# publicmosaic.rules — generated 2026-10-30 20:37 UTC — 353 rules — TLP:CLEAR
# source: https://publicmosaic.com — published for defensive use
# scope: configuration beacon type — https://publicmosaic.com/config/beacon_type/d3M
# rev:4 — replace every earlier rule file from this site. Suricata refuses a duplicate sid, so never load an older one beside this one.
# covers listed listeners only; archived listings omitted: 0
# A withdrawal can take up to five minutes to reach this file. Each address's page under publicmosaic.com/ip/ is authoritative.
alert tcp $HOME_NET any -> 205.234.170.195 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/205.234.170.195; sid:9100927; rev:4;)
alert tcp $HOME_NET any -> 193.134.209.166 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/193.134.209.166; sid:9100930; rev:4;)
alert tcp $HOME_NET any -> 185.242.3.178 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/185.242.3.178; sid:9100932; rev:4;)
alert tcp $HOME_NET any -> 169.239.128.75 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/169.239.128.75; sid:9100934; rev:4;)
alert tcp $HOME_NET any -> 155.94.144.168 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/155.94.144.168; sid:9100937; rev:4;)
alert tcp $HOME_NET any -> 154.92.5.37 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.92.5.37; sid:9100940; rev:4;)
alert tcp $HOME_NET any -> 154.92.5.37 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.92.5.37; sid:9100942; rev:4;)
alert tcp $HOME_NET any -> 151.245.90.134 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/151.245.90.134; sid:9100943; rev:4;)
alert tcp $HOME_NET any -> 47.254.173.184 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.254.173.184; sid:9100970; rev:4;)
alert tcp $HOME_NET any -> 45.194.17.183 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.194.17.183; sid:9100983; rev:4;)
alert tcp $HOME_NET any -> 45.86.229.111 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.86.229.111; sid:9100987; rev:4;)
alert tcp $HOME_NET any -> 39.109.126.185 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/39.109.126.185; sid:9100991; rev:4;)
alert tcp $HOME_NET any -> 38.47.102.194 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.47.102.194; sid:9100992; rev:4;)
alert tcp $HOME_NET any -> 178.16.52.120 8787 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/178.16.52.120; sid:9101173; rev:4;)
alert tcp $HOME_NET any -> 104.168.19.222 9000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.168.19.222; sid:9101191; rev:4;)
alert tcp $HOME_NET any -> 39.109.126.185 12306 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/39.109.126.185; sid:9101204; rev:4;)
alert tcp $HOME_NET any -> 103.242.12.143 1234 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.242.12.143; sid:9101218; rev:4;)
alert tcp $HOME_NET any -> 145.79.143.166 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/145.79.143.166; sid:9101339; rev:4;)
alert tcp $HOME_NET any -> 47.236.130.154 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.236.130.154; sid:9101440; rev:4;)
alert tcp $HOME_NET any -> 154.91.180.246 18080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.180.246; sid:9101524; rev:4;)
alert tcp $HOME_NET any -> 192.25.102.246 8089 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.25.102.246; sid:9101622; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.34 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.34; sid:9102293; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.44 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.44; sid:9102295; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.42 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.42; sid:9102297; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.35 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.35; sid:9102298; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.62 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.62; sid:9102300; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.61 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.61; sid:9102302; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.60 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.60; sid:9102304; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.58 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.58; sid:9102306; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.57 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.57; sid:9102308; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.55 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.55; sid:9102310; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.52 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.52; sid:9102312; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.39 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.39; sid:9102314; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.38 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.38; sid:9102316; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.37 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.37; sid:9102318; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.35 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.35; sid:9102320; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.34 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.34; sid:9102322; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.62 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.62; sid:9102324; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.55 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.55; sid:9102326; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.50 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.50; sid:9102328; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.45 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.45; sid:9102330; rev:4;)
