Covenant
4 addresses convicted as Covenant command-and-control servers — 4 still listed, 0 archived. Observed from 2026-08-23.
Detection packs
Rules for the 4 still-listed addresses on this page, regenerated as the archive updates; archived episodes are omitted, and a rule can lag a withdrawal by up to five minutes. Suricata rules are rev:2 — alert tcp on address and port, alert tls where a full certificate fingerprint is published — and carry the archive's own episode ids as sids, so packs load beside each other and beside any per-host file. YARA packs are hash matches only: this site holds no file bytes.
About
An open-source .NET C2 framework built around collaborative red-team use. Its author stopped developing it years ago — master has not moved since April 2021 and the dev branch that carried the later work stopped in 2023 — and newer frameworks have displaced it. That says nothing about the age of any server listed here: a C2 framework needs no upstream maintenance to be stood up fresh, and modified Covenant payloads were still being attributed to state actors in 2025.
Ports
Addresses
Ordered by when this archive first recorded them, newest first — a stable ordering, so a page holds the same addresses tomorrow. Archived addresses are included and marked; they are the majority of this corpus over time.
Listed in error?
These pages are generated from automated scanning and are publicly available. Write to support@publicmosaic.com — see abuse & takedown, or opt-out to exclude a network range from scanning.