public mosaic llc support@publicmosaic.com
confirmed host

IP address 43.135.34.69

Adaptixcommand-and-control server · :43911, :443

Last confirmed 2026-09-15, first seen 2026-08-25. On AS132203.

listed last confirmed feed checked TLP:CLEAR SURICATA .RULES SEE THE LIVE FEED →

This address answered on 2 ports — :43911, :443.

43.135.34.69:43911 · Adaptix

Last confirmed (today)

first seen2026-09-02 10:13 UTC
serviceip-port · tcp
networkAS132203 · Tencent Building, Kejizhongyi Avenue
confidence100 / 100
tls certificate57ef4e42062b8b2f6b7e6d986a2ec73752d91c2747a4a5c4243679bd4ad1d4dd
cert subjectlocalhost
cert subject orgAdaptixC2
cert issuerlocalhost
cert issuer orgAdaptixC2
cert validity2025-12-22 → 2035-12-20
cert typeself-signed
cert key2048-bit
cert serial (decimal)76864601229500736029971121327590574118064434295

The certificate names above are what the certificate ASSERTS, not proof this host owns them — a self-signed certificate can claim any subject, so treat a familiar name here as an impersonation attempt rather than an identity.

ja4x2bab15409345_2bab15409345_795797892f9c

43.135.34.69:443 · Adaptix

Last confirmed (today)

first seen2026-08-25 03:31 UTC
serviceip-port · tcp · HTTPS blend-in
networkAS132203 · Tencent Building, Kejizhongyi Avenue
confidence100 / 100
tls certificate1befcd3a15cbd1524d43e494bb416033da50f9e8ada46ec406c30cbcd2baf001
cert validity2025-12-22 → 2026-12-22
cert typeself-signed
cert key2048-bit
cert serial (decimal)8625051764152268313682813199501436
cert names0.0.0.0

The certificate names above are what the certificate ASSERTS, not proof this host owns them — a self-signed certificate can claim any subject, so treat a familiar name here as an impersonation attempt rather than an identity.

ja4x000000000000_000000000000_e1926048963f
jarm3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fb
payload sha-256464816fd640d5bdd848e7c4340f378f873c406c641d9d6c1477c4d83ddbdacf2

The payload hash is the SHA-256 of the file this listener served when it was scanned. A host can change what it serves at any time, so this identifies a sample to look up or analyse rather than describing what it serves now. Only the response’s Content-Type claimed a download — no executable magic bytes were seen — so the bytes behind this hash are unverified.

Observation history

18d agotoday

Observed on 18 of the 18 days since this archive began recording, 2026-08-29 UTC. Presence is per UTC day: a day is marked when the scanner confirmed this address at least once, not once per scan.

Shared JA4X issuance template · 79 hosts

These hosts issued certificates from the same template — the same distinguished-name fields hashed in the same order. It links tooling, not necessarily an operator.

Showing 24 of 79. The rest are reachable from any of them.

Pivots & lookups