# publicmosaic.sigma.yml — generated 2026-10-30 18:37 UTC — TLP:CLEAR
# source: https://publicmosaic.com — published for defensive use
# scope: asn 139646 — https://publicmosaic.com/asn/139646
# covers listed listeners only; archived listings omitted: 0
# A withdrawal can take up to five minutes to reach this file. Each address's page under publicmosaic.com/ip/ is authoritative.
title: 'AS139646 — connections to listed C2 hosts'
id: 0bffbfdc-83df-8284-afb4-e8c4c51a5880
status: experimental
description: 'Outbound connection to an address Public Mosaic listed as a C2 host when this file was generated.'
references:
  - 'https://publicmosaic.com/asn/139646'
author: 'Public Mosaic'
date: 2026-10-21
modified: 2026-10-30
tags:
  - attack.command_and_control
  - tlp.clear
logsource:
  category: network_connection
detection:
  selection_p8877:
    DestinationIp:
      - 156.240.41.100
      - 156.240.41.101
      - 156.240.41.102
      - 156.240.41.104
      - 156.240.41.105
      - 156.240.41.107
      - 156.240.41.108
      - 156.240.41.109
      - 156.240.41.11
      - 156.240.41.110
      - 156.240.41.111
      - 156.240.41.112
      - 156.240.41.113
      - 156.240.41.114
      - 156.240.41.115
      - 156.240.41.117
      - 156.240.41.118
      - 156.240.41.120
      - 156.240.41.123
      - 156.240.41.124
      - 156.240.41.125
      - 156.240.41.126
      - 156.240.41.128
      - 156.240.41.129
      - 156.240.41.13
      - 156.240.41.130
      - 156.240.41.131
      - 156.240.41.132
      - 156.240.41.133
      - 156.240.41.134
      - 156.240.41.135
      - 156.240.41.136
      - 156.240.41.137
      - 156.240.41.139
      - 156.240.41.140
      - 156.240.41.142
      - 156.240.41.143
      - 156.240.41.144
      - 156.240.41.145
      - 156.240.41.146
      - 156.240.41.147
      - 156.240.41.148
      - 156.240.41.149
      - 156.240.41.15
      - 156.240.41.150
      - 156.240.41.151
      - 156.240.41.153
      - 156.240.41.154
      - 156.240.41.155
      - 156.240.41.157
      - 156.240.41.158
      - 156.240.41.159
      - 156.240.41.16
      - 156.240.41.160
      - 156.240.41.161
      - 156.240.41.164
      - 156.240.41.166
      - 156.240.41.168
      - 156.240.41.169
      - 156.240.41.17
      - 156.240.41.170
      - 156.240.41.171
      - 156.240.41.172
      - 156.240.41.173
      - 156.240.41.175
      - 156.240.41.177
      - 156.240.41.178
      - 156.240.41.179
      - 156.240.41.18
      - 156.240.41.180
      - 156.240.41.181
      - 156.240.41.182
      - 156.240.41.183
      - 156.240.41.184
      - 156.240.41.185
      - 156.240.41.186
      - 156.240.41.187
      - 156.240.41.189
      - 156.240.41.19
      - 156.240.41.190
      - 156.240.41.191
      - 156.240.41.193
      - 156.240.41.195
      - 156.240.41.197
      - 156.240.41.198
      - 156.240.41.20
      - 156.240.41.200
      - 156.240.41.201
      - 156.240.41.202
      - 156.240.41.203
      - 156.240.41.204
      - 156.240.41.205
      - 156.240.41.206
      - 156.240.41.207
      - 156.240.41.208
      - 156.240.41.21
      - 156.240.41.210
      - 156.240.41.211
      - 156.240.41.212
      - 156.240.41.213
      - 156.240.41.214
      - 156.240.41.215
      - 156.240.41.216
      - 156.240.41.217
      - 156.240.41.218
      - 156.240.41.219
      - 156.240.41.221
      - 156.240.41.222
      - 156.240.41.223
      - 156.240.41.224
      - 156.240.41.225
      - 156.240.41.227
      - 156.240.41.228
      - 156.240.41.229
      - 156.240.41.230
      - 156.240.41.232
      - 156.240.41.233
      - 156.240.41.234
      - 156.240.41.235
      - 156.240.41.237
      - 156.240.41.238
      - 156.240.41.239
      - 156.240.41.241
      - 156.240.41.242
      - 156.240.41.243
      - 156.240.41.244
      - 156.240.41.245
      - 156.240.41.248
      - 156.240.41.250
      - 156.240.41.251
      - 156.240.41.252
      - 156.240.41.253
      - 156.240.41.26
      - 156.240.41.27
      - 156.240.41.28
      - 156.240.41.29
      - 156.240.41.3
      - 156.240.41.31
      - 156.240.41.32
      - 156.240.41.34
      - 156.240.41.35
      - 156.240.41.37
      - 156.240.41.39
      - 156.240.41.4
      - 156.240.41.40
      - 156.240.41.42
      - 156.240.41.43
      - 156.240.41.47
      - 156.240.41.48
      - 156.240.41.49
      - 156.240.41.5
      - 156.240.41.50
      - 156.240.41.51
      - 156.240.41.52
      - 156.240.41.54
      - 156.240.41.55
      - 156.240.41.57
      - 156.240.41.58
      - 156.240.41.59
      - 156.240.41.6
      - 156.240.41.60
      - 156.240.41.61
      - 156.240.41.63
      - 156.240.41.65
      - 156.240.41.66
      - 156.240.41.71
      - 156.240.41.72
      - 156.240.41.74
      - 156.240.41.75
      - 156.240.41.77
      - 156.240.41.78
      - 156.240.41.79
      - 156.240.41.8
      - 156.240.41.81
      - 156.240.41.82
      - 156.240.41.83
      - 156.240.41.84
      - 156.240.41.85
      - 156.240.41.86
      - 156.240.41.88
      - 156.240.41.89
      - 156.240.41.9
      - 156.240.41.90
      - 156.240.41.91
      - 156.240.41.92
      - 156.240.41.93
      - 156.240.41.94
      - 156.240.41.95
      - 156.240.41.96
      - 156.240.41.97
      - 156.240.41.98
      - 156.240.41.99
    DestinationPort: 8877
  condition: 1 of selection_*
falsepositives:
  - 'Shared hosting: an address can later serve other tenants. Its host page shows whether it is still listed.'
level: high