Public Mosaic C2 indicators

malware family

Havoc

116 hosts convicted as Havoc command-and-control servers: 113 still listed, 3 archived. First seen 2026-08-23.

feed checked 2026-10-30 17:37 UTC TLP:CLEAR

hosts 116 113 still listed

listings 152

networks 57

first seen 2026-08-23

About

An open-source C2 framework whose Demon agent was written explicitly to evade modern endpoint detection. It is common in criminal use, and its default profile leaves a recognisable TLS surface.

Ports

:44361:4005627:8020:844311:80805:20963:84443:44432

The 8 ports with the most hosts, of 27.

Observed changes

Relabelled: 1 host earlier labelled Sliver. Only the most recent earlier label is kept.

Detection packs

Rules for this hub's 113 still-listed hosts, across all 2 pages of the list, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.

Suricata rules Sigma rules View in the live feed

Hosts · page 1 of 2

Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.

62.171.134.180HavocAS51167 · Contabolast confirmed 2026-10-30 80.241.214.61HavocAS51167 · Contabolast confirmed 2026-10-30 167.148.201.108HavocAS135392 · MillenialHostlast confirmed 2026-10-28 57.129.168.220HavocAS16276 · OVHlast confirmed 2026-10-30 37.104.21.124HavocAS25019 · Saudi Telecom Company JSClast confirmed 2026-10-22 191.223.44.85HavocAS140227 · Hong Kong Communications Internationa…last confirmed 2026-10-30 96.62.218.236HavocAS207043 · DEDIK SERVICESlast confirmed 2026-10-28 165.154.227.150HavocAS142002 · Scloud Ptelast confirmed 2026-10-30 94.49.29.166HavocAS25019 · Saudi Telecom Company JSClast confirmed 2026-10-17 167.179.76.179HavocAS20473 · The Constant Companylast confirmed 2026-10-19 100.53.215.212HavocAS14618 · Amazon.comlast confirmed 2026-10-17 52.246.183.133HavocAS8075 · Microsoftlast confirmed 2026-10-15 185.193.125.8HavocAS39287 · Materialismlast confirmed 2026-10-19 45.195.76.187HavocAS149440 · Evoxt Sdn. Bhdlast confirmed 2026-10-30 38.55.99.208HavocAS42960 · VH Globallast confirmed 2026-10-18 93.95.230.32HavocAS44925 · 1984 ehflast confirmed 2026-10-30 177.201.230.9HavocAS140227 · Hong Kong Communications Internationa…last confirmed 2026-10-14 88.208.224.179HavocAS8560 · IONOS SElast confirmed 2026-10-13 3.81.47.132HavocAS14618 · Amazon.comlast confirmed 2026-10-14 216.40.79.38HavocAS63023 · GTHostlast confirmed 2026-10-23 216.152.156.175HavocAS63023 · GTHostlast confirmed 2026-10-30 5.163.189.237HavocAS25019 · Saudi Telecom Company JSClast confirmed 2026-10-12 82.202.157.112HavocAS208677 · "Cloud Technologies" LLC trading as C…last confirmed 2026-10-15 74.241.250.35HavocAS8075 · Microsoftlast confirmed 2026-10-13 157.137.215.66HavocAS31898 · Oraclelast confirmed 2026-10-30 64.227.35.8HavocAS14061 · DigitalOceanlast confirmed 2026-10-30 45.79.198.116HavocAS63949 · Akamai Connected Cloudlast confirmed 2026-10-16 137.184.139.185HavocAS14061 · DigitalOceanlast confirmed 2026-10-06 100.57.14.236HavocAS14618 · Amazon.comlast confirmed 2026-10-13 164.90.190.203HavocAS14061 · DigitalOceanlast confirmed 2026-10-09 44.243.239.80HavocAS16509 · Amazon.comlast confirmed 2026-10-09 100.61.249.34HavocAS14618 · Amazon.comlast confirmed 2026-10-13 92.51.46.35HavocAS210976 · Timeweb, LLPlast confirmed 2026-10-30 158.94.210.16HavocAS202412 · Omegatechlast confirmed 2026-10-12 157.22.198.33HavocAS29182 · JSC IOTlast confirmed 2026-10-15 13.61.179.31HavocAS16509 · Amazon.comlast confirmed 2026-10-05 169.58.228.3HavocAS51167 · Contabolast confirmed 2026-10-18 34.116.132.157HavocAS396982 · Googlelast confirmed 2026-10-06 144.172.69.79HavocAS30823 · aurologiclast confirmed 2026-10-02 47.236.114.167HavocAS45102 · Alibaba (US) Technologylast confirmed 2026-09-29 179.43.170.151HavocAS51852 · Private Layerlast confirmed 2026-10-09 51.159.21.191HavocAS12876 · Scalewaylast confirmed 2026-09-28 78.17.93.159HavocAS26832 · Rica Web Serviceslast confirmed 2026-10-02 34.51.203.250HavocAS396982 · Googlelast confirmed 