Supershell
115 hosts convicted as Supershell command-and-control servers: 115 still listed, 0 archived. First seen 2026-08-28.
About
Supershell is an open-source, MIT-licensed C2 platform published in 2023 by the developer tdragon6 and run from a Chinese-language web console. Its clients call back over reverse SSH tunnels for interactive shells, file management and port forwarding on Windows, Linux, macOS, Android and more. The tunnel side is NHAS's reverse_ssh server, which Supershell's own deployment runs on port 3232 with the certificate the reverse_ssh hub identifies, so addresses here often appear there: one machine, two listeners. The fingerprint identifies only the console, never a machine running a client. The console's default port is 8888, where most of these addresses answered. Its author says it is for authorised testing only; in 2024 AhnLab reported its client installed as a backdoor on poorly managed Linux SSH servers. An authorised test and an intrusion can stand the console up identically, so a listing says nothing about who runs it or whether its use was authorised.
Ports
The 8 ports with the most hosts, of 31.
Observed changes
Relabelled: 57 hosts earlier labelled reverse_ssh. Only the most recent earlier label is kept.
New networks for this family in this archive, last 7 days: AS140227 on 2026-10-25 (1 host); AS61112 on 2026-10-24 (1 host).
Detection packs
Rules for this hub's 115 still-listed hosts, across all 2 pages of the list, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts · page 1 of 2
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.