Abuse & takedown

Write to us

support@publicmosaic.com, with Abuse in the subject line. No form or account is needed. An email from a person is fine, and so is an automated report from an abuse desk.

Include, if you can:

The indicator exactly as it appears in the feed: the IP address and port, and the domain if one is listed. A listing is per address and port, so an address alone may match several listings or none.
What you believe is wrong (see the grounds below). One sentence is enough.
Your relationship to the host: operator, hosting provider, network owner, or incident responder acting for the owner.

You do not need to send logs, packet captures or evidence of remediation. We re-check the host ourselves, and you do not need to prove anything.

What we publish, and what a listing means

We publish infrastructure at /indicators and in the machine-readable feed: the addresses, ports, domains and certificates of hosts assessed as command-and-control servers, or as related hosts such as compromised devices, malware distribution hosts and exposed tools. A listing says that our scanner identified known software at that address and port, or found it named as a command-and-control host in a configuration it recovered, at the times the listing records. It is not a statement about who owns the address, who rents it, or who is responsible.

A host is listed only on a determinative match: the scanner's own observation identifies the software there by value, at a publicly routable address, with a confidence of 90 or more. The full criteria are in methodology.

Grounds we act on

The most common grounds:

Misidentification. The service at that address and port is not what we identified it as. Signatures can and do produce false matches, and withdrawing one withdraws every listing it produced, including those you did not write about.
Remediated compromise. The host was compromised, you have cleaned it up, and the listing describes a state that has ended.
Reassignment. The address was reallocated to you after the sighting, and the listing describes a previous tenant's activity.
Shared infrastructure. The indicator names a platform, CDN or reverse proxy rather than the tenant running the service behind it.

What happens next

We re-scan the host and re-examine the evidence the listing rested on. If we withdraw the listing:

The page for the address answers 410 Gone within about a minute if nothing else is listed on the address. Search engines treat that status as a deliberate removal rather than a broken link. If other listings on the address still stand, the page stays, and drops the withdrawn one within minutes.
The listing leaves the feed at its next update, within about fifteen minutes; the feed is a separate system from this site.

Nothing further is needed from you, and there is no confirmation step.

If we do not withdraw it, we will tell you why, specifically enough for you to dispute it.

Listings have their own pages, and search engines index them

Every address in the feed has a page at publicmosaic.com/ip/<address>. These pages are ordinary HTML and open to search engines, so an address listed here can appear in results for a search on that address.

A listing is an observation, not an allegation about you. A large share of command-and-control infrastructure runs on machines somebody else compromised, or on rented addresses whose provider had no part in it. The page records what a scan saw at a point in time. It does not say who put it there.

Removal is per address, and it is the fast route. Write to us as above and, if the listing is withdrawn, the page goes within about a minute. If you are responsible for a whole range, use opt-out instead: it is verified, and it covers addresses we have not seen yet as well as those we have. A takedown here covers only what was already published, and a fresh detection on the same address later would be listed again.

Listings expire on their own

A listing stays in the live feed for up to 90 days after its last confirmed sighting. A host that has gone quiet does not leave it sooner: the scanner keeps re-checking listed hosts, but a check that finds nothing does not remove a listing. The 90-day window keeps infrastructure that goes quiet and returns from being repeatedly forgotten. After it, the listing stays in this site's archive, marked archived.

A listing can therefore outlast what it describes by up to three months. If what it describes has ended, write to us and we will re-check it rather than leave it listed for weeks.

What removal here does not reach

The feed is published TLP:CLEAR for defensive use, so anyone may copy it. Withdrawing a listing stops us publishing it, to anyone who reads us from then on, but it cannot recall copies already taken by other people, aggregators or security products that ingested the feed earlier. If a listing has spread somewhere that matters to you, tell us and we will confirm in writing that we have withdrawn it, which is usually what a downstream consumer needs.