Public Mosaic C2 indicators
confirmed host

49.7.54.75

Quasarremote-access trojan controller · :9443

First seen 2026-09-21, last confirmed 2026-09-23. No longer listed. On AS23724.

archived last confirmed feed checked TLP:CLEAR

Relations

Network context

SharedValueOther hosts
/2449.7.54.0/243 other hosts · 3 listed
NetworkAS23724 · IDC, China Telecommunications13 other hosts · 13 listed

Hosts near this one, for context only.

Summary

First seen by the scanner2026-09-21
In this archive since2026-09-21
Look up elsewhereVirusTotal · Shodan · Censys
About this listingWhat a listing means · Is this your address?

Observation history

Listed on all 3 days from its first sighting by the scanner on 2026-09-21 to its last confirmation on 2026-09-23 UTC.

  1. listed
  2. :9443

2026-08-292026-09-23

  • first seen to last confirmed

A marked day is a UTC day the feed listed this address. The feed keeps a listener for up to 90 days after its last confirmation, so a listed day is not a confirmation. A listener no longer in the feed is drawn to its last confirmation.

Listed days as dates
  • 2026-09-21 – 2026-09-23 (3 days)

49.7.54.75:9443 · Quasar

no longer listed Last confirmed

first seen2026-09-21 21:26 UTC
serviceip-port · tcp
networkAS23724 · IDC, China Telecommunications
confidence100 / 100

Neighbourhood · 49.7.54.0/24 · 3 other hosts

3 other hosts in this archive are in the same /24, shown for context.

49.7.54.73Sliver49.7.54.77Sliver49.7.54.246VShell

Deploy

No listener here is listed, so there are no rules. The queries below search past traffic: run them once, not as a standing alert.

Each query searches the last 30 days of your logs for connections to these listeners. Queries hold only addresses, ports and file hashes.

Microsoft Defender XDR (KQL)
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where (RemoteIP == "49.7.54.75" and RemotePort in (9443))
Microsoft Sentinel (KQL)
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where (DestinationIP == "49.7.54.75" and DestinationPort in (9443))
Splunk (SPL, CIM data models)
| tstats summariesonly=false count min(_time) as first_time max(_time) as last_time
    from datamodel=Network_Traffic where earliest=-30d
    ((All_Traffic.dest_ip="49.7.54.75" (All_Traffic.dest_port=9443)))
    by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port
Elastic (EQL)
network where
  (destination.ip == "49.7.54.75" and destination.port in (9443))

Cite this record

Plain text, for a ticket or a report
Address 49.7.54.75 Family Quasar (remote-access trojan controller) Ports :9443 Status archived (feed checked 2026-10-30 18:37 UTC) First seen 2026-09-21 Last confirmed 2026-09-23 Record https://publicmosaic.com/ip/49.7.54.75 Source Public Mosaic, TLP:CLEAR