alert tcp $HOME_NET any -> 154.36.163.65 63350 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.36.163.65; sid:9102336; rev:4;)
alert tcp $HOME_NET any -> 154.36.163.65 53389 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.36.163.65; sid:9102337; rev:4;)
alert tcp $HOME_NET any -> 151.245.121.11 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/151.245.121.11; sid:9102356; rev:4;)
alert tcp $HOME_NET any -> 151.243.137.78 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/151.243.137.78; sid:9102357; rev:4;)
alert tcp $HOME_NET any -> 149.30.247.60 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.30.247.60; sid:9102364; rev:4;)
alert tcp $HOME_NET any -> 149.28.139.62 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.28.139.62; sid:9102365; rev:4;)
alert tcp $HOME_NET any -> 149.28.135.144 8083 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.28.135.144; sid:9102366; rev:4;)
alert tcp $HOME_NET any -> 134.122.153.121 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/134.122.153.121; sid:9102391; rev:4;)
alert tcp $HOME_NET any -> 130.94.92.169 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/130.94.92.169; sid:9102394; rev:4;)
alert tcp $HOME_NET any -> 108.165.176.124 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/108.165.176.124; sid:9102492; rev:4;)
alert tcp $HOME_NET any -> 108.165.176.124 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/108.165.176.124; sid:9102493; rev:4;)
alert tcp $HOME_NET any -> 107.173.85.194 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.173.85.194; sid:9102500; rev:4;)
alert tcp $HOME_NET any -> 107.172.214.214 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.172.214.214; sid:9102505; rev:4;)
alert tcp $HOME_NET any -> 107.172.80.241 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.172.80.241; sid:9102507; rev:4;)
alert tcp $HOME_NET any -> 107.161.168.217 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.161.168.217; sid:9102509; rev:4;)
alert tcp $HOME_NET any -> 103.211.32.112 2082 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.211.32.112; sid:9102533; rev:4;)
alert tcp $HOME_NET any -> 103.159.206.136 2086 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.159.206.136; sid:9102537; rev:4;)
alert tcp $HOME_NET any -> 103.110.221.162 8441 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.110.221.162; sid:9102548; rev:4;)
alert tcp $HOME_NET any -> 103.51.147.252 15312 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.51.147.252; sid:9102553; rev:4;)
alert tcp $HOME_NET any -> 103.51.147.252 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.51.147.252; sid:9102554; rev:4;)
alert tcp $HOME_NET any -> 102.204.223.106 47351 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/102.204.223.106; sid:9102557; rev:4;)
alert tcp $HOME_NET any -> 206.119.178.109 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.119.178.109; sid:9102615; rev:4;)
alert tcp $HOME_NET any -> 204.194.54.54 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/204.194.54.54; sid:9102626; rev:4;)
alert tcp $HOME_NET any -> 204.194.53.9 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/204.194.53.9; sid:9102629; rev:4;)
alert tcp $HOME_NET any -> 204.194.51.97 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/204.194.51.97; sid:9102632; rev:4;)
alert tcp $HOME_NET any -> 202.182.102.83 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/202.182.102.83; sid:9102639; rev:4;)
alert tcp $HOME_NET any -> 195.114.193.201 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/195.114.193.201; sid:9102645; rev:4;)
alert tcp $HOME_NET any -> 192.255.128.122 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.255.128.122; sid:9102652; rev:4;)
alert tcp $HOME_NET any -> 192.227.167.203 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.227.167.203; sid:9102655; rev:4;)
alert tcp $HOME_NET any -> 192.129.141.183 18886 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.129.141.183; sid:9102664; rev:4;)
alert tcp $HOME_NET any -> 185.244.212.122 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/185.244.212.122; sid:9102670; rev:4;)
alert tcp $HOME_NET any -> 185.244.212.122 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/185.244.212.122; sid:9102672; rev:4;)
alert tcp $HOME_NET any -> 185.244.212.122 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/185.244.212.122; sid:9102673; rev:4;)
alert tcp $HOME_NET any -> 178.16.52.120 8767 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/178.16.52.120; sid:9102692; rev:4;)
alert tcp $HOME_NET any -> 156.244.9.19 9094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.244.9.19; sid:9102719; rev:4;)
alert tcp $HOME_NET any -> 156.238.120.13 18084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.238.120.13; sid:9102725; rev:4;)
alert tcp $HOME_NET any -> 154.92.5.37 8334 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.92.5.37; sid:9102727; rev:4;)
