19 addresses routed by AS9924 have been convicted as command-and-control infrastructure — 19 still listed. Observed from 2026-09-02.
TLP:CLEAR
addresses1919 still listed
observations38address and port pairs
networks1distinct ASNs
first seen2026-09-02oldest observation
Detection packs
Rules for the 19 still-listed addresses on this page,
regenerated as the archive updates; archived episodes are omitted, and a rule can lag a withdrawal
by up to five minutes. Suricata rules are rev:2 — alert tcp on address and port, alert tls where a
full certificate fingerprint is published — and carry the archive's own episode ids as sids, so
packs load beside each other and beside any per-host file. YARA packs are hash matches only: this
site holds no file bytes.
AS9924 is registered to Taiwan Fixed Network, Telco and Network Service Provider.. A network appears here because addresses it routes were observed serving C2, which is overwhelmingly tenant activity on rented or compromised machines rather than anything the operator did. Large hosting providers appear because they are large.
Ordered by when this archive first recorded them, newest first —
a stable ordering, so a page holds the same addresses tomorrow. Archived addresses are
included and marked; they are the majority of this corpus over time.
These pages are generated from automated scanning and are publicly available.
Write to support@publicmosaic.com —
see abuse & takedown, or opt-out to exclude
a network range from scanning.