Gshell
3 hosts convicted as Gshell command-and-control servers: 3 still listed, 0 archived. First seen 2026-09-04.
About
A command-and-control framework known only from its servers' certificates, which name it. Hunt.io reported the first two in July 2026 inside a cluster of TencShell infrastructure and assessed — with moderate confidence, and without recovering an implant — that Gshell is a second framework run in tandem by the same operators, whom it describes as suspected China-linked. Nothing about its implants or protocol is public. A listed address presented that certificate; nothing on this page attributes the host to anyone.
Ports
Detection packs
Rules for this hub's 3 still-listed hosts, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.