alert tcp $HOME_NET any -> 154.91.180.246 18081 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.180.246; sid:9102728; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.60 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.60; sid:9102732; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.57 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.57; sid:9102734; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.55 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.55; sid:9102736; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.61 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.61; sid:9102738; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.59 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.59; sid:9102740; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.58 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.58; sid:9102742; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.57 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.57; sid:9102744; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.56 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.56; sid:9102746; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.48 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.48; sid:9102750; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.47 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.47; sid:9102751; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.38 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.38; sid:9102753; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.54 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.54; sid:9102756; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.51 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.51; sid:9102757; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.55 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.55; sid:9102758; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.47 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.47; sid:9102761; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.46 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.46; sid:9102762; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.49 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.49; sid:9102764; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.53 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.53; sid:9102766; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.37 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.37; sid:9102767; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.33 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.33; sid:9102769; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.51 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.51; sid:9102772; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.44 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.44; sid:9102774; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.43 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.43; sid:9102776; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.34 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.34; sid:9102779; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.42 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.42; sid:9102781; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.62 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.62; sid:9102783; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.54 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.54; sid:9102785; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.45 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.45; sid:9102786; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.47 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.47; sid:9102787; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.60 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.60; sid:9102788; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.61 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.61; sid:9102789; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.43 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.43; sid:9102790; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.48 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.48; sid:9102791; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.40 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.40; sid:9102794; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.39 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.39; sid:9102799; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.42 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.42; sid:9102802; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.59 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.59; sid:9102804; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.56 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.56; sid:9102806; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.54 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.54; sid:9102810; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.51 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.51; sid:9102812; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.48 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.48; sid:9102814; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.47 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.47; sid:9102815; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.46 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.46; sid:9102818; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.43 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.43; sid:9102820; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.44 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.44; sid:9102821; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.42 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.42; sid:9102824; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.37 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.37; sid:9102826; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.36 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.36; sid:9102828; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.35 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.35; sid:9102830; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.34 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.34; sid:9102832; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.33 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.33; sid:9102833; rev:4;)
