# publicmosaic.rules — generated 2026-10-30 20:07 UTC — 8 rules — TLP:CLEAR
# source: https://publicmosaic.com — published for defensive use
# scope: asn 218731 — https://publicmosaic.com/asn/218731
# rev:4 — replace every earlier rule file from this site. Suricata refuses a duplicate sid, so never load an older one beside this one.
# covers listed listeners only; archived listings omitted: 3
# A withdrawal can take up to five minutes to reach this file. Each address's page under publicmosaic.com/ip/ is authoritative.
alert tcp $HOME_NET any -> 31.77.138.10 6767 (msg:"Public Mosaic C2 PureRAT"; reference:url,publicmosaic.com/ip/31.77.138.10; sid:9109133; rev:4;)
alert tcp $HOME_NET any -> 31.77.170.141 5000 (msg:"Public Mosaic C2 BTMOB"; reference:url,publicmosaic.com/ip/31.77.170.141; sid:9101547; rev:4;)
alert tcp $HOME_NET any -> 31.77.220.141 31337 (msg:"Public Mosaic C2 Sliver"; reference:url,publicmosaic.com/ip/31.77.220.141; sid:9106005; rev:4;)
alert tcp $HOME_NET any -> 31.77.248.3 7443 (msg:"Public Mosaic C2 HypeAgent"; reference:url,publicmosaic.com/ip/31.77.248.3; sid:9101290; rev:4;)
alert tcp $HOME_NET any -> 89.125.43.163 8888 (msg:"Public Mosaic C2 DarkSword"; reference:url,publicmosaic.com/ip/89.125.43.163; sid:9106442; rev:4;)
alert tcp $HOME_NET any -> 89.125.48.185 40056 (msg:"Public Mosaic C2 Havoc"; reference:url,publicmosaic.com/ip/89.125.48.185; sid:9104164; rev:4;)
alert tcp $HOME_NET any -> 150.241.124.167 5173 (msg:"Public Mosaic C2 Overlord"; reference:url,publicmosaic.com/ip/150.241.124.167; sid:9104933; rev:4;)
alert tcp $HOME_NET any -> 185.238.191.45 5173 (msg:"Public Mosaic C2 Overlord"; reference:url,publicmosaic.com/ip/185.238.191.45; sid:9105856; rev:4;)