# publicmosaic.rules — generated 2026-10-30 18:37 UTC — 15 rules — TLP:CLEAR
# source: https://publicmosaic.com — published for defensive use
# scope: asn 1014 — https://publicmosaic.com/asn/1014
# rev:4 — replace every earlier rule file from this site. Suricata refuses a duplicate sid, so never load an older one beside this one.
# covers listed listeners only; archived listings omitted: 0
# A withdrawal can take up to five minutes to reach this file. Each address's page under publicmosaic.com/ip/ is authoritative.
alert tcp $HOME_NET any -> 38.95.74.22 443 (msg:"Public Mosaic C2 Flying Eagle"; reference:url,publicmosaic.com/ip/38.95.74.22; sid:9106351; rev:4;)
alert tcp $HOME_NET any -> 38.175.192.57 8013 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.175.192.57; sid:9108753; rev:4;)
alert tcp $HOME_NET any -> 64.90.30.189 443 (msg:"Public Mosaic C2 Flying Eagle"; reference:url,publicmosaic.com/ip/64.90.30.189; sid:9101831; rev:4;)
alert tcp $HOME_NET any -> 64.90.31.240 443 (msg:"Public Mosaic C2 Flying Eagle"; reference:url,publicmosaic.com/ip/64.90.31.240; sid:9106639; rev:4;)
alert tcp $HOME_NET any -> 154.36.163.65 53389 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.36.163.65; sid:9102337; rev:4;)
alert tcp $HOME_NET any -> 154.36.163.65 63350 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.36.163.65; sid:9102336; rev:4;)
alert tcp $HOME_NET any -> 154.36.167.198 3000 (msg:"Public Mosaic C2 DarkSword"; reference:url,publicmosaic.com/ip/154.36.167.198; sid:9106804; rev:4;)
alert tcp $HOME_NET any -> 154.37.218.73 12580 (msg:"Public Mosaic C2 Cobalt Strike"; reference:url,publicmosaic.com/ip/154.37.218.73; sid:9100032; rev:4;)
alert tcp $HOME_NET any -> 154.37.218.73 15641 (msg:"Public Mosaic C2 Cobalt Strike"; reference:url,publicmosaic.com/ip/154.37.218.73; sid:9103437; rev:4;)
alert tcp $HOME_NET any -> 154.37.218.235 4321 (msg:"Public Mosaic C2 Adaptix"; reference:url,publicmosaic.com/ip/154.37.218.235; sid:9105789; rev:4;)
alert tcp $HOME_NET any -> 154.37.218.235 8443 (msg:"Public Mosaic C2 Adaptix"; reference:url,publicmosaic.com/ip/154.37.218.235; sid:9105343; rev:4;)
alert tcp $HOME_NET any -> 154.40.45.170 11000 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/154.40.45.170; sid:9110719; rev:4;)
alert tcp $HOME_NET any -> 154.64.245.88 15004 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/154.64.245.88; sid:9102334; rev:4;)
alert tcp $HOME_NET any -> 154.64.245.88 15005 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/154.64.245.88; sid:9102333; rev:4;)
alert tcp $HOME_NET any -> 189.24.79.183 443 (msg:"Public Mosaic C2 Flying Eagle"; reference:url,publicmosaic.com/ip/189.24.79.183; sid:9107795; rev:4;)