# publicmosaic.rules — generated 2026-10-30 18:37 UTC — 36 rules — TLP:CLEAR
# source: https://publicmosaic.com — published for defensive use
# scope: asn 403005 — https://publicmosaic.com/asn/403005
# rev:4 — replace every earlier rule file from this site. Suricata refuses a duplicate sid, so never load an older one beside this one.
# covers listed listeners only; archived listings omitted: 0
# A withdrawal can take up to five minutes to reach this file. Each address's page under publicmosaic.com/ip/ is authoritative.
alert tcp $HOME_NET any -> 31.56.19.40 6666 (msg:"Public Mosaic C2 DcRat"; reference:url,publicmosaic.com/ip/31.56.19.40; sid:9109515; rev:4;)
alert tcp $HOME_NET any -> 36.255.97.47 6606 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/36.255.97.47; sid:9109316; rev:4;)
alert tcp $HOME_NET any -> 36.255.97.47 7707 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/36.255.97.47; sid:9109315; rev:4;)
alert tcp $HOME_NET any -> 36.255.97.47 8808 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/36.255.97.47; sid:9109314; rev:4;)
alert tcp $HOME_NET any -> 36.255.97.86 80 (msg:"Public Mosaic C2 Flying Eagle"; reference:url,publicmosaic.com/ip/36.255.97.86; sid:9105808; rev:4;)
alert tcp $HOME_NET any -> 36.255.97.86 443 (msg:"Public Mosaic C2 Flying Eagle"; reference:url,publicmosaic.com/ip/36.255.97.86; sid:9103945; rev:4;)
alert tcp $HOME_NET any -> 36.255.97.162 4045 (msg:"Public Mosaic C2 Cobalt Strike"; reference:url,publicmosaic.com/ip/36.255.97.162; sid:9107248; rev:4;)
alert tcp $HOME_NET any -> 36.255.97.162 8033 (msg:"Public Mosaic C2 Cobalt Strike"; reference:url,publicmosaic.com/ip/36.255.97.162; sid:9104260; rev:4;)
alert tcp $HOME_NET any -> 36.255.97.162 50050 (msg:"Public Mosaic C2 Cobalt Strike"; reference:url,publicmosaic.com/ip/36.255.97.162; sid:9107003; rev:4;)
alert tcp $HOME_NET any -> 43.228.157.252 6606 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/43.228.157.252; sid:9102153; rev:4;)
alert tcp $HOME_NET any -> 46.151.182.16 1011 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/46.151.182.16; sid:9102152; rev:4;)
alert tcp $HOME_NET any -> 46.151.182.16 2202 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/46.151.182.16; sid:9102151; rev:4;)
alert tcp $HOME_NET any -> 46.151.182.67 443 (msg:"Public Mosaic C2 PureRAT"; reference:url,publicmosaic.com/ip/46.151.182.67; sid:9107486; rev:4;)
alert tcp $HOME_NET any -> 46.151.182.67 56002 (msg:"Public Mosaic C2 PureRAT"; reference:url,publicmosaic.com/ip/46.151.182.67; sid:9109633; rev:4;)
alert tcp $HOME_NET any -> 46.151.182.67 56003 (msg:"Public Mosaic C2 PureRAT"; reference:url,publicmosaic.com/ip/46.151.182.67; sid:9109780; rev:4;)
alert tcp $HOME_NET any -> 46.151.182.182 443 (msg:"Public Mosaic C2 Sliver"; reference:url,publicmosaic.com/ip/46.151.182.182; sid:9104696; rev:4;)
