# publicmosaic.rules — generated 2026-10-30 20:37 UTC — 13 rules — TLP:CLEAR
# source: https://publicmosaic.com — published for defensive use
# scope: asn 402506 — https://publicmosaic.com/asn/402506
# rev:4 — replace every earlier rule file from this site. Suricata refuses a duplicate sid, so never load an older one beside this one.
# covers listed listeners only; archived listings omitted: 1
# A withdrawal can take up to five minutes to reach this file. Each address's page under publicmosaic.com/ip/ is authoritative.
alert tcp $HOME_NET any -> 45.205.27.227 9997 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/45.205.27.227; sid:9103066; rev:4;)
alert tcp $HOME_NET any -> 45.205.27.227 9998 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/45.205.27.227; sid:9103065; rev:4;)
alert tcp $HOME_NET any -> 45.205.27.227 9999 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/45.205.27.227; sid:9103064; rev:4;)
alert tcp $HOME_NET any -> 82.158.89.75 2053 (msg:"Public Mosaic C2 Cobalt Strike"; reference:url,publicmosaic.com/ip/82.158.89.75; sid:9108696; rev:4;)
alert tcp $HOME_NET any -> 82.158.89.122 80 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/82.158.89.122; sid:9110112; rev:4;)
alert tcp $HOME_NET any -> 82.158.89.122 443 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/82.158.89.122; sid:9110032; rev:4;)
alert tcp $HOME_NET any -> 82.158.89.214 2053 (msg:"Public Mosaic C2 Cobalt Strike"; reference:url,publicmosaic.com/ip/82.158.89.214; sid:9109088; rev:4;)
alert tcp $HOME_NET any -> 154.12.94.16 2087 (msg:"Public Mosaic C2 Cobalt Strike"; reference:url,publicmosaic.com/ip/154.12.94.16; sid:9100262; rev:4;)
alert tcp $HOME_NET any -> 154.12.94.16 8443 (msg:"Public Mosaic C2 Cobalt Strike"; reference:url,publicmosaic.com/ip/154.12.94.16; sid:9100263; rev:4;)
alert tcp $HOME_NET any -> 154.219.123.78 60000 (msg:"Public Mosaic C2 Viper"; reference:url,publicmosaic.com/ip/154.219.123.78; sid:9109259; rev:4;)
alert tcp $HOME_NET any -> 156.238.224.156 5522 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.238.224.156; sid:9101213; rev:4;)
alert tcp $HOME_NET any -> 156.238.224.156 5533 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.238.224.156; sid:9103492; rev:4;)
alert tcp $HOME_NET any -> 199.102.217.211 8084 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/199.102.217.211; sid:9109942; rev:4;)