Chisel
11 hosts identified as exposed Chisel tunnel endpoints: 1 still listed, 10 archived. First seen 2026-08-30.
About
Chisel is Jaime Pillora's open-source tunnelling tool, on GitHub since 2015 under the MIT licence. It is a single Go program that carries TCP and UDP over HTTP, secured with SSH. Its README presents it as a way through firewalls and a secure endpoint into one's own network, and joint CISA and FBI advisories name it among the tunnelling tools ransomware groups have used. Since late 2018 a Chisel server, the end its clients connect to, has named itself in its reply to a client's opening handshake. That server is also a Go library that other programs build in, so the string shows that code built on Chisel was listening, not which program it belonged to. A listing records an exposed listener, not what passed through it or who set it up: a legitimate deployment emits the same fingerprint, so this page claims nothing about the traffic or the operator's intent.
Ports
Observed changes
Relabelled: 1 host earlier labelled Sliver. Only the most recent earlier label is kept.
Detection packs
Rules for this hub's 1 still-listed host, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.