Ligolo-ng
11 hosts identified as exposed Ligolo-ng tunnel endpoints: 0 still listed, 11 archived. First seen 2026-08-25.
About
An open-source tunnelling and pivoting tool, published on GitHub by nicocha30 under the GPL for penetration testers: a reverse tunnel paired with a virtual (TUN) interface, so an operator can route into a network as though attached to it. An agent inside that network connects back to a relay (the software calls it the proxy), and the fingerprint identifies the relay, not a machine running an agent. Once a client connects over TLS, directly or through a websocket, the relay speaks first: it opens a session and asks the client to identify itself. These addresses were most often reached on 11601, the relay's default port, and on 443. What makes it useful on an authorised engagement makes it useful to somebody already inside. A reachable relay is therefore an exposed endpoint and not by itself evidence of a compromise — the relay is what was confirmed here, never who set it up.
Ports
Detection packs
Rules for this hub's 0 still-listed hosts, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.