The certificate names above are what the certificate ASSERTS, not proof this host owns them — a self-signed certificate can claim any subject, so treat a familiar name here as an impersonation attempt rather than an identity.
The certificate names above are what the certificate ASSERTS, not proof this host owns them — a self-signed certificate can claim any subject, so treat a familiar name here as an impersonation attempt rather than an identity.
The certificate names above are what the certificate ASSERTS, not proof this host owns them — a self-signed certificate can claim any subject, so treat a familiar name here as an impersonation attempt rather than an identity.
callback127.0.0.1 · operator-supplied; a redirector or impersonation target, not an attribution
beacon typeHTTPS
cs versionUnknown
getGET /iot/telemetry/ping
postPOST /iot/telemetry/event-submit
user-agentMozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
sleep45s ±37%
watermark1234567890
server key md516390b7b750f32ef7a33ba0a847fe293
inject stubecc996c40e5ea9a2ff8f08a1e6c01391
spawn to x86%windir%\syswow64\dllhost.exe
spawn to x64%windir%\sysnative\dllhost.exe
Observation history
18d agotoday
Observed on 5 of the 18 days since this archive began recording, 2026-08-29 UTC. Presence is per UTC day: a day is marked when the scanner confirmed this address at least once, not once per scan.
Shared JA4X issuance template · 270 hosts
These hosts issued certificates from the same template — the same distinguished-name
fields hashed in the same order. It links tooling, not necessarily an operator. Full cohort →
A watermark identifies the Cobalt Strike licence a beacon was generated from. Hosts sharing
one were built from the same copy of the software — which is not the same as one operator,
since cracked and leaked builds circulate widely and share a watermark by definition.
This page is generated from automated scanning and is publicly available. If you
are responsible for this address and it should not be listed, write to
support@publicmosaic.com —
see abuse & takedown for what we need and what happens next, or
opt-out to exclude a whole range from scanning.
Addresses are frequently compromised third-party hosts rather than
infrastructure their owner stood up. A listing records what a scan observed at a point in
time; it is not an allegation about whoever pays for the address.