# publicmosaic.sigma.yml — generated 2026-10-30 18:37 UTC — TLP:CLEAR
# source: https://publicmosaic.com — published for defensive use
# scope: asn 403005 — https://publicmosaic.com/asn/403005
# covers listed listeners only; archived listings omitted: 0
# A withdrawal can take up to five minutes to reach this file. Each address's page under publicmosaic.com/ip/ is authoritative.
title: 'AS403005 — connections to listed C2 hosts'
id: e2e6c47f-f9be-8d11-bbcd-d251c33ad8d7
status: experimental
description: 'Outbound connection to an address Public Mosaic listed as a C2 host when this file was generated.'
references:
  - 'https://publicmosaic.com/asn/403005'
author: 'Public Mosaic'
date: 2026-08-23
modified: 2026-10-30
tags:
  - attack.command_and_control
  - tlp.clear
logsource:
  category: network_connection
detection:
  selection_p80:
    DestinationIp:
      - 36.255.97.86
      - 64.89.161.171
    DestinationPort: 80
  selection_p443:
    DestinationIp:
      - 36.255.97.86
      - 46.151.182.182
      - 46.151.182.67
      - 64.89.161.171
    DestinationPort: 443
  selection_p1011:
    DestinationIp:
      - 46.151.182.16
    DestinationPort: 1011
  selection_p2021:
    DestinationIp:
      - 64.89.160.127
    DestinationPort: 2021
  selection_p2202:
    DestinationIp:
      - 46.151.182.16
    DestinationPort: 2202
  selection_p4045:
    DestinationIp:
      - 36.255.97.162
    DestinationPort: 4045
  selection_p4443:
    DestinationIp:
      - 46.151.182.190
    DestinationPort: 4443
  selection_p4782:
    DestinationIp:
      - 64.89.160.4
    DestinationPort: 4782
  selection_p5173:
    DestinationIp:
      - 46.151.182.224
      - 64.89.161.6
    DestinationPort: 5173
  selection_p6606:
    DestinationIp:
      - 36.255.97.47
      - 43.228.157.252
      - 46.151.182.205
    DestinationPort: 6606
  selection_p6666:
    DestinationIp:
      - 31.56.19.40
    DestinationPort: 6666
  selection_p7707:
    DestinationIp:
      - 36.255.97.47
    DestinationPort: 7707
  selection_p7777:
    DestinationIp:
      - 64.89.160.44
    DestinationPort: 7777
  selection_p8033:
    DestinationIp:
      - 36.255.97.162
    DestinationPort: 8033
  selection_p8808:
    DestinationIp:
      - 36.255.97.47
    DestinationPort: 8808
  selection_p19132:
    DestinationIp:
      - 64.89.160.29
    DestinationPort: 19132
  selection_p31337:
    DestinationIp:
      - 196.251.121.120
      - 46.151.182.182
    DestinationPort: 31337
  selection_p50050:
    DestinationIp:
      - 36.255.97.162
    DestinationPort: 50050
  selection_p56001:
    DestinationIp:
      - 196.251.121.52
      - 64.89.160.4
      - 64.89.160.47
      - 64.89.161.92
    DestinationPort: 56001
  selection_p56002:
    DestinationIp:
      - 46.151.182.67
      - 64.89.160.4
      - 64.89.161.92
    DestinationPort: 56002
  selection_p56003:
    DestinationIp:
      - 46.151.182.67
      - 64.89.160.4
      - 64.89.161.92
    DestinationPort: 56003
  condition: 1 of selection_*
falsepositives:
  - 'Shared hosting: an address can later serve other tenants. Its host page shows whether it is still listed.'
level: high
---
title: 'AS403005 — beacon URI or user agent in a request to a listed host'
id: a86212d4-1e13-8ad2-9d92-31dc30173f4f
status: experimental
description: 'A request to a listed address carrying a URI or user agent from a configuration recovered for these hosts. Both conditions are required: either value alone is common.'
references:
  - 'https://publicmosaic.com/asn/403005'
author: 'Public Mosaic'
date: 2026-08-23
modified: 2026-10-30
tags:
  - attack.command_and_control
  - tlp.clear
logsource:
  category: proxy
detection:
  selection_dst:
    DestinationIp:
      - 196.251.121.120
      - 196.251.121.52
      - 31.56.19.40
      - 36.255.97.162
      - 36.255.97.47
      - 36.255.97.86
      - 43.228.157.252
      - 46.151.182.16
      - 46.151.182.182
      - 46.151.182.190
      - 46.151.182.205
      - 46.151.182.224
      - 46.151.182.67
      - 64.89.160.127
      - 64.89.160.29
      - 64.89.160.4
      - 64.89.160.44
      - 64.89.160.47
      - 64.89.161.171
      - 64.89.161.6
      - 64.89.161.92
  selection_uri:
    c-uri|contains:
      - '/IE9CompatViewList.xml'
      - '/activity'
      - '/jquery-3.3.1.min.js'
      - '/jquery-3.3.2.min.js'
      - '/submit.php'
  selection_ua:
    c-useragent:
      - 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; QQDownload 733; InfoPath.2)'
      - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36'
      - 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)'
  condition: selection_dst and (selection_uri or selection_ua)
falsepositives:
  - 'A benign request to a listed address carrying a commodity user agent'
level: high