Cobalt Strike
Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”.
9New IOCs · 24h
57New IOCs · 7 days
1,744Indicators tracked
5Independent feeds
2026-10-12 08:05Last activity
New indicators per day
2026-09-29 to 2026-10-12, by first report.
- IP821
- Domain759
- Hash12
- URL1
- TLS cert151
- C21,731
- Malware13
MITRE ATT&CK lists this as malware Cobalt Strike. Explore the ATT&CK matrix →
Where its infrastructure is hosted
Latest indicators
Filter the live feed →| First seen | Type | Indicator | Role | Where |
|---|---|---|---|---|
| 2026-10-12 08:05 | IP | 43.136.92[.]170:22 | Botnet C2 | — |
| 2026-10-12 06:11 | IP | 100.57.32[.]60:8443 | Botnet C2 | — |
| 2026-10-12 06:11 | IP | 3.98.91[.]44:443 | Botnet C2 | — |
| 2026-10-12 04:05 | IP | 118.126.95[.]117:443 | Botnet C2 | — |
| 2026-10-11 19:05 | IP | 160.191.52[.]105:45893 | Botnet C2 | — |
| 2026-10-11 15:05 | IP | 129.121.140[.]89:8080 | Botnet C2 | — |
| 2026-10-11 14:05 | IP | 114.215.184[.]158:7000 | Botnet C2 | — |
| 2026-10-11 14:05 | IP | 101.35.247[.]212:8081 | Botnet C2 | — |
| 2026-10-11 09:05 | IP | 49.235.158[.]141:7777 | Botnet C2 | — |
| 2026-10-11 07:02 | IP | 23.100.98[.]39:10443 | Botnet C2 | — |
| 2026-10-11 07:02 | IP | 157.254.167[.]61:443 | Botnet C2 | — |
| 2026-10-11 04:35 | IP | 43.139.173[.]26 | Botnet C2 | — |
| 2026-10-10 16:15 | IP | 156.67.105[.]187:5698 | Botnet C2 | — |
| 2026-10-10 14:41 | SHA256 | d96464b13eac20ad12520e3b81ee9154a8bb5c75ce1baaa3146b633ee83abc99 | Malware sample | — |
| 2026-10-10 14:05 | IP | 198.46.143[.]15:8080 | Botnet C2 | — |
| 2026-10-10 13:46 | IP | 45.227.253[.]132:58993 | Botnet C2 | — |
| 2026-10-10 13:46 | IP | 43.139.173[.]26:13588 | Botnet C2 | — |
| 2026-10-10 13:40 | SHA256 | d4ad9bcfd4c1dc7034bb946f360ed1fe2f34b276145a48a4d24da6b8f9f5b839 | Malware sample | — |
| 2026-10-10 11:40 | SHA256 | a09a3b0eae9ac84b4d40f079a86bafdb3320fa628b84366aad883b83bd25aeca | Malware sample | — |
| 2026-10-10 07:05 | IP | 39.96.65[.]0:8888 | Botnet C2 | — |
| 2026-10-10 04:30 | IP | 101.133.225[.]51 | Botnet C2 | — |
| 2026-10-10 04:30 | IP | 8.162.1[.]240 | Botnet C2 | — |
| 2026-10-10 04:30 | Domain | pull[.]portal[.]10086[.]cn | Botnet C2 | — |
| 2026-10-09 19:05 | IP | 120.76.143[.]184:9999 | Botnet C2 | — |
| 2026-10-09 10:48 | IP | 185.212.44[.]20:443 | Payload delivery | — |
| 2026-10-09 08:19 | IP | 103.72.56[.]236:443 | Botnet C2 | — |
| 2026-10-09 08:19 | IP | 39.106.221[.]81:8088 | Botnet C2 | — |
| 2026-10-09 08:19 | IP | 91.199.133[.]239:443 | Botnet C2 | — |
