Live C2 Indicators
Command-and-control infrastructure on the open internet, convicted by Public Mosaic’s Hollowpoint Scanner. Every host here was identified from what the server itself returned — nothing on this page is a guess.
Live mosaic · one tile per convicted host
Shared fingerprints · reuse
Top hosting ASNs
Top ports
| Fingerprints | Copy | ||||||
|---|---|---|---|---|---|---|---|
| pure_rat | 45.139.104.26:443newapi.purecoder.io | AS399979 | 100 | 11h ago | 5m ago | ||
| pure_rat | 45.139.104.226:443api.purecoder.io | AS399979 | 100 | 9d ago | 5m ago | ||
| pure_rat | 45.139.104.204:443api.purecoder.io | AS399979 | 100 | 7d ago | 5m ago | ||
| pure_rat | 103.54.153.49:443api.purecoder.io | AS136557 | 100 | 13d ago | 6m ago | ||
| quasar_rat | 154.23.189.222:17788new | AS140227 | 100 | 3h ago | 3h ago | — | |
| cobalt_strike | 36.255.97.162:8033 | AS205759 | 100 | 10d ago | 4h ago | ||
| vshell | 45.221.112.127:4443new | AS967 | 100 | 4h ago | 4h ago | — | |
| vshell | 45.221.112.127:443new | AS967 | 100 | 4h ago | 4h ago | — | |
| vshell | 64.176.84.14:443 | AS20473 | 100 | 11d ago | 5h ago | — | |
| vshell | 45.77.240.46:39756 | AS20473 | 100 | 8d ago | 5h ago | — | |
| vshell | 112.124.44.139:8084 | AS37963 | 100 | 13d ago | 5h ago | — | |
| vshell | 38.54.40.184:443 | AS138915 | 100 | 13d ago | 5h ago | — | |
| pure_rat | 103.54.153.49:56003 | AS136557 | 100 | 13d ago | 5h ago | ||
| pure_rat | 103.54.153.49:56002 | AS136557 | 100 | 13d ago | 5h ago | ||
| pure_rat | 103.54.153.49:56001 | AS136557 | 100 | 13d ago | 5h ago | ||
| vshell | 103.115.108.111:8000 | AS152179 | 98 | 6d ago | 5h ago | — | |
| vshell | 103.115.108.111:80 | AS152179 | 98 | 10d ago | 5h ago | — | |
| mozi | 124.234.219.141:44247 | AS4134 | 100 | 4d ago | 5h ago | ||
| pure_rat | 104.143.46.142:56002 | AS140227 | 100 | 11d ago | 5h ago | ||
| pure_rat | 104.143.46.142:56001 | AS140227 | 100 | 11d ago | 5h ago | ||
| hajime | 139.255.97.116:6983 | AS9905 | 98 | 13d ago | 5h ago | ||
| ligolo | 43.212.255.197:2096 | AS16509 | 98 | 6d ago | 5h ago | — | |
| pure_rat | 217.60.195.89:443 | AS58232 | 100 | 20d ago | 5h ago | ||
| vshell | 182.92.62.124:51001 | AS37963 | 100 | 13d ago | 5h ago | — | |
| vshell | 45.76.146.82:8081 | AS20473 | 100 | 9d ago | 5h ago | — | |
| vshell | 45.76.146.82:443 | AS20473 | 100 | 9d ago | 5h ago | — | |
| vshell | 38.207.161.212:7410 | AS967 | 100 | 13d ago | 5h ago | — | |
| quasar_rat | 185.34.147.35:443 | AS7488 | 100 | 13d ago | 5h ago | ||
| quasar_rat | 185.34.147.34:443 | AS7488 | 100 | 13d ago | 5h ago | ||
| quasar_rat | 185.34.147.33:443 | AS7488 | 100 | 13d ago | 5h ago |
Conviction
A host reaches this feed only on a determinative match: it is malicious, sits on a routable address, and either its C2 framework was identified by value — certificate DN attributes, the JA4X X.509 template, a framework marker path, or a behavioral probe — or it served a malicious-category content signature. JARM and JA4S corroborate only. The lower-confidence candidate tier is never published.
Lifecycle
Hosts are rescanned about every 30 minutes and the feed re-exports about every 15. A record drops out 90 days after its last confirmed sighting — so a listing can outlast the controller behind it. Retiring a signature retracts the convictions it produced.
Published for defensive use. Believe a host is listed in error, or want it excluded? See abuse & takedown and opt-out.