{
  "name": "Port Forwarding Services",
  "observable_types": [
    "domain"
  ],
  "published": "2026-10-19T00:00:00",
  "modified": "2026-10-19T00:00:00",
  "authors": [
    "Erik Hjelmvik (Netresec)"
  ],
  "description": "Adversaries may use a port forwarding proxy/tunnel to direct network traffic between systems or act as an intermediary for payload delivery and network communications to a command and control server to avoid direct connections to their infrastructure.\n\nBlocking access to port forwarding services neutralizes multiple classes of malware command-and-control (C2).\n",
  "references": [
    "https://www.crowdstrike.com/en-us/blog/4-common-endpoint-tools-used-to-facilitate-covert-c2/",
    "https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats",
    "https://www.sophos.com/en-us/blog/rapid-response-the-ngrok-incident-guide"
  ],
  "techniques": [
    "T1090",
    "T1571",
    "T1608.001"
  ],
  "observables": [
    {
      "type": "domain",
      "value": "a.free.pinggy.link",
      "description": "Port forwarding service"
    },
    {
      "type": "domain",
      "value": "a.pinggy.click",
      "description": "Port forwarding service"
    },
    {
      "type": "domain",
      "value": "argotunnel.co",
      "description": "Port forwarding service"
    },
    {
      "type": "domain",
      "value": "devtunnels.ms",
      "description": "Port forwarding service"
    },
    {
      "type": "domain",
      "value": "localtunnel.me",
      "description": "Port forwarding service"
    },
    {
      "type": "domain",
      "value": "localxpose.io",
      "description": "Port forwarding service"
    },
    {
      "type": "domain",
      "value": "ngrok.app",
      "description": "Port forwarding service"
    },
    {
      "type": "domain",
      "value": "ngrok.dev",
      "description": "Port forwarding service"
    },
    {
      "type": "domain",
      "value": "ngrok.com",
      "description": "Port forwarding service"
    },
    {
      "type": "domain",
      "value": "ngrok.io",
      "description": "Port forwarding service"
    },
    {
      "type": "domain",
      "value": "ngrok-free.app",
      "description": "Port forwarding service"
    },
    {
      "type": "domain",
      "value": "ngrok-free.dev",
      "description": "Port forwarding service"
    },
    {
      "type": "domain",
      "value": "pagekite.me",
      "description": "Port forwarding service"
    },
    {
      "type": "domain",
      "value": "ply.gg",
      "description": "Port forwarding service"
    },
    {
      "type": "domain",
      "value": "portmap.host",
      "description": "Port forwarding service"
    },
    {
      "type": "domain",
      "value": "portmap.io",
      "description": "Port forwarding service"
    },
    {
      "type": "domain",
      "value": "serveo.net",
      "description": "Port forwarding service"
    },
    {
      "type": "domain",
      "value": "trycloudflare.com",
      "description": "Port forwarding service"
    },
    {
      "type": "domain",
      "value": "tunnel4.com",
      "description": "Port forwarding service"
    },
    {
      "type": "domain",
      "value": "tunnels.api.visualstudio.com",
      "description": "Port forwarding service"
    }
  ]
}