Flying Eagle
116 addresses convicted as Flying Eagle remote-access trojan controllers — 116 still listed, 0 archived. Observed from 2026-08-29.
Detection packs
Rules for the 116 still-listed addresses on this page, regenerated as the archive updates; archived episodes are omitted, and a rule can lag a withdrawal by up to five minutes. Suricata rules are rev:2 — alert tcp on address and port, alert tls where a full certificate fingerprint is published — and carry the archive's own episode ids as sids, so packs load beside each other and beside any per-host file. YARA packs are hash matches only: this site holds no file bytes.
About
An Android remote-access trojan built around a generator: the operator picks a name, an icon and a callback address, and it produces an APK. Lures impersonate Chinese government services; on a phone it abuses the accessibility service to log keystrokes, capture the screen and lay credential-stealing overlays over payment apps. WHAT IS LISTED HERE IS THE OPERATOR'S PANEL, never an infected handset — no phone is recorded and nothing on this page identifies a victim. Its source leaked in early 2026, which is the likeliest reason these panels sit across dozens of unrelated networks rather than in one operator's range, with no shared certificate binding them. Re-labelled by the upstream in place: 1 host earlier labelled Overlord. The archive keeps only the most recent earlier label per episode. Recently first observed in AS213495 on 2026-09-08 (1 host) — networks this family had not appeared in before, as seen by this archive. Upstream population estimate: hosts of this family observed moving toward AS45753 on 2026-09-14 (fewer than 10 hosts); toward AS400619 on 2026-09-12 (fewer than 10 hosts); toward AS55933 on 2026-09-11 (fewer than 10 hosts); toward AS16509 on 2026-09-09 (fewer than 10 hosts) — the upstream scanner's estimate from a passive search population, not this archive's observation, and shown only for networks where this archive holds at least one host of this family.
Ports
Addresses · page 1 of 2
Ordered by when this archive first recorded them, newest first — a stable ordering, so a page holds the same addresses tomorrow. Archived addresses are included and marked; they are the majority of this corpus over time.
Listed in error?
These pages are generated from automated scanning and are publicly available. Write to support@publicmosaic.com — see abuse & takedown, or opt-out to exclude a network range from scanning.