reverse_ssh
48 hosts convicted as reverse_ssh command-and-control servers: 0 still listed, 48 archived. First seen 2026-08-28.
About
reverse_ssh is an open-source Go tool, published on GitHub by the developer NHAS, that turns SSH into a command-and-control channel: implants connect back to its server, optionally over TLS, HTTP or websockets, giving the operator shells, file transfer and port forwarding with ordinary SSH commands. Supershell is built on it, so many addresses here also appear on Supershell's hub: one address, two listeners. The tool has no default port; most of this hub was reached on 3232, which nearly every example in its documentation uses and Supershell defaults to. With TLS on, as in the official image and Supershell, the server generates a self-signed certificate unless given one, its organisation hard-coded as "Cloudflare, Inc". A listing identifies the server, or the server's port relayed through a machine running its implant; neither a listing nor the Cloudflare name says who runs the host or whether its use was authorised.
Ports
Detection packs
Rules for this hub's 0 still-listed hosts, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.