DayBreak
15 hosts convicted as DayBreak command-and-control servers: 15 still listed, 0 archived. First seen 2026-08-24.
About
DayBreak (破晓) is a breach-and-attack-simulation platform from the Chinese security company Tophant (斗象科技), first released in November 2022 as a free community edition for enterprise security staff and white-hat testers — closed-source, and activated by a licence the vendor issues. Its documentation says that edition covers only automated penetration testing: agents run from a foothold inside a network and report to a server whose console the vendor itself calls a built-in C2. The fingerprint identifies that server, not a machine running an agent: its default self-signed certificates, named bas-server on the console and bas-listener on its HTTPS listeners. The console's default port is 1337, where most of these addresses answered. An authorised engagement and an intrusion can stand the server up identically, so a listing says nothing about who runs it or whether its use was authorised.
Ports
The 8 ports with the most hosts, of 11.
Detection packs
Rules for this hub's 15 still-listed hosts, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.