| 2026-10-09 08:19 | IP | 101.133.170[.]144:81 | Botnet C2 | — |
| 2026-10-09 04:28 | IP | 1.12.253[.]219 | Botnet C2 | — |
| 2026-10-09 04:28 | IP | 124.221.191[.]237 | Botnet C2 | — |
| 2026-10-09 04:28 | IP | 43.138.221[.]218 | Botnet C2 | — |
| 2026-10-09 04:28 | IP | 45.207.8[.]36 | Botnet C2 | — |
| 2026-10-09 04:28 | IP | 47.113.98[.]42 | Botnet C2 | — |
| 2026-10-09 04:28 | IP | 49.235.158[.]141 | Botnet C2 | — |
| 2026-10-09 04:28 | Domain | dns1[.]dreamls[.]com | Botnet C2 | — |
| 2026-10-09 04:28 | Domain | dns2[.]dreamls[.]com | Botnet C2 | — |
| 2026-10-09 04:28 | Domain | update[.]microsofthk[.]com | Botnet C2 | — |
| 2026-10-09 04:28 | Domain | update[.]microsoftkernel[.]com | Botnet C2 | — |
| 2026-10-09 03:45 | IP | 124.221.191[.]237:3668 | Botnet C2 | — |
| 2026-10-09 03:45 | IP | 1.12.253[.]219:443 | Botnet C2 | — |
| 2026-10-08 23:45 | IP | 45.207.8[.]36:53 | Botnet C2 | — |
| 2026-10-08 13:46 | IP | 43.138.221[.]218:443 | Botnet C2 | — |
| 2026-10-08 08:05 | IP | 132.243.172[.]224:80 | Botnet C2 | — |
| 2026-10-08 05:33 | IP | 31.207.4[.]106:443 | Botnet C2 | — |
| 2026-10-08 04:48 | SHA256 | d75158e09c2a7ccb13029bc2e04f68bccda7873b6846dc4ee7ec8a35b9cce5a1 | Malware sample | — |
| 2026-10-07 17:35 | URL | hxxp://69[.]49[.]229[.]88:443/MQEw | Botnet C2 | — |
| 2026-10-07 16:59 | SHA256 | 07be0afdd645d8d0f8ccb48fa873932711325412adb9acf2179bda7bc6fa53f2 | Malware sample | — |
| 2026-10-07 06:05 | IP | 154.12.17[.]20:8080 | Botnet C2 | — |
| 2026-10-07 03:46 | IP | 129.204.55[.]230:443 | Botnet C2 | — |
| 2026-10-06 19:46 | IP | 47.94.56[.]71:443 | Botnet C2 | — |
| 2026-10-06 13:45 | IP | 117.158.148[.]164:65535 | Botnet C2 | — |
| 2026-10-06 09:45 | IP | 188.227.14[.]105:8080 | Botnet C2 | — |
| 2026-10-06 05:27 | IP | 186.241.115[.]168:12443 | Botnet C2 | — |
| 2026-10-06 03:45 | IP | 109.206.247[.]245:10881 | Botnet C2 | — |
| 2026-10-05 20:05 | IP | 43.134.112[.]45:7500 | Botnet C2 | — |
| 2026-10-05 19:57 | SHA256 | 81883bede526e686d7739be06ae32c73f78058a1603f1756c3263162452793f8 | Malware sample | — |
| 2026-10-05 02:33 | SHA1 | 2ff26540ebb9100dae76a2ae040108ba9338113c | payload | — |
| 2026-10-05 02:33 | MD5 | e4a34372eab0832d0682fa986a8e0b97 | payload | — |
| 2026-10-05 02:33 | SHA256 | 224aec5fec1f907ce152895095f56a3a2f2db0d627633ee691af56a13f34e7f8 | payload | — |
| 2026-10-05 02:33 | SHA1 | b5019015ada1f9212aef477b2e7b5a2fb0ed07af | payload | — |
| 2026-10-05 02:33 | MD5 | c41354155dc082e2cd6db84a69b35c28 | payload | — |
| 2026-10-05 02:33 | SHA256 | 35afe2df347cb0909fdf2aba8ed6a506a681518a98c0a723b25a16957437f944 | payload | — |
