VShell
2,046 hosts convicted as VShell command-and-control servers: 2,046 still listed, 0 archived. First seen 2026-08-24.
About
VShell is a Go remote-access framework, a RAT in its own README's words, whose server builds implants for Windows, Linux and macOS and drives them from a browser console. The GitHub user "veo" published it from 2021 as compiled builds; from late 2023 they required a licence, public releases ended in March 2024, and cracked later versions have circulated since. NVISO found Chinese-speaking actors its most prolific users, but not its only ones. What the scan matched at each address is a listener, the port its implants connect to, not the console. Since version 4.2 those listeners have imitated nginx's stock welcome page, so they are identified by how they behave rather than by what they display. Because it also serves the implant that script fetches, many of these addresses carry the malware distribution host label. Port 8084, the default for several of its listener types, is among the commonest here. A listing says nothing about who runs it, or why.
Ports
The 8 ports with the most hosts, of 565.
Observed changes
Relabelled: 2 hosts earlier labelled Cobalt Strike. Only the most recent earlier label is kept.
New networks for this family in this archive, last 7 days: AS58466 on 2026-10-27 (1 host).
Detection packs
Rules for this hub's 2,046 still-listed hosts, across all 21 pages of the list, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Files
9,222 files for this family, with hashes and serving hosts →
Hosts · page 17 of 21
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.