Mythic C2 Detected – 39.105.125.23539[.]105[.]125[.]235:7443

Shodan found an nginx service on 39[.]105[.]125[.]235:7443 that redirects to /new/login and returns a 403 IP-block page. Its TLS certificate names Mythic as both subject and issuer, which is consistent with a Mythic C2 service but does not confirm its role.

Why this matters and what to do now

What : If this is an active C2 panel, exposure could enable unauthorised access to operator functions or provide adversaries with a control point.

Why : A login route and Mythic-named certificate are meaningful leads, but the 403 response and service fingerprints do not establish that the host is malicious or accessible to others.

Do now : Check firewall, proxy, DNS, and endpoint logs for connections to 39[.]105[.]125[.]235, especially on port 7443.

Do now : Compare the certificate fingerprint, JARM, and JA3S with known sightings and internal threat intelligence.

Do now : If unauthorised activity is suspected, preserve relevant logs and restrict access to the host while investigating.

Do now : Recheck the service from an authorised monitoring point and record any changes in response, certificate, or redirect.

Do now : Determine whether the IP or service is expected in the organisation’s network and escalate confirmed matches through incident response.

The Mythic-named TLS certificate and /new/login redirect are consistent with a Mythic-related web interface, potentially a C2 operator panel. The 403 response indicates access restriction for the observed request, not whether the service is operational or what access controls are in place. Attribution is not conclusive from this scan alone. The certificate could be reused or presented by a test, decoy, or unrelated service. Correlate the TLS fingerprints, certificate fingerprint, and IP with other sightings and internal telemetry before treating it as confirmed C2 infrastructure.

network and proxy logs for outbound or inbound connections to 39[.]105[.]125[.]235:7443.

Hunt TLS telemetry for the reported certificate SHA-256 fingerprint, JARM, and JA3S values.

Review HTTP logs for requests redirected to /new/login or responses titled Error 403 – IP Address Blocked.

Restrict access to the service by network policy if it is not authorised or required.

Block the IP only where operationally appropriate and after checking for legitimate dependencies.

Preserve DNS, firewall, proxy, and endpoint records before making changes if incident activity is suspected.

Moderate, The Mythic-named certificate and login redirect suggest a Mythic-related interface, but the scan alone does not confirm an active C2 deployment.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.