alert tcp $HOME_NET any -> 46.151.182.182 31337 (msg:"Public Mosaic C2 Sliver"; reference:url,publicmosaic.com/ip/46.151.182.182; sid:9100391; rev:4;)
alert tcp $HOME_NET any -> 46.151.182.190 4443 (msg:"Public Mosaic C2 Cobalt Strike"; reference:url,publicmosaic.com/ip/46.151.182.190; sid:9104026; rev:4;)
alert tcp $HOME_NET any -> 46.151.182.205 6606 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/46.151.182.205; sid:9102150; rev:4;)
alert tcp $HOME_NET any -> 46.151.182.224 5173 (msg:"Public Mosaic C2 Overlord"; reference:url,publicmosaic.com/ip/46.151.182.224; sid:9102076; rev:4;)
alert tcp $HOME_NET any -> 64.89.160.4 4782 (msg:"Public Mosaic C2 Quasar"; reference:url,publicmosaic.com/ip/64.89.160.4; sid:9100041; rev:4;)
alert tcp $HOME_NET any -> 64.89.160.4 56001 (msg:"Public Mosaic C2 PureRAT"; reference:url,publicmosaic.com/ip/64.89.160.4; sid:9109215; rev:4;)
alert tcp $HOME_NET any -> 64.89.160.4 56002 (msg:"Public Mosaic C2 PureRAT"; reference:url,publicmosaic.com/ip/64.89.160.4; sid:9109217; rev:4;)
alert tcp $HOME_NET any -> 64.89.160.4 56003 (msg:"Public Mosaic C2 PureRAT"; reference:url,publicmosaic.com/ip/64.89.160.4; sid:9109216; rev:4;)
alert tcp $HOME_NET any -> 64.89.160.29 19132 (msg:"Public Mosaic C2 Quasar"; reference:url,publicmosaic.com/ip/64.89.160.29; sid:9104152; rev:4;)
alert tcp $HOME_NET any -> 64.89.160.44 7777 (msg:"Public Mosaic C2 DcRat"; reference:url,publicmosaic.com/ip/64.89.160.44; sid:9104512; rev:4;)
alert tcp $HOME_NET any -> 64.89.160.47 56001 (msg:"Public Mosaic C2 Quasar-family"; reference:url,publicmosaic.com/ip/64.89.160.47; sid:9101655; rev:4;)
alert tcp $HOME_NET any -> 64.89.160.127 2021 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/64.89.160.127; sid:9110291; rev:4;)
alert tcp $HOME_NET any -> 64.89.161.6 5173 (msg:"Public Mosaic C2 Overlord"; reference:url,publicmosaic.com/ip/64.89.161.6; sid:9102072; rev:4;)
alert tcp $HOME_NET any -> 64.89.161.92 56001 (msg:"Public Mosaic C2 PureRAT"; reference:url,publicmosaic.com/ip/64.89.161.92; sid:9109697; rev:4;)
alert tcp $HOME_NET any -> 64.89.161.92 56002 (msg:"Public Mosaic C2 PureRAT"; reference:url,publicmosaic.com/ip/64.89.161.92; sid:9108700; rev:4;)
alert tcp $HOME_NET any -> 64.89.161.92 56003 (msg:"Public Mosaic C2 PureRAT"; reference:url,publicmosaic.com/ip/64.89.161.92; sid:9107240; rev:4;)
alert tcp $HOME_NET any -> 64.89.161.171 80 (msg:"Public Mosaic C2 Overlord"; reference:url,publicmosaic.com/ip/64.89.161.171; sid:9111311; rev:4;)
alert tcp $HOME_NET any -> 64.89.161.171 443 (msg:"Public Mosaic C2 Overlord"; reference:url,publicmosaic.com/ip/64.89.161.171; sid:9106573; rev:4;)
alert tcp $HOME_NET any -> 196.251.121.52 56001 (msg:"Public Mosaic C2 Quasar"; reference:url,publicmosaic.com/ip/196.251.121.52; sid:9109384; rev:4;)
alert tcp $HOME_NET any -> 196.251.121.120 31337 (msg:"Public Mosaic C2 Sliver"; reference:url,publicmosaic.com/ip/196.251.121.120; sid:9109772; rev:4;)