Adaptix
440 hosts convicted as Adaptix command-and-control servers: 434 still listed, 6 archived. First seen 2026-08-22.
About
AdaptixC2 is an open-source post-exploitation and adversarial-emulation framework, developed on GitHub by the Adaptix Framework project since 2024 and made, its README says, for authorised penetration testing; Unit 42 documented its use in intrusions in 2025. Operators drive its Go team server from a cross-platform desktop client, and listeners and agents plug in as modules. As shipped, the team server and its listeners answer requests in ways that identify the product. The team server's default port is 4321, where many of these addresses answered. A listed address is the server, or a redirector relaying its responses (the documentation provides for one), not a machine running an agent. Testers and intruders stand the server up identically, so a listing cannot say whose it is or whether its use was authorised.
Ports
The 8 ports with the most hosts, of 162.
Observed changes
Relabelled: 1 host earlier labelled Sliver; 1 host earlier labelled Mythic; 1 host earlier labelled Cobalt Strike. Only the most recent earlier label is kept.
New networks for this family in this archive, last 7 days: AS965 on 2026-10-26 (1 host); AS979 on 2026-10-25 (1 host); AS198953 on 2026-10-24 (1 host).
Estimated moves of this family toward AS8075 on 2026-10-14 (fewer than 10 hosts); toward AS45090 on 2026-10-14 (fewer than 10 hosts); toward AS14061 on 2026-10-13 (fewer than 10 hosts); toward AS20473 on 2026-10-13 (fewer than 10 hosts). These are the scanner’s estimates from passive search data, shown only where this archive also holds a host of this family. Showing the 4 newest of at least 8.
Detection packs
Rules for this hub's 434 still-listed hosts, across all 5 pages of the list, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Files
Hosts · page 5 of 5
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.