alert tcp $HOME_NET any -> 96.126.179.88 10000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/96.126.179.88; sid:9102897; rev:4;)
alert tcp $HOME_NET any -> 93.177.77.228 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/93.177.77.228; sid:9102900; rev:4;)
alert tcp $HOME_NET any -> 91.92.242.3 7001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/91.92.242.3; sid:9102904; rev:4;)
alert tcp $HOME_NET any -> 91.92.242.3 2087 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/91.92.242.3; sid:9102905; rev:4;)
alert tcp $HOME_NET any -> 88.216.208.91 65523 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/88.216.208.91; sid:9102907; rev:4;)
alert tcp $HOME_NET any -> 88.216.208.91 65512 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/88.216.208.91; sid:9102908; rev:4;)
alert tcp $HOME_NET any -> 88.216.208.91 2052 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/88.216.208.91; sid:9102909; rev:4;)
alert tcp $HOME_NET any -> 88.216.191.9 8880 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/88.216.191.9; sid:9102910; rev:4;)
alert tcp $HOME_NET any -> 85.209.48.248 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/85.209.48.248; sid:9102911; rev:4;)
alert tcp $HOME_NET any -> 77.111.101.118 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/77.111.101.118; sid:9102925; rev:4;)
alert tcp $HOME_NET any -> 69.48.228.156 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/69.48.228.156; sid:9102928; rev:4;)
alert tcp $HOME_NET any -> 66.179.30.146 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/66.179.30.146; sid:9102929; rev:4;)
alert tcp $HOME_NET any -> 65.0.216.226 80 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/65.0.216.226; sid:9102934; rev:4;)
alert tcp $HOME_NET any -> 64.111.93.243 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/64.111.93.243; sid:9102936; rev:4;)
alert tcp $HOME_NET any -> 64.7.199.177 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/64.7.199.177; sid:9102940; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.237 9090 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.237; sid:9102962; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.236 9090 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.236; sid:9102966; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.235 9090 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.235; sid:9102970; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.234 9090 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.234; sid:9102973; rev:4;)
alert tcp $HOME_NET any -> 47.239.223.39 5678 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.239.223.39; sid:9103001; rev:4;)
alert tcp $HOME_NET any -> 47.236.130.154 2095 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.236.130.154; sid:9103006; rev:4;)
alert tcp $HOME_NET any -> 47.129.155.127 80 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/47.129.155.127; sid:9103008; rev:4;)
alert tcp $HOME_NET any -> 47.86.82.95 8081 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.86.82.95; sid:9103049; rev:4;)
alert tcp $HOME_NET any -> 47.79.123.84 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.79.123.84; sid:9103053; rev:4;)
alert tcp $HOME_NET any -> 47.76.245.121 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.76.245.121; sid:9103055; rev:4;)
alert tcp $HOME_NET any -> 45.197.36.34 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.197.36.34; sid:9103067; rev:4;)
alert tcp $HOME_NET any -> 45.194.21.64 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.194.21.64; sid:9103069; rev:4;)
alert tcp $HOME_NET any -> 45.136.14.91 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.136.14.91; sid:9103078; rev:4;)
alert tcp $HOME_NET any -> 45.87.53.6 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.87.53.6; sid:9103088; rev:4;)
alert tcp $HOME_NET any -> 45.77.242.92 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.77.242.92; sid:9103089; rev:4;)
alert tcp $HOME_NET any -> 45.77.220.145 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.77.220.145; sid:9103091; rev:4;)
alert tcp $HOME_NET any -> 43.255.156.232 8888 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.255.156.232; sid:9103097; rev:4;)
alert tcp $HOME_NET any -> 43.255.156.232 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.255.156.232; sid:9103098; rev:4;)
alert tcp $HOME_NET any -> 43.255.156.232 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.255.156.232; sid:9103099; rev:4;)
alert tcp $HOME_NET any -> 43.173.70.252 4455 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.173.70.252; sid:9103103; rev:4;)
alert tcp $HOME_NET any -> 43.156.179.8 4433 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.156.179.8; sid:9103105; rev:4;)
alert tcp $HOME_NET any -> 43.110.42.102 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.110.42.102; sid:9103136; rev:4;)
alert tcp $HOME_NET any -> 38.181.44.109 9999 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.181.44.109; sid:9103167; rev:4;)
alert tcp $HOME_NET any -> 38.181.44.109 8089 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.181.44.109; sid:9103168; rev:4;)
alert tcp $HOME_NET any -> 38.76.169.233 8081 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.76.169.233; sid:9103173; rev:4;)
alert tcp $HOME_NET any -> 38.60.125.131 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.60.125.131; sid:9103180; rev:4;)
alert tcp $HOME_NET any -> 38.54.95.51 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.54.95.51; sid:9103183; rev:4;)
alert tcp $HOME_NET any -> 38.45.125.102 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.45.125.102; sid:9103192; rev:4;)
alert tcp $HOME_NET any -> 38.45.125.101 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.45.125.101; sid:9103193; rev:4;)
alert tcp $HOME_NET any -> 38.45.125.100 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.45.125.100; sid:9103194; rev:4;)
