>samit_hota
Back to IOCs
G000850 indicators

Cobalt Strike — Indicators of Compromise

Samit Hota·
#ioc#cobalt-strike

Overview

Indicators of compromise associated with Cobalt Strike. 50 indicators listed below, linked to the G0008 adversary profile.

Not exhaustive, and confidence varies. Always corroborate against your own telemetry before taking action.

TypeIndicatorFirst SeenConfidence
ip:port101.33.225.32:123July 19, 2026100%
ip:port101.42.255.92:8082July 19, 2026100%
ip:port101.42.255.92:5353July 19, 2026100%
ip:port101.33.225.32:3306July 19, 2026100%
ip:port101.42.255.92:137July 19, 2026100%
ip:port101.33.225.32:22July 19, 2026100%
ip:port101.33.225.32:13306July 19, 2026100%
ip:port49.233.136.227:18082July 19, 2026100%
ip:port49.233.136.227:22July 19, 2026100%
ip:port47.108.60.27:22July 19, 2026100%
ip:port101.200.193.211:8000July 19, 2026100%
ip:port101.200.193.211:44321July 19, 2026100%
ip:port38.76.169.75:870July 18, 202675%
ip:port130.94.34.66:6666July 18, 202675%
ip:port101.126.10.34:22July 18, 2026100%
ip:port47.105.36.109:22July 18, 2026100%
ip:port116.11.4.136:10443July 18, 2026100%
ip:port103.86.65.202:80July 18, 2026100%
ip:port15.224.128.203:443July 18, 2026100%
ip:port1.116.121.47:10000July 18, 2026100%
ip:port101.133.225.51:22July 18, 2026100%
ip:port117.72.39.83:111July 18, 2026100%
ip:port101.133.225.51:7777July 18, 2026100%
ip:port1.116.121.47:5003July 18, 2026100%
ip:port1.116.121.47:8091July 18, 2026100%
ip:port159.94.211.163:14443July 18, 202675%
ip:port158.94.211.163:14443July 18, 202675%
ip:port47.101.51.235:1099July 18, 2026100%
ip:port47.101.51.235:8000July 18, 2026100%
ip:port47.101.51.235:8888July 18, 2026100%
ip:port45.87.53.6:5003July 18, 2026100%
ip:port45.87.53.6:18082July 18, 2026100%
ip:port45.87.53.6:8888July 18, 2026100%
ip:port43.167.177.224:6666July 18, 2026100%
ip:port43.167.177.224:22July 18, 2026100%
ip:port43.144.20.144:5004July 18, 2026100%
ip:port43.144.20.144:53July 18, 2026100%
ip:port43.144.19.224:5004July 18, 2026100%
ip:port43.144.20.144:3306July 17, 2026100%
ip:port45.194.17.39:18443July 17, 202675%
ip:port114.134.187.38:5000July 17, 2026100%
ip:port114.134.187.38:22July 17, 2026100%
ip:port114.134.187.38:8082July 17, 2026100%
ip:port47.106.110.47:80July 17, 202675%
ip:port114.134.187.38:111July 17, 2026100%
ip:port198.46.175.153:9090July 17, 2026100%
ip:port8.141.121.30:9999July 17, 2026100%
ip:port103.43.18.230:80July 17, 2026100%
ip:port203.9.150.13:8443July 16, 2026100%
ip:port107.173.85.194:8443July 16, 2026100%

Related content

Adversary Profile

Carbanak Threat Profile: Financial Apex Predators

IOCs

Meterpreter — Indicators of Compromise

Adversary Profile

Deep Panda (G0009) Threat Actor Profile: A Persistent Chinese Espionage Group

Adversary Profile

APT29 (Midnight Blizzard / Cozy Bear): Russian SVR's Elite Cyber Espionage Unit

Seeing these indicators in your logs?

Let's figure out how far it's gotten.

Book an advisory call