Sliver
895 hosts convicted as Sliver command-and-control servers: 722 still listed, 173 archived. First seen 2026-08-22.
About
Sliver is an open-source adversary-emulation framework written in Go, published by the security firm Bishop Fox since 2019 for red teams and penetration testers; its implants call back over mutual TLS, WireGuard, HTTP(S) or DNS. Microsoft reported in 2022 that state-backed and ransomware-linked groups were using it in intrusions, with or in place of Cobalt Strike. Operators connect to a Sliver server through its multiplayer listener, on TCP 31337 by default, the commonest port on this hub. That listener's certificate is named "multiplayer" and issued by the server's own authority, "operators": two names Sliver does not randomise. Its mTLS and HTTPS implant listeners by default present certificates whose issuer has no name. These listeners all run on the server, never on a machine an implant runs on. A red team and an intruder stand that server up identically, so a listing cannot say who runs it or whether its use was authorised.
Ports
The 8 ports with the most hosts, of 105.
Observed changes
Relabelled: 12 hosts earlier labelled Sliver or Havoc; 1 host earlier labelled VShell; 1 host earlier labelled PoshC2; 1 host earlier labelled Havoc. Only the most recent earlier label is kept.
New networks for this family in this archive, last 7 days: AS133731 on 2026-10-29 (1 host); AS154321 on 2026-10-27 (1 host); AS62240 on 2026-10-26 (1 host); AS214961 on 2026-10-26 (1 host); AS174 on 2026-10-26 (1 host); AS47764 on 2026-10-26 (1 host). Showing the 6 newest of at least 12.
Detection packs
Rules for this hub's 722 still-listed hosts, across all 9 pages of the list, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts · page 3 of 9
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.