alert tcp $HOME_NET any -> 38.45.125.99 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.45.125.99; sid:9103195; rev:4;)
alert tcp $HOME_NET any -> 38.45.125.98 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.45.125.98; sid:9103196; rev:4;)
alert tcp $HOME_NET any -> 31.7.62.178 12583 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/31.7.62.178; sid:9103200; rev:4;)
alert tcp $HOME_NET any -> 31.7.62.178 12581 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/31.7.62.178; sid:9103201; rev:4;)
alert tcp $HOME_NET any -> 31.7.62.178 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/31.7.62.178; sid:9103202; rev:4;)
alert tcp $HOME_NET any -> 23.224.69.110 3308 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.224.69.110; sid:9103213; rev:4;)
alert tcp $HOME_NET any -> 23.224.69.109 3308 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.224.69.109; sid:9103214; rev:4;)
alert tcp $HOME_NET any -> 23.224.69.108 3308 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.224.69.108; sid:9103215; rev:4;)
alert tcp $HOME_NET any -> 23.224.69.107 3308 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.224.69.107; sid:9103216; rev:4;)
alert tcp $HOME_NET any -> 23.224.69.106 3308 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.224.69.106; sid:9103217; rev:4;)
alert tcp $HOME_NET any -> 23.148.212.219 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.148.212.219; sid:9103218; rev:4;)
alert tcp $HOME_NET any -> 23.148.212.219 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.148.212.219; sid:9103219; rev:4;)
alert tcp $HOME_NET any -> 23.95.242.55 1080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.95.242.55; sid:9103221; rev:4;)
alert tcp $HOME_NET any -> 23.95.242.55 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.95.242.55; sid:9103222; rev:4;)
alert tcp $HOME_NET any -> 23.94.70.197 8085 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.94.70.197; sid:9103225; rev:4;)
alert tcp $HOME_NET any -> 18.163.8.203 31522 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/18.163.8.203; sid:9103232; rev:4;)
alert tcp $HOME_NET any -> 16.162.195.211 8443 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/16.162.195.211; sid:9103233; rev:4;)
alert tcp $HOME_NET any -> 8.218.114.253 59000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.218.114.253; sid:9103239; rev:4;)
alert tcp $HOME_NET any -> 178.104.160.172 9001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/178.104.160.172; sid:9103474; rev:4;)
alert tcp $HOME_NET any -> 173.249.220.138 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/173.249.220.138; sid:9103475; rev:4;)
alert tcp $HOME_NET any -> 173.242.114.162 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/173.242.114.162; sid:9103477; rev:4;)
alert tcp $HOME_NET any -> 173.211.46.220 53306 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/173.211.46.220; sid:9103479; rev:4;)
alert tcp $HOME_NET any -> 172.245.126.122 2082 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/172.245.126.122; sid:9103480; rev:4;)
alert tcp $HOME_NET any -> 165.154.241.51 2086 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/165.154.241.51; sid:9103488; rev:4;)
alert tcp $HOME_NET any -> 160.25.134.148 559 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/160.25.134.148; sid:9103490; rev:4;)
alert tcp $HOME_NET any -> 159.100.9.55 18081 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/159.100.9.55; sid:9103491; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.62 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.62; sid:9103501; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.59 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.59; sid:9103503; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.58 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.58; sid:9103505; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.52 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.52; sid:9103507; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.50 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.50; sid:9103509; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.48 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.48; sid:9103511; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.47 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.47; sid:9103513; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.44 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.44; sid:9103515; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.40 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.40; sid:9103517; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.37 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.37; sid:9103519; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.36 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.36; sid:9103521; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.35 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.35; sid:9103523; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.62 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.62; sid:9103525; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.61 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.61; sid:9103527; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.59 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.59; sid:9103529; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.57 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.57; sid:9103531; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.54 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.54; sid:9103533; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.53 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.53; sid:9103535; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.52 