# publicmosaic.rules — generated 2026-10-30 19:07 UTC — 13 rules — TLP:CLEAR
# source: https://publicmosaic.com — published for defensive use
# scope: host 102.220.163.36 — https://publicmosaic.com/ip/102.220.163.36
# rev:4 — replace every earlier rule file from this site. Suricata refuses a duplicate sid, so never load an older one beside this one.
# covers listed listeners only; archived listings omitted: 0
# A withdrawal can take up to five minutes to reach this file. Each address's page under publicmosaic.com/ip/ is authoritative.
alert tcp $HOME_NET any -> 102.220.163.36 56003 (msg:"Public Mosaic C2 PureRAT"; reference:url,publicmosaic.com/ip/102.220.163.36; sid:9111297; rev:4;)
alert tcp $HOME_NET any -> 102.220.163.36 2503 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/102.220.163.36; sid:9109010; rev:4;)
alert tcp $HOME_NET any -> 102.220.163.36 7007 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/102.220.163.36; sid:9108841; rev:4;)
alert tcp $HOME_NET any -> 102.220.163.36 7008 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/102.220.163.36; sid:9108845; rev:4;)
alert tcp $HOME_NET any -> 102.220.163.36 2505 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/102.220.163.36; sid:9108762; rev:4;)
alert tcp $HOME_NET any -> 102.220.163.36 7005 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/102.220.163.36; sid:9107663; rev:4;)
alert tcp $HOME_NET any -> 102.220.163.36 6606 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/102.220.163.36; sid:9107560; rev:4;)
alert tcp $HOME_NET any -> 102.220.163.36 7707 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/102.220.163.36; sid:9107124; rev:4;)
alert tcp $HOME_NET any -> 102.220.163.36 8808 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/102.220.163.36; sid:9107125; rev:4;)
alert tcp $HOME_NET any -> 102.220.163.36 7006 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/102.220.163.36; sid:9107126; rev:4;)
alert tcp $HOME_NET any -> 102.220.163.36 2502 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/102.220.163.36; sid:9107127; rev:4;)
alert tcp $HOME_NET any -> 102.220.163.36 2504 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/102.220.163.36; sid:9107128; rev:4;)
alert tcp $HOME_NET any -> 102.220.163.36 443 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/102.220.163.36; sid:9107129; rev:4;)