DarkComet
4 hosts convicted as DarkComet remote-access trojan controllers: 4 still listed, 0 archived. First seen 2026-09-16.
About
A Windows remote-access trojan its author distributed free from 2008 and withdrew in July 2012 after reports of its use against Syrian activists. Its source never leaked, but the final builds have circulated in hacking packs ever since, and it remains one of the most common commodity RATs more than a decade on. Its default listening port is 1604, and every host on this hub was reached there. What is listed is the controller side of that connection: in DarkComet's own inverted naming the compromised machine runs the "server" stub and calls out to the operator's "client", and it is that listener the scanner reached, never a machine the stub runs on.
Ports
Observed changes
New networks for this family in this archive, last 7 days: AS8151 on 2026-10-28 (1 host).
Detection packs
Rules for this hub's 4 still-listed hosts, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.