| 2026-10-04 08:05 | IP | 106.55.253[.]229:80 | Botnet C2 | — |
| 2026-10-03 13:45 | IP | 144.172.68[.]200:443 | Botnet C2 | — |
| 2026-10-03 13:45 | Domain | agent[.]cloudfiledisk[.]com | Botnet C2 | — |
| 2026-10-03 02:05 | IP | 191.124.5[.]50:8080 | Botnet C2 | — |
| 2026-10-02 13:46 | IP | 159.75.202[.]228:443 | Botnet C2 | — |
| 2026-10-02 13:46 | IP | 141.255.166[.]178:8080 | Botnet C2 | — |
| 2026-10-01 13:46 | IP | 43.139.239[.]108:443 | Botnet C2 | — |
| 2026-10-01 10:05 | IP | 93.185.165[.]104:80 | Botnet C2 | — |
| 2026-10-01 03:46 | IP | 156.254.20[.]48:5998 | Botnet C2 | — |
| 2026-09-30 03:46 | IP | 8.166.128[.]186:50053 | Botnet C2 | — |
| 2026-09-29 08:21 | IP | 153.80.242[.]105:9999 | Botnet C2 | — |
| 2026-09-29 08:05 | IP | 46.19.140[.]50:443 | Botnet C2 | — |
| 2026-09-28 03:46 | Domain | bbb[.]0101011010010111001[.]com | Botnet C2 | — |
| 2026-09-27 20:14 | IP | 116.205.106[.]137:10051 | Botnet C2 | — |
| 2026-09-27 13:46 | IP | 38.190.196[.]25:5638 | Botnet C2 | — |
| 2026-09-27 13:46 | IP | 14.225.212[.]124:53 | Botnet C2 | — |
| 2026-09-27 13:46 | Domain | ns1[.]kcsc[.]tf | Botnet C2 | — |
| 2026-09-27 13:46 | Domain | ns2[.]kcsc[.]tf | Botnet C2 | — |
| 2026-09-26 13:47 | IP | 23.238.82[.]42:3388 | Botnet C2 | — |
| 2026-09-26 13:46 | IP | 150.158.102[.]111:1235 | Botnet C2 | — |
| 2026-09-26 08:05 | IP | 46.250.228[.]119:1337 | Botnet C2 | — |
| 2026-09-26 08:05 | IP | 209.38.82[.]85:8443 | Botnet C2 | — |
| 2026-09-26 06:20 | IP | 43.143.38[.]95:19999 | Botnet C2 | — |
| 2026-09-26 03:47 | IP | 178.253.31[.]5:80 | Botnet C2 | — |
| 2026-09-25 07:52 | IP | 191.124.5[.]229:8443 | Botnet C2 | — |
| 2026-09-25 05:47 | IP | 42.51.44[.]173:18888 | Botnet C2 | — |
| 2026-09-25 03:47 | IP | 43.136.69[.]37:443 | Botnet C2 | — |
| 2026-09-25 03:47 | IP | 139.196.50[.]117:8839 | Botnet C2 | — |
| 2026-09-25 03:46 | Domain | i[.]gckni[.]com | Botnet C2 | — |
| 2026-09-24 13:48 | IP | 82.156.186[.]185:18443 | Botnet C2 | — |
| 2026-09-24 13:48 | Domain | 178-128-196-79[.]sslip[.]io | Botnet C2 | — |
| 2026-09-24 07:05 | IP | 85.11.182[.]104:443 | Botnet C2 | — |
| 2026-09-24 04:05 | IP | 101.35.217[.]145:8081 | Botnet C2 | — |
| 2026-09-24 03:48 | IP | 82.158.89[.]214:443 | Botnet C2 | — |
| 2026-09-24 03:47 | IP | 156.254.20[.]47:5996 | Botnet C2 | — |
| 2026-09-24 03:47 | IP | 120.27.20[.]98:55801 | Botnet C2 | — |
| 2026-09-23 15:05 | IP | 35.213.187[.]40:80 | Botnet C2 | — |
Defanged for safety. URL query strings removed.