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.52; sid:9103537; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.48 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.48; sid:9103539; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.44 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.44; sid:9103540; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.43 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.43; sid:9103543; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.39 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.39; sid:9103545; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.38 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.38; sid:9103547; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.34 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.34; sid:9103549; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.33 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.33; sid:9103551; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.59 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.59; sid:9103553; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.53 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.53; sid:9103555; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.49 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.49; sid:9103557; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.45 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.45; sid:9103559; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.44 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.44; sid:9103561; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.43 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.43; sid:9103563; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.41 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.41; sid:9103565; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.38 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.38; sid:9103567; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.37 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.37; sid:9103569; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.36 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.36; sid:9103572; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.62 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.62; sid:9103573; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.61 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.61; sid:9103575; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.60 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.60; sid:9103577; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.53 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.53; sid:9103579; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.52 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.52; sid:9103582; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.51 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.51; sid:9103584; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.49 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.49; sid:9103586; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.47 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.47; sid:9103588; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.46 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.46; sid:9103590; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.45 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.45; sid:9103591; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.42 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.42; sid:9103593; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.39 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.39; sid:9103595; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.38 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.38; sid:9103597; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.37 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.37; sid:9103599; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.36 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.36; sid:9103600; rev:4;)
alert tcp $HOME_NET any -> 8.210.222.251 56789 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.210.222.251; sid:9103622; rev:4;)
alert tcp $HOME_NET any -> 107.172.201.125 59009 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.172.201.125; sid:9103630; rev:4;)
alert tcp $HOME_NET any -> 202.61.140.122 58002 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/202.61.140.122; sid:9103805; rev:4;)
alert tcp $HOME_NET any -> 45.221.115.76 8843 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.221.115.76; sid:9103898; rev:4;)
alert tcp $HOME_NET any -> 18.139.85.136 2086 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/18.139.85.136; sid:9103899; rev:4;)
alert tcp $HOME_NET any -> 172.245.168.240 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/172.245.168.240; sid:9104009; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.238 9090 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.238; sid:9104018; rev:4;)
alert tcp $HOME_NET any -> 23.238.28.180 58443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.238.28.180; sid:9104022; rev:4;)
alert tcp $HOME_NET any -> 103.208.87.59 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.208.87.59; sid:9104053; rev:4;)
alert tcp $HOME_NET any -> 38.54.14.80 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.54.14.80; sid:9104097; rev:4;)
alert tcp $HOME_NET any -> 104.234.172.217 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.234.172.217; sid:9104157; rev:4;)
alert tcp $HOME_NET any -> 103.110.221.162 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.110.221.162; sid:9104195; rev:4;)
alert tcp $HOME_NET any -> 102.129.165.178 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/102.129.165.178; sid:9104302; rev:4;)
