Ligolo-ng
97 addresses running exposed Ligolo-ng tunnel endpoints — 97 still listed, 0 archived. Observed from 2026-08-25.
Detection packs
Rules for the 97 still-listed addresses on this page, regenerated as the archive updates; archived episodes are omitted, and a rule can lag a withdrawal by up to five minutes. Suricata rules are rev:2 — alert tcp on address and port, alert tls where a full certificate fingerprint is published — and carry the archive's own episode ids as sids, so packs load beside each other and beside any per-host file. YARA packs are hash matches only: this site holds no file bytes.
About
An open-source tunnelling and pivoting tool: a reverse tunnel paired with a userland network interface, so an operator can route into a network as though attached to it. It is published for penetration testers, and the same property that makes it useful on an authorised engagement makes it useful to somebody already inside. A reachable relay is therefore an EXPOSED endpoint and not by itself evidence of a compromise — the listener is what was confirmed here, never who set it up. Most of these hosts answer on 11601, its default relay port. Recently first observed in AS213790 on 2026-09-10 (1 host); AS59711 on 2026-09-10 (1 host); AS28573 on 2026-09-08 (1 host) — networks this family had not appeared in before, as seen by this archive. Upstream population estimate: hosts of this family observed moving toward AS8075 on 2026-09-02 (fewer than 10 hosts); toward AS152615 on 2026-09-02 (fewer than 10 hosts) — the upstream scanner's estimate from a passive search population, not this archive's observation, and shown only for networks where this archive holds at least one host of this family.
Ports
Addresses
Ordered by when this archive first recorded them, newest first — a stable ordering, so a page holds the same addresses tomorrow. Archived addresses are included and marked; they are the majority of this corpus over time.
Listed in error?
These pages are generated from automated scanning and are publicly available. Write to support@publicmosaic.com — see abuse & takedown, or opt-out to exclude a network range from scanning.