Mythic C2 Detected – 142.93.126.132142[.]93[.]126[.]132:7443

Shodan observed a web interface titled “Mythic” on 142[.]93[.]126[.]132:7443. The site redirects to /new/login and presents a TLS certificate with “Mythic” as both subject and issuer.

Why this matters and what to do now

What : A likely Mythic management interface is exposed on a public IP address and port.

Why : If unauthorised users can reach or access the panel, they may gain visibility into or control over C2 operations. The scan does not show whether authentication is bypassable or whether the service is in use.

Do now : Check whether the IP and port are owned or authorised by your organisation.

Do now : If unauthorised, restrict public access to port 7443 and preserve relevant network and host logs.

Do now : Review authentication, access, and process logs for unexpected connections or activity.

Do now : firewall, proxy, DNS, and endpoint telemetry for connections to 142[.]93[.]126[.]132:7443 and the listed TLS fingerprints.

Do now : If the service is authorised, verify access controls, patch status, and certificate configuration.

The title, login route, and certificate identity are consistent with an exposed Mythic web interface. Mythic is a command-and-control framework, so this host may be operating its management portal. The scan does not establish whether it is actively used for malicious activity or who operates it. The login route indicates an administrative access surface is reachable from the internet. DigitalOcean hosting and the observed TLS fingerprints can support correlation, but do not independently establish attribution or intent. The self-issued certificate is consistent with a privately configured service and is not proof of compromise.

DNS, proxy, firewall, and EDR telemetry for outbound connections to 142[.]93[.]126[.]132 on port 7443.

Review TLS inspection or network flow records for the listed JARM and JA3S values, and validate matches against current observations.

Hunt web and proxy logs for requests to /new/login and responses containing the title “Mythic”.

Block or restrict access to the IP and port where they are not authorised.

Require VPN or allow-listed source access for any legitimate management panel.

Review account security and audit logs; rotate credentials if exposure or unauthorised access is suspected.

Retain relevant logs and investigate associated hosts before removing evidence.

Moderate, Multiple service indicators identify a Mythic interface, but the scan alone cannot confirm operator intent or active malicious use.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.