# publicmosaic.rules — generated 2026-10-30 19:07 UTC — 23 rules — TLP:CLEAR
# source: https://publicmosaic.com — published for defensive use
# scope: host 104.243.248.63 — https://publicmosaic.com/ip/104.243.248.63
# rev:4 — replace every earlier rule file from this site. Suricata refuses a duplicate sid, so never load an older one beside this one.
# covers listed listeners only; archived listings omitted: 0
# A withdrawal can take up to five minutes to reach this file. Each address's page under publicmosaic.com/ip/ is authoritative.
alert tcp $HOME_NET any -> 104.243.248.63 415 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9110356; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 413 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9110357; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 409 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9110358; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 405 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9110359; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 404 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9110360; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 305 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9110361; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 304 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9110362; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 303 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9110155; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 3602 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9109987; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 403 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9109801; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 402 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9109802; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 411 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9109742; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 406 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9109743; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 3601 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9108846; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 3603 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9108763; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 3606 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9108764; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 1001 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9107562; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 3604 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9107563; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 407 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9107227; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 3605 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9106973; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 400 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9106974; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 100 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9106976; rev:4;)
alert tcp $HOME_NET any -> 104.243.248.63 302 (msg:"Public Mosaic C2 AsyncRAT"; reference:url,publicmosaic.com/ip/104.243.248.63; sid:9106975; rev:4;)