Mythic C2 Detected – 172.94.9.194172[.]94[.]9[.]194:7443

Shodan identified a Mythic-branded web interface on 172[.]94[.]9[.]194:7443, with a login route at /new/login. This is consistent with a Mythic C2 portal, but the scan alone does not confirm that it is active or malicious.

Why this matters and what to do now

What : An internet-accessible Mythic-branded login interface may expose a C2 management service.

Why : If operational, unauthorised access or exposure of the panel could enable control of connected agents or disclose operational data. The scan does not establish that the interface is vulnerable or compromised.

Do now : Check whether the address and service are owned or authorised by your organisation.

Do now : If in scope and not required to be public, restrict access to the panel using network controls.

Do now : Preserve relevant firewall, authentication, and server logs before making changes.

Do now : Review access records and endpoint telemetry for unauthorised logins or related activity.

Do now : internal and external telemetry for the IP, login route, certificate fingerprint, JARM, and JA3S.

The Mythic page title, login route, and TLS certificate organisation are consistent with an exposed Mythic control interface. Mythic is a command-and-control framework, so this host warrants prompt investigation. The evidence identifies a web interface, not whether it is being used for operations or currently has connected agents. A legitimate test environment, research deployment, or decoy could present the same indicators. The TLS and HTTP fingerprints can support clustering with other observations, but do not independently prove common ownership or malicious activity. Confirm the system’s role and ownership before taking disruptive action.

Review proxy and firewall logs for connections to 172[.]94[.]9[.]194 on TCP/7443.

TLS inspection or network telemetry for the listed certificate fingerprint, JARM, and JA3S; treat matches as correlation leads, not definitive attribution.

Inspect DNS, HTTP, and authentication logs for the /new/login route and Mythic page title, including related internal hosts.

Restrict management interfaces to approved VPNs or trusted source addresses; remove public exposure where it is not required.

Require strong authentication and multi-factor authentication where supported, and rotate credentials if exposure is unauthorised.

Review connected agents and panel activity, and isolate affected systems if unauthorised use is found.

High, The scan directly shows a Mythic-branded page, login route, and matching TLS certificate organisation, but does not confirm active malicious use.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.