Mythic C2 Detected – 142.93.52.11142[.]93[.]52[.]11:7443

A Mythic command-and-control web interface was identified at 142[.]93[.]52[.]11:7443. The service is served through nginx and redirects unauthenticated HTTP requests to /new/login.

Why this matters and what to do now

What : An internet-accessible Mythic C2 management interface is exposed.

Why : Compromise could provide control over agents, tasking and collected data. Public exposure also enables fingerprinting, password attacks and infrastructure tracking.

Do now : Confirm whether 142[.]93[.]52[.]11:7443 is authorised and identify the system owner.

Do now : Restrict port 7443 to approved administration networks or place it behind a VPN and firewall allow-list.

Do now : Preserve access logs, authentication events and host telemetry before making changes.

Do now : Rotate Mythic administrator credentials and review accounts, sessions, agents and task history.

Do now : enterprise telemetry for connections to 142[.]93[.]52[.]11 over TCP/7443 and investigate associated hosts.

The evidence strongly indicates an exposed Mythic C2 management interface. The title, product fingerprint, React asset paths, /new/login route and self-identifying TLS certificate are mutually consistent. The login redirect suggests that administrative access is gated, but it does not reduce the risk of exposing the management service. The infrastructure is hosted on DigitalOcean and uses a direct public IPv4 address with a non-standard HTTPS port. This may represent an operator-controlled C2 server, a test deployment or a legitimately operated security laboratory. Shodan data alone cannot establish ownership, active compromise or current operator activity.

Alert on outbound or inbound connections to 142[.]93[.]52[.]11:7443.

Hunt HTTP Host and TLS SNI values associated with 142[.]93[.]52[.]11, /new/login and Mythic.

proxy, DNS and endpoint logs for repeated connections to public infrastructure on TCP/7443.

Cluster TLS observations using the supplied JARM, JA3S and certificate SHA-256 values.

Remove direct internet exposure of the Mythic management interface.

Allow administration only through a VPN, bastion host or tightly scoped firewall rules.

Enforce strong unique administrator credentials and multi-factor authentication where supported.

Update Mythic, nginx and the underlying host, then review configuration and enabled services.

Monitor and alert on new agents, unexpected tasking and unusual administrator activity.

High, The Mythic page title, product fingerprint, login route and Mythic-labelled TLS certificate provide consistent direct evidence.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.