de3f6f687d5def41dd75d184dd38ceb8f6c14" OR Filesystem.file_hash="aa50d9298eec17e0e072c06b07a7e5c4ba341258e6575c6b4f110344986dd82d" OR Filesystem.file_hash="fe1d45c2c4a4c088d29cf686656ab514df50b21441cfdb2515cf91fe50cc13d5")
    by Filesystem.dest Filesystem.file_path Filesystem.file_hash
Elastic (EQL)
network where
  (destination.ip == "8.146.227.247" and destination.port in (80, 8084, 8090, 8092))
file where file.hash.sha256 in ("0c3a67c118b16ee5d3b09ae004d629f92a9638a5e90dda955f05a41f39843142", "2a02c3ec1d198c0b81301b47173a72a64a0472e8bc031df3f92e8ca48cc07c85", "403d943bb97915668a79cc5c3c4170c7f3dbddc4aed50b9dc72b851495fe8644", "462ed62b2baaac9ab5e0a412e7f4d0bae95a0a6f963e553874219438220ccd63", "46c2b4e86dcdd9b10dc272a4e0118fa93f66693eca579776cfbe03c4b3e20eac", "a3d8be36fa3f9be1bdc56225761de3f6f687d5def41dd75d184dd38ceb8f6c14", "aa50d9298eec17e0e072c06b07a7e5c4ba341258e6575c6b4f110344986dd82d", "fe1d45c2c4a4c088d29cf686656ab514df50b21441cfdb2515cf91fe50cc13d5")

Cite this record

Plain text, for a ticket or a report
Address 8.146.227.247 Family VShell, Cobalt Strike Ports :80, :8084, :8090, :8092 Status listed (feed checked 2026-10-30 18:37 UTC) First seen 2026-09-17 Last confirmed 2026-10-30 Record https://publicmosaic.com/ip/8.146.227.247 Source Public Mosaic, TLP:CLEAR