Mirai
4 hosts identified as Mirai botnet nodes: 1 still listed, 3 archived. First seen 2026-06-13.
About
An IoT botnet whose source was published in 2016 and has been forked continuously since, so "Mirai" names a lineage rather than one program. The original spread by trying a short list of default credentials against exposed telnet on ports 23 and 2323; later variants added exploits for known router and camera flaws. Most of what is listed under this label is somebody's derivative rather than the original.
Ports
Detection packs
Rules for this hub's 1 still-listed host, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.