# publicmosaic.rules — generated 2026-10-30 18:37 UTC — 15 rules — TLP:CLEAR
# source: https://publicmosaic.com — published for defensive use
# scope: asn 22427 — https://publicmosaic.com/asn/22427
# rev:4 — replace every earlier rule file from this site. Suricata refuses a duplicate sid, so never load an older one beside this one.
# covers listed listeners only; archived listings omitted: 0
# A withdrawal can take up to five minutes to reach this file. Each address's page under publicmosaic.com/ip/ is authoritative.
alert tcp $HOME_NET any -> 38.45.125.98 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.45.125.98; sid:9103196; rev:4;)
alert tcp $HOME_NET any -> 38.45.125.99 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.45.125.99; sid:9103195; rev:4;)
alert tcp $HOME_NET any -> 38.45.125.100 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.45.125.100; sid:9103194; rev:4;)
alert tcp $HOME_NET any -> 38.45.125.101 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.45.125.101; sid:9103193; rev:4;)
alert tcp $HOME_NET any -> 38.45.125.102 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.45.125.102; sid:9103192; rev:4;)
alert tcp $HOME_NET any -> 38.46.15.202 4141 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.46.15.202; sid:9105093; rev:4;)
alert tcp $HOME_NET any -> 38.46.15.202 8989 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/38.46.15.202; sid:9109993; rev:4;)
alert tcp $HOME_NET any -> 38.46.15.203 4141 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.46.15.203; sid:9105092; rev:4;)
alert tcp $HOME_NET any -> 38.46.15.203 8989 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/38.46.15.203; sid:9110051; rev:4;)
alert tcp $HOME_NET any -> 38.46.15.204 4141 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.46.15.204; sid:9103191; rev:4;)
alert tcp $HOME_NET any -> 38.46.15.204 8989 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/38.46.15.204; sid:9110050; rev:4;)
alert tcp $HOME_NET any -> 38.46.15.205 4141 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.46.15.205; sid:9105091; rev:4;)
alert tcp $HOME_NET any -> 38.46.15.205 8989 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/38.46.15.205; sid:9109940; rev:4;)
alert tcp $HOME_NET any -> 38.46.15.206 4141 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.46.15.206; sid:9105090; rev:4;)
alert tcp $HOME_NET any -> 38.46.15.206 8989 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/38.46.15.206; sid:9109939; rev:4;)