# publicmosaic.sigma.yml — generated 2026-10-30 20:37 UTC — TLP:CLEAR
# source: https://publicmosaic.com — published for defensive use
# scope: asn 402506 — https://publicmosaic.com/asn/402506
# covers listed listeners only; archived listings omitted: 1
# A withdrawal can take up to five minutes to reach this file. Each address's page under publicmosaic.com/ip/ is authoritative.
title: 'AS402506 — connections to listed hosts'
id: fbeef341-2b36-8337-91e1-85e68ffcda4a
status: experimental
description: 'Outbound connection to an address Public Mosaic listed as a C2 host or a malware distribution host when this file was generated.'
references:
  - 'https://publicmosaic.com/asn/402506'
author: 'Public Mosaic'
date: 2026-08-25
modified: 2026-10-30
tags:
  - tlp.clear
logsource:
  category: network_connection
detection:
  selection_p80:
    DestinationIp:
      - 82.158.89.122
    DestinationPort: 80
  selection_p443:
    DestinationIp:
      - 82.158.89.122
    DestinationPort: 443
  selection_p2053:
    DestinationIp:
      - 82.158.89.214
      - 82.158.89.75
    DestinationPort: 2053
  selection_p2087:
    DestinationIp:
      - 154.12.94.16
    DestinationPort: 2087
  selection_p5522:
    DestinationIp:
      - 156.238.224.156
    DestinationPort: 5522
  selection_p5533:
    DestinationIp:
      - 156.238.224.156
    DestinationPort: 5533
  selection_p8084:
    DestinationIp:
      - 199.102.217.211
    DestinationPort: 8084
  selection_p8443:
    DestinationIp:
      - 154.12.94.16
    DestinationPort: 8443
  selection_p9997:
    DestinationIp:
      - 45.205.27.227
    DestinationPort: 9997
  selection_p9998:
    DestinationIp:
      - 45.205.27.227
    DestinationPort: 9998
  selection_p9999:
    DestinationIp:
      - 45.205.27.227
    DestinationPort: 9999
  selection_p60000:
    DestinationIp:
      - 154.219.123.78
    DestinationPort: 60000
  condition: 1 of selection_*
falsepositives:
  - 'Shared hosting: an address can later serve other tenants. Its host page shows whether it is still listed.'
level: medium
---
title: 'AS402506 — beacon URI or user agent in a request to a listed host'
id: a956fa2b-4f60-8aab-ba0e-befb4ccf4656
status: experimental
description: 'A request to a listed address carrying a URI or user agent from a configuration recovered for these hosts. Both conditions are required: either value alone is common.'
references:
  - 'https://publicmosaic.com/asn/402506'
author: 'Public Mosaic'
date: 2026-08-25
modified: 2026-10-30
tags:
  - tlp.clear
logsource:
  category: proxy
detection:
  selection_dst:
    DestinationIp:
      - 154.12.94.16
      - 154.219.123.78
      - 156.238.224.156
      - 199.102.217.211
      - 45.205.27.227
      - 82.158.89.122
      - 82.158.89.214
      - 82.158.89.75
  selection_uri:
    c-uri|contains:
      - '/api/v1/get'
      - '/api/v1/post'
      - '/jquery-3.3.1.min.js'
      - '/jquery-3.3.2.min.js'
  selection_ua:
    c-useragent:
      - 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36'
      - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36'
      - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0'
  condition: selection_dst and (selection_uri or selection_ua)
falsepositives:
  - 'A benign request to a listed address carrying a commodity user agent'
level: medium