Viper
55 hosts convicted as Viper command-and-control servers: 54 still listed, 1 archived. First seen 2026-06-13.
About
A graphical adversary-emulation platform popular in Chinese-language security work, which bundles Metasploit alongside its own modules behind a browser control panel. It is free to run and distributed as a vendor container image with a paid tier, but it is NOT open source — the BSD-licensed source ended with the 1.5 series. It is red-team tooling that also turns up in intrusions. As with Supershell, a scan usually identifies the control panel before it identifies any implant traffic.
Ports
Observed changes
Relabelled: 3 hosts earlier labelled Viper Rat. Only the most recent earlier label is kept.
Detection packs
Rules for this hub's 54 still-listed hosts, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.