How to Hunt Cobalt Strike C2 Infrastructure with Automated Discovery

Jan 6, 2026 · Original article ↗

Summary

Hunt.io’s guide demonstrates using its C2 dashboard, certificate and header pivots, and HuntSQL queries to find Cobalt Strike infrastructure, and outlines network and endpoint defenses against beacon activity.

Key points

The guide shows how to use Hunt.io’s C2 Overview and Listing views to filter detections by malware family, ASN, port, and TLD.
It demonstrates pivoting from a suspicious IP to related infrastructure using certificate issuer and subject names, X.509 fingerprints, and HTTP header hashes.
HuntSQL examples query certificate and header indicators over the previous 30 days, grouping results by IP and port.
The article highlights ports 8443 and 8444 in its example investigation and also recommends monitoring 11112 and 4434.
It recommends network segmentation, strict egress filtering, beacon detection, endpoint monitoring, and validation of TLS certificates.
The guide includes a list of IP addresses it identifies as confirmed Cobalt Strike infrastructure.

Article Details

Defense Focus: Automated discovery and clustering of Cobalt Strike command-and-control infrastructure using certificate, HTTP-header, protocol, and network-activity indicators.
Detection Methods: Use the C2 Overview and C2 Listing views to identify detected Cobalt Strike servers and filter detections by malware family, ASN, port, or TLD.
Validate detections with certificate matching, header analysis, and protocol inspection.
Pivot from a suspicious IP across certificate issuer and subject names, X.509 certificate fingerprints, and redacted HTTP-header hashes to identify related infrastructure.
Query certificate and HTTP-header data over a recent time window, grouping results by IP and port.
Look for beacon-like patterns, including regular timed outbound connections and encrypted traffic over uncommon ports.
Data Sources: Certificate issuer and subject common names
X.509 certificate hashes
Redacted HTTP-header SHA-256 hashes
Network IP, port, and timestamp observations
Protocol-inspection results
TLS certificates and outbound connection telemetry
Rule Types: HuntSQL queries against certificate and HTTP-header data, grouped by IP and port
Network detection based on C2 indicators, suspicious ports, and beaconing behavior
Platforms: Hunt.io C2 Overview and C2 Listing interface
Network detection and response (NDR) systems
Intrusion detection systems (IDS)
Endpoint detection and response (EDR) solutions
Defensive Actions: Monitor network traffic for suspicious ports including 8443, 8444, 11112, and 4434, and ingest threat-intelligence indicators for IPs, domains, and certificate fingerprints.
Inspect outbound TLS certificates and monitor for reused or spoofed certificate data, including mail.live.com.
Apply strict egress filtering and restrict external connections to trusted destinations.
Segment networks and enforce access controls between zones to limit lateral movement.
Enable endpoint behavioral telemetry and look for named pipes, process injection, and memory-resident modules.
Run recurring hunts using certificate hashes, HTTP-header signatures, and behavioral patterns.
Prepare incident-response procedures for detection, containment, and forensic collection.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`rxjh[.]online`	Infrastructure domain associated with the identified high-risk Cobalt Strike IP.
IPV4	`1[.]94[.]228[.]130`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`106[.]52[.]136[.]106`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`106[.]55[.]60[.]141`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`107[.]174[.]144[.]204`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`113[.]207[.]49[.]133`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`114[.]67[.]243[.]235`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`118[.]89[.]81[.]201`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`120[.]48[.]25[.]39`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`120[.]53[.]107[.]202`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`121[.]41[.]18[.]122`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`121[.]43[.]57[.]122`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`123[.]206[.]226[.]226`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`123[.]57[.]239[.]178`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`123[.]57[.]38[.]20`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`129[.]226[.]212[.]179`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`137[.]220[.]194[.]49`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`156[.]225[.]20[.]77`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`165[.]154[.]225[.]50`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`185[.]242[.]235[.]158`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`198[.]46[.]217[.]168`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`198[.]46[.]234[.]37`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`203[.]91[.]76[.]95`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`31[.]59[.]41[.]163`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`35[.]77[.]170[.]224`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`38[.]38[.]251[.]151`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`43[.]133[.]41[.]106`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`45[.]135[.]118[.]251`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`45[.]138[.]16[.]178`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`45[.]158[.]8[.]189`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`46[.]17[.]41[.]9`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`47[.]100[.]63[.]226`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`47[.]100[.]86[.]35`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`47[.]109[.]201[.]173`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`47[.]110[.]67[.]64`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`47[.]243[.]175[.]24`	IP identified in the article as high risk and associated with confirmed Cobalt Strike activity on ports 8443 and 8444.
IPV4	`47[.]92[.]222[.]254`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`47[.]92[.]233[.]242`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`49[.]233[.]177[.]30`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`52[.]24[.]111[.]103`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`54[.]191[.]68[.]151`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`58[.]87[.]103[.]59`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`59[.]110[.]7[.]32`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`61[.]135[.]130[.]191`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`8[.]131[.]103[.]16`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`8[.]136[.]1[.]42`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`8[.]137[.]149[.]67`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`81[.]70[.]197[.]166`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`81[.]70[.]37[.]146`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`82[.]165[.]137[.]177`	Listed as a confirmed Cobalt Strike infrastructure indicator.
IPV4	`99[.]81[.]114[.]154`	Listed as a confirmed Cobalt Strike infrastructure indicator.
SHA256	`689d6592a0b88c44821739b93f5f2c988bb9cdab5d57edb9e2663ef939933e1f`	Redacted HTTP-header signature hash used to identify related Cobalt Strike infrastructure.
SHA256	`87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c`	X.509 certificate hash used as a pivot to find related Cobalt Strike infrastructure.