alert tcp $HOME_NET any -> 173.249.206.44 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/173.249.206.44; sid:9104311; rev:4;)
alert tcp $HOME_NET any -> 160.25.134.148 8964 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/160.25.134.148; sid:9104312; rev:4;)
alert tcp $HOME_NET any -> 18.139.222.223 82 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/18.139.222.223; sid:9104441; rev:4;)
alert tcp $HOME_NET any -> 130.94.66.82 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/130.94.66.82; sid:9104459; rev:4;)
alert tcp $HOME_NET any -> 8.220.246.195 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.220.246.195; sid:9104477; rev:4;)
alert tcp $HOME_NET any -> 139.95.24.51 8081 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/139.95.24.51; sid:9104548; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.59 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.59; sid:9104649; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.36 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.36; sid:9104655; rev:4;)
alert tcp $HOME_NET any -> 8.217.34.108 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.217.34.108; sid:9104832; rev:4;)
alert tcp $HOME_NET any -> 104.64.210.147 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.64.210.147; sid:9105611; rev:4;)
alert tcp $HOME_NET any -> 206.206.76.110 2082 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.206.76.110; sid:9105612; rev:4;)
alert tcp $HOME_NET any -> 198.46.159.243 2086 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/198.46.159.243; sid:9105619; rev:4;)
alert tcp $HOME_NET any -> 198.12.77.134 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/198.12.77.134; sid:9105620; rev:4;)
alert tcp $HOME_NET any -> 107.173.51.146 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.173.51.146; sid:9105646; rev:4;)
alert tcp $HOME_NET any -> 134.122.154.92 2086 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/134.122.154.92; sid:9105650; rev:4;)
alert tcp $HOME_NET any -> 134.122.154.92 2082 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/134.122.154.92; sid:9105653; rev:4;)
alert tcp $HOME_NET any -> 165.154.205.34 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/165.154.205.34; sid:9105658; rev:4;)
alert tcp $HOME_NET any -> 165.154.205.34 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/165.154.205.34; sid:9105659; rev:4;)
alert tcp $HOME_NET any -> 8.219.211.139 8888 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.219.211.139; sid:9105662; rev:4;)
alert tcp $HOME_NET any -> 154.92.5.25 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.92.5.25; sid:9105664; rev:4;)
alert tcp $HOME_NET any -> 206.206.76.110 2095 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.206.76.110; sid:9105667; rev:4;)
alert tcp $HOME_NET any -> 206.206.76.110 2086 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.206.76.110; sid:9105668; rev:4;)
alert tcp $HOME_NET any -> 154.92.5.25 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.92.5.25; sid:9105670; rev:4;)
alert tcp $HOME_NET any -> 102.129.165.177 8083 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/102.129.165.177; sid:9105686; rev:4;)
alert tcp $HOME_NET any -> 8.218.4.6 60001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.218.4.6; sid:9105854; rev:4;)
alert tcp $HOME_NET any -> 45.207.35.31 8087 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.207.35.31; sid:9105860; rev:4;)
alert tcp $HOME_NET any -> 206.188.196.221 8001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.188.196.221; sid:9105867; rev:4;)
alert tcp $HOME_NET any -> 194.213.18.117 8082 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/194.213.18.117; sid:9105868; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.41 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.41; sid:9105873; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.36 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.36; sid:9105875; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.59 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.59; sid:9105879; rev:4;)
alert tcp $HOME_NET any -> 154.92.5.25 8334 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.92.5.25; sid:9105884; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.34 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.34; sid:9105890; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.53 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.53; sid:9105892; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.52 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.52; sid:9105896; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.36 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.36; sid:9105898; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.46 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.46; sid:9105901; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.33 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.33; sid:9105902; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.40 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.40; sid:9105905; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.42 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.42; sid:9105906; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.49 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.49; sid:9105908; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.61 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.61; sid:9105911; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.45 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.45; sid:9105912; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.56 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.56; sid:9105913; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.54 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.54; sid:9105917; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.43 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.43; sid:9105920; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.35 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.35; sid:9105925; rev:4;)