2026-09-27 188.48.121.249HavocAS25019 · Saudi Telecom Company JSClast confirmed 2026-09-24 45.86.229.111HavocAS62005 · BlueVPS OUlast confirmed 2026-10-09 38.60.136.202HavocAS154177 · LIGHT NODElast confirmed 2026-09-22 13.140.145.33HavocAS51167 · Contabolast confirmed 2026-09-22 76.13.165.226HavocAS47583 · Hostinger Internationallast confirmed 2026-09-23 45.74.36.153HavocAS212238 · Datacamplast confirmed 2026-09-21 188.166.254.199HavocAS14061 · DigitalOceanlast confirmed 2026-10-30 154.36.161.180HavocAS979 · NetLab Globallast confirmed 2026-09-29 68.178.202.150HavocAS398101 · GoDaddy.comlast confirmed 2026-10-06 57.154.15.252HavocAS8075 · Microsoftlast confirmed 2026-10-30 16.5.7.159HavocAS219008 · Magnohost Provedora de Servicos Web L…last confirmed 2026-09-14 154.46.30.12HavocAS203919 · LUMADOCKlast confirmed 2026-09-11 54.247.42.8HavocAS16509 · Amazon.comlast confirmed 2026-10-02archived 104.248.156.16HavocAS14061 · DigitalOceanlast confirmed 2026-10-12 167.172.142.69HavocAS14061 · DigitalOceanlast confirmed 2026-09-23 66.78.40.93HavocAS215659 · Aokigaharalast confirmed 2026-09-09 50.60.157.152HavocAS25019 · Saudi Telecom Company JSClast confirmed 2026-09-23archived 85.9.199.115HavocAS25697 · UpCloud USAlast confirmed 2026-09-07 193.239.85.15HavocAS9009 · M247 Europelast confirmed 2026-10-27 154.205.145.109HavocAS154177 · LIGHT NODElast confirmed 2026-10-30 151.236.21.109HavocAS9009 · M247 Europelast confirmed 2026-10-28 178.128.14.67HavocAS14061 · DigitalOceanlast confirmed 2026-10-30 37.235.54.142HavocAS39326 · Syntura Grouplast confirmed 2026-10-30 41.216.189.153HavocAS211138 · Private-Hosting di Cipriano oscarlast confirmed 2026-10-30 8.147.114.203HavocAS37963 · Hangzhou Alibaba Advertisinglast confirmed 2026-09-21archived 159.89.192.91HavocAS14061 · DigitalOceanlast confirmed 2026-10-30 68.183.248.32HavocAS14061 · DigitalOceanlast confirmed 2026-10-30 89.125.48.185HavocAS218731 · Andris Jakovlevslast confirmed 2026-09-08 18.171.190.112HavocAS16509 · Amazon.comlast confirmed 2026-09-10 2.91.182.143HavocAS25019 · Saudi Telecom Company JSClast confirmed 2026-09-05 3.39.249.68HavocAS16509 · Amazon.comlast confirmed 2026-09-05 20.2.140.201HavocAS8075 · Microsoftlast confirmed 2026-10-28 164.132.104.177HavocAS16276 · OVHlast confirmed 2026-09-02 210.2.169.213HavocAS23966 · LINKdotNET Telecomlast confirmed 2026-10-21 124.220.55.95HavocAS45090 · Shenzhen Tencent Computer Systems Com…last confirmed 2026-09-21 212.103.26.10HavocAS15557 · SFR SAlast confirmed 2026-10-30 212.46.38.117HavocAS62005 · BlueVPS OUlast confirmed 2026-10-30 18.97.21.97HavocAS14618 · Amazon.comlast confirmed 2026-09-17 185.130.45.240HavocAS210083 · Privexlast confirmed 2026-09-03 95.133.166.10HavocAS200651 · FlokiNET ehflast confirmed 2026-10-28 2.91.185.72HavocAS25019 · Saudi Telecom Company JSClast confirmed 2026-08-31 162.243.160.70HavocAS14061 · DigitalOceanlast confirmed 2026-08-31 217.217.97.164HavocAS214961 · Stellar Grouplast confirmed 2026-09-04 191.252.184.198HavocAS27715 · Locaweb Servicos de Internet S/Alast confirmed 2026-10-20 154.37.213.27HavocAS979 · NetLab Globallast confirmed 2026-09-06 172.239.45.42HavocAS63949 · Akamai Connected Cloudlast confirmed 2026-08-28 173.249.41.141HavocAS51167 · Contabolast confirmed 2026-10-23 143.198.120.167HavocAS14061 · DigitalOceanlast confirmed 2026-10-30 107.172.22.3HavocAS36352 · HostPapalast confirmed 2026-10-29 82.156.224.184HavocAS45090 · Shenzhen Tencent Computer Systems Com…last confirmed 2026-10-30 51.81.171.234HavocAS16276 · OVHlast confirmed 2026-10-30 35.179.229.71HavocAS16509 · Amazon.comlast confirmed 2026-09-16 15.204.95.228HavocAS16276 · OVHlast confirmed 2026-10-30 15.204.14.143HavocAS16276 · OVHlast confirmed 2026-10-30 54.95.208.190HavocAS16509 · Amazon.comlast confirmed 2026-10-30 2.88.92.98HavocAS25019 · Saudi Telecom Company JSClast confirmed 2026-08-28

Listed in error?

These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.