public mosaic llc support@publicmosaic.com
confirmed host

IP address 13.231.27.0

Brute Ratelcommand-and-control server · :80

Observed 2026-08-28 to 2026-08-31 and no longer listed. On AS16509. This is an archived record, kept because an address that was listed stays answerable for having been listed.

archived last confirmed feed checked TLP:CLEAR SURICATA .RULES SEE THE LIVE FEED →

13.231.27.0:80 · Brute Ratel

no longer listed Last confirmed

first seen2026-08-28 09:05 UTC
serviceip-port · tcp
networkAS16509 · Amazon.com
confidence100 / 100

Observation history

18d agotoday

Observed on 2 of the 18 days since this archive began recording, 2026-08-29 UTC. Presence is per UTC day: a day is marked when the scanner confirmed this address at least once, not once per scan.

Neighbourhood · 13.231.27.0/24 · 1 host

1 other confirmed host in the same /24. Adjacent addresses under one operator are a different signal from a shared certificate — they suggest a block, not a build.

Pivots & lookups