alert tcp $HOME_NET any -> 149.104.28.204 61372 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.104.28.204; sid:9106083; rev:4;)
alert tcp $HOME_NET any -> 202.182.102.83 50299 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/202.182.102.83; sid:9106128; rev:4;)
alert tcp $HOME_NET any -> 45.192.103.138 18080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.192.103.138; sid:9106340; rev:4;)
alert tcp $HOME_NET any -> 208.167.245.124 18889 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/208.167.245.124; sid:9106392; rev:4;)
alert tcp $HOME_NET any -> 143.246.202.156 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/143.246.202.156; sid:9106409; rev:4;)
alert tcp $HOME_NET any -> 8.213.149.0 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.213.149.0; sid:9106614; rev:4;)
alert tcp $HOME_NET any -> 45.192.105.32 18084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.192.105.32; sid:9106794; rev:4;)
alert tcp $HOME_NET any -> 45.221.112.127 4443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.221.112.127; sid:9106835; rev:4;)
alert tcp $HOME_NET any -> 45.221.112.127 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.221.112.127; sid:9106836; rev:4;)
alert tcp $HOME_NET any -> 107.150.25.65 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.150.25.65; sid:9106921; rev:4;)
alert tcp $HOME_NET any -> 107.148.78.97 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.148.78.97; sid:9106922; rev:4;)
alert tcp $HOME_NET any -> 91.207.173.117 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/91.207.173.117; sid:9106992; rev:4;)
alert tcp $HOME_NET any -> 64.81.30.24 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/64.81.30.24; sid:9107080; rev:4;)
alert tcp $HOME_NET any -> 107.148.78.97 9000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.148.78.97; sid:9107122; rev:4;)
alert tcp $HOME_NET any -> 139.99.135.67 19999 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/139.99.135.67; sid:9107138; rev:4;)
alert tcp $HOME_NET any -> 198.46.159.243 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/198.46.159.243; sid:9107167; rev:4;)
alert tcp $HOME_NET any -> 38.76.191.100 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.76.191.100; sid:9107265; rev:4;)
alert tcp $HOME_NET any -> 217.60.76.178 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/217.60.76.178; sid:9107271; rev:4;)
alert tcp $HOME_NET any -> 176.97.117.157 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/176.97.117.157; sid:9107305; rev:4;)
alert tcp $HOME_NET any -> 89.125.244.117 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/89.125.244.117; sid:9107368; rev:4;)
alert tcp $HOME_NET any -> 151.243.137.78 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/151.243.137.78; sid:9107384; rev:4;)
alert tcp $HOME_NET any -> 205.186.112.213 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/205.186.112.213; sid:9107410; rev:4;)
alert tcp $HOME_NET any -> 170.62.130.154 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/170.62.130.154; sid:9107414; rev:4;)
alert tcp $HOME_NET any -> 104.233.217.124 9090 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.233.217.124; sid:9107564; rev:4;)
alert tcp $HOME_NET any -> 47.236.204.56 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.236.204.56; sid:9108750; rev:4;)
alert tcp $HOME_NET any -> 39.109.126.185 12307 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/39.109.126.185; sid:9108819; rev:4;)
alert tcp $HOME_NET any -> 139.180.216.149 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/139.180.216.149; sid:9108830; rev:4;)
alert tcp $HOME_NET any -> 107.148.78.97 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.148.78.97; sid:9108842; rev:4;)
alert tcp $HOME_NET any -> 154.92.5.37 8888 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.92.5.37; sid:9108927; rev:4;)
alert tcp $HOME_NET any -> 154.81.37.187 8092 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.81.37.187; sid:9108929; rev:4;)
alert tcp $HOME_NET any -> 128.241.231.135 18083 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/128.241.231.135; sid:9108955; rev:4;)
alert tcp $HOME_NET any -> 107.148.78.97 8899 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.148.78.97; sid:9108997; rev:4;)
alert tcp $HOME_NET any -> 104.233.217.124 10086 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.233.217.124; sid:9108999; rev:4;)
alert tcp $HOME_NET any -> 134.122.140.110 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/134.122.140.110; sid:9109021; rev:4;)
alert tcp $HOME_NET any -> 89.125.244.117 22 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/89.125.244.117; sid:9109028; rev:4;)
alert tcp $HOME_NET any -> 47.239.57.214 5566 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.239.57.214; sid:9109072; rev:4;)
alert tcp $HOME_NET any -> 45.77.42.89 23566 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.77.42.89; sid:9109079; rev:4;)
alert tcp $HOME_NET any -> 45.221.112.127 4419 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.221.112.127; sid:9109082; rev:4;)
alert tcp $HOME_NET any -> 45.136.14.91 110 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.136.14.91; sid:9109476; rev:4;)
alert tcp $HOME_NET any -> 178.16.53.91 2052 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/178.16.53.91; sid:9109480; rev:4;)
alert tcp $HOME_NET any -> 50.114.184.76 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/50.114.184.76; sid:9109499; rev:4;)