# publicmosaic.rules — generated 2026-10-30 18:37 UTC — 13 rules — TLP:CLEAR
# source: https://publicmosaic.com — published for defensive use
# scope: asn 36680 — https://publicmosaic.com/asn/36680
# rev:4 — replace every earlier rule file from this site. Suricata refuses a duplicate sid, so never load an older one beside this one.
# covers listed listeners only; archived listings omitted: 2
# A withdrawal can take up to five minutes to reach this file. Each address's page under publicmosaic.com/ip/ is authoritative.
alert tcp $HOME_NET any -> 36.255.97.175 4445 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/36.255.97.175; sid:9105698; rev:4;)
alert tcp $HOME_NET any -> 46.151.182.5 7707 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/46.151.182.5; sid:9108798; rev:4;)
alert tcp $HOME_NET any -> 46.151.182.5 8080 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/46.151.182.5; sid:9108799; rev:4;)
alert tcp $HOME_NET any -> 46.151.182.5 8808 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/46.151.182.5; sid:9109129; rev:4;)
alert tcp $HOME_NET any -> 46.151.182.17 5555 (msg:"Public Mosaic C2 DcRat"; reference:url,publicmosaic.com/ip/46.151.182.17; sid:9103822; rev:4;)
alert tcp $HOME_NET any -> 46.151.182.30 7080 (msg:"Public Mosaic C2 HypeAgent"; reference:url,publicmosaic.com/ip/46.151.182.30; sid:9103298; rev:4;)
alert tcp $HOME_NET any -> 46.151.182.30 7443 (msg:"Public Mosaic C2 HypeAgent"; reference:url,publicmosaic.com/ip/46.151.182.30; sid:9103297; rev:4;)
alert tcp $HOME_NET any -> 46.151.182.98 7080 (msg:"Public Mosaic C2 HypeAgent"; reference:url,publicmosaic.com/ip/46.151.182.98; sid:9101051; rev:4;)
alert tcp $HOME_NET any -> 46.151.182.98 7443 (msg:"Public Mosaic C2 HypeAgent"; reference:url,publicmosaic.com/ip/46.151.182.98; sid:9101059; rev:4;)
alert tcp $HOME_NET any -> 64.89.160.29 5566 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/64.89.160.29; sid:9107002; rev:4;)
alert tcp $HOME_NET any -> 64.89.160.77 7080 (msg:"Public Mosaic C2 HypeAgent"; reference:url,publicmosaic.com/ip/64.89.160.77; sid:9101054; rev:4;)
alert tcp $HOME_NET any -> 64.89.160.140 7040 (msg:"Public Mosaic C2 HypeAgent"; reference:url,publicmosaic.com/ip/64.89.160.140; sid:9101055; rev:4;)
alert tcp $HOME_NET any -> 64.89.161.65 4444 (msg:"Public Mosaic C2 DcRat"; reference:url,publicmosaic.com/ip/64.89.161.65; sid:9101674; rev:4;)