Hajime
153 hosts identified as Hajime botnet nodes: 0 still listed, 153 archived. First seen 2026-06-13.
About
An anonymously released peer-to-peer IoT worm, first documented and named by Rapidity Networks in October 2016. It spreads like Mirai, but analyses up to 2019 found it used for nothing else. It blocks telnet and three other ports such worms abuse, and its author's signed message claims white-hat intent, widely read as vigilante rather than criminal. It has no central C2 server — peers meet over the public BitTorrent DHT — yet its author's signed updates spread through the mesh. Infected devices pass the worm on from a random high port. The scanner fetched and hashed an ELF file over HTTP from each address here, but took the name Hajime from abuse.ch's MalwareBazaar and could not confirm it from the file. On that identification, a listed address was observed as an infected device, not operator infrastructure. However its author meant it, the worm installs itself uninvited; a listing cannot say who owns the device or whether it remains infected.
Ports
The 8 ports with the most hosts, of 140.
Detection packs
Rules for this hub's 0 still-listed hosts, across all 2 pages of the list, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Files
Hosts · page 2 of 2
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.