Havoc
116 hosts convicted as Havoc command-and-control servers: 113 still listed, 3 archived. First seen 2026-08-23.
About
An open-source C2 framework whose Demon agent was written explicitly to evade modern endpoint detection. It is common in criminal use, and its default profile leaves a recognisable TLS surface.
Ports
The 8 ports with the most hosts, of 27.
Observed changes
Relabelled: 1 host earlier labelled Sliver. Only the most recent earlier label is kept.
Detection packs
Rules for this hub's 113 still-listed hosts, across all 2 pages of the list, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts · page 2 of 2
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.