Public Mosaic C2 indicators
INTERNET SCANNER

Live C2 Indicators

Command-and-control servers and related infrastructure, identified by Public Mosaic’s scanner from what each host returned.

live 9,440 indicators updated 2026-10-30 17:07 UTC TLP:CLEAR

One tile per listed indicator, coloured by family

    STIX CSV RSS JSON

    API keys

    JSON lookups against the archive: GET /api/v1/ip/{ip}, /cert/{sha256}, /ja4x/{fp}, /asn/{n}, /sample/{sha256}, /family/{slug}. Send the key as Authorization: Bearer pm_…. Free: 100 requests a day per account, up to 5 keys. The indicators are the same as on the public pages.

      Family Indicator ASN Confidence First seen Last confirmed Fingerprints
      daybreak 149.104.26.229:11234 AS139659 100 33d ago 2h ago cert fb1a87ef5bc3…ja4x 7022c563de38… ×22
      pure_rat 45.225.135.133:56003 AS64107 100 4d ago 2h ago —
      pure_rat 45.225.135.227:56003 AS64107 100 5d ago 2h ago —
      sliver 47.116.113.15:31337 AS37963 100 59d ago 2h ago cert 9d8f783ce026…ja4x 7022c563de38… ×641
      cobalt_strike 36.93.147.195:8443 AS7713 100 56d ago 2h ago watermark 666666666 ×118
      vshell 8.156.39.163:1401 AS37963 100 33d ago 2h ago —
      dcrat 104.250.167.93:8080 AS9009 100 22d ago 2h ago —
      dcrat 104.250.167.93:2704 AS9009 100 22d ago 2h ago —
      dcrat 191.93.113.119:1000 AS13489 100 22d ago 2h ago —
      cobalt_strike 38.76.219.253:50051 AS401701 100 4d ago 2h ago cert 512deb9d4c0c…ja4x 2166164053c1… ×494
      pure_rat 217.60.195.157:1111 AS209373 100 2d ago 2h ago —
      pure_rat 217.60.195.157:443api.purecoder.io AS209373 100 20d ago 2h ago cert fd49bfac08d0…ja4x 0b479b1b5763… ×167payload 21dc02e86864…
      asyncrat 104.250.161.126:2061 AS9009 98 58d ago 2h ago —
      pure_rat 104.219.236.166:56003 AS27176 100 7d ago 2h ago —
      pure_rat 104.219.236.166:56002 AS27176 100 7d ago 2h ago —
      pure_rat 104.219.236.166:56001 AS27176 100 7d ago 2h ago —
      dcrat 45.192.105.44:8080 AS401701 100 58d ago 2h ago —
      pure_rat 70.36.127.51:443api.purecoder.io AS22439 100 3d ago 2h ago cert e8e5a4f101a5… ×4ja4x 0b479b1b5763… ×167payload 7201ceed3e8f…
      pure_rat 91.92.41.92:443api.purecoder.io AS211443 100 27d ago 2h ago cert 7faa24a7dc30…ja4x 0b479b1b5763… ×167payload 5423ea784285…
      pure_rat 85.17.92.21:443api.purecoder.io AS60781 100 30d ago 2h ago cert c84545459128…ja4x 0b479b1b5763… ×167payload 22112b5cd5c6…
      pure_rat 70.36.127.16:443api.purecoder.io AS22439 100 8d ago 2h ago cert e8e5a4f101a5… ×4ja4x 0b479b1b5763… ×167payload c6cda4aabcb4…
      pure_rat 66.235.174.79:443api.purecoder.io AS397423 100 5d ago 2h ago cert 18563f2fc6b5…ja4x 0b479b1b5763… ×167payload 8d35fe1ac0e9…
      pure_rat 64.224.17.22:443api.purecoder.io AS399486 100 6d ago 2h ago cert ea515f7710b8…ja4x 0b479b1b5763… ×167payload 3879240773c1…
      pure_rat 52.197.194.156:443api.purecoder.io AS16509 100 30d ago 2h ago cert 80c40c2ff446…ja4x 0b479b1b5763… ×167payload 4880aa622736…
      pure_rat 46.151.182.67:443api.purecoder.io AS403005 100 38d ago 2h ago cert bbf183f5bdf7…ja4x 0b479b1b5763… ×167payload 4d6c7ec55697…
      pure_rat 45.88.91.165:7590 AS399486 100 38d ago 2h ago —
      pure_rat 45.88.91.165:443api.purecoder.io AS399486 100 38d ago 2h ago cert 2b92afc94cef…ja4x 0b479b1b5763… ×167payload fd86b9d9e522…
      pure_rat 45.139.104.29:443api.purecoder.io AS399979 100 40d ago 2h ago cert 62d7ed498bff…ja4x 0b479b1b5763… ×167payload 33e683746ce7…
      pure_rat 45.139.104.232:443api.purecoder.io AS399979 100 28d ago 2h ago cert 88cc82200427… ×3ja4x 0b479b1b5763… ×167payload 0864f87699ae…
      pure_rat 45.139.104.199:443api.purecoder.io AS399979 100 28d ago 2h ago cert 269bc90b83c8… ×3ja4x 0b479b1b5763… ×167payload fd55a162a366…

      How a host is listed

      Listed only on a determinative match: evidence that identifies the host’s software by value. Full criteria in methodology.

      Lifecycle

      Listed hosts are rescanned about every 30 minutes. A listing stays in the feed for 90 days after its last confirmation, so it can outlast the server behind it. Withdrawn detections are counted on corrections.

      Published for defensive use. Method: methodology · Withdrawn detections: corrections · Listed in error: abuse & takedown · Exclude a range: opt-out