Mythic C2 Detected – 143.244.135.17143[.]244[.]135[.]17:7443

Shodan observed a Mythic-branded web interface at 143[.]244[.]135[.]17:7443, redirecting to /new/login. The host uses nginx and a TLS certificate whose issuer and subject identify Mythic.

Why this matters and what to do now

What : An externally reachable Mythic-branded interface may expose a sensitive control panel.

Why : Unauthorised access or compromise of a C2 management interface could enable control of connected agents or reveal operational data. The scan does not show whether authentication is enforced or whether agents are connected.

Do now : Check whether the IP and service are authorised and known to your organisation.

Do now : If it is in your environment and is not approved for public access, restrict inbound access to the required trusted sources.

Do now : Review authentication, access, and endpoint logs for unexpected activity.

Do now : network and endpoint telemetry for connections to 143[.]244[.]135[.]17, especially on port 7443.

Do now : Correlate the certificate fingerprint and TLS fingerprints with other observed infrastructure.

The Mythic title, Mythic TLS certificate identity, and login redirect are consistent with an exposed Mythic web interface. Mythic is used for command-and-control, but these observations alone do not establish that this host is actively controlling compromised systems or identify its operator. The service may be an authorised deployment, a test system, a honeypot, or other infrastructure presenting a Mythic interface. The DigitalOcean hosting and observed TLS fingerprints can support infrastructure correlation, but do not independently establish malicious activity.

DNS, proxy, firewall, and endpoint telemetry for connections to 143[.]244[.]135[.]17, including destination port 7443.

Review HTTP and TLS inspection logs for requests to /new/login or connections presenting the listed certificate fingerprint.

Hunt for outbound connections to other hosts sharing the JARM or JA3S values; treat matches as leads, not attribution.

If the host is managed by your organisation, restrict the interface to a VPN or allowlisted administrative network.

Ensure strong authentication and multifactor authentication are enabled, and update the service and host components.

If the host is unauthorised or compromised, preserve relevant logs, isolate it where appropriate, and investigate related systems and credentials.

High, The observed page title, login redirect, and TLS certificate consistently identify a Mythic-branded interface, but do not prove malicious use.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.