huntback / IP intelligence

139.28.220.253

DATACENTERoperator-submittedc2exploitexposed-secrethavocmalware

Intelligence

ASN / OrgAS207569 · IHOR HOSTING LTD
CountryFinland
NetworkDATACENTER · risk 60/100
Threat score0/100
Open ports22, 443, 2096, 8443
Productsnginx
Loot harvested36 file(s), 24456 KB · c2, exploit, exposed-secret, havoc, malware, mozi

Open directory contents (36)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
‹redacted›.ALLALL5.0 MB
ls-lR.gzGZ5.0 MB
GUTINDEX.zipZIP2.7 MB
‹redacted›.filterFILTER2.6 MB
‹redacted›.AUSAUS760 KB
GUTINDEX.20102010474 KB
‹redacted›.ps.gzGZ472 KB
GUTINDEX.20042004437 KB
GUTINDEX.20072007427 KB
GUTINDEX.20082008409 KB
GUTINDEX.20122012402 KB
GUTINDEX.20152015386 KB
GUTINDEX.20162016381 KB
GUTINDEX.20202020381 KB
GUTINDEX.20132013354 KB
GUTINDEX.20052005337 KB
GUTINDEX.20212021337 KB
GUTINDEX.20032003333 KB
GUTINDEX.20062006327 KB
GUTINDEX.20232023327 KB
GUTINDEX.20252025320 KB
GUTINDEX.20222022316 KB
GUTINDEX.20192019296 KB
GUTINDEX.20182018290 KB
GUTINDEX.20242024283 KB
GUTINDEX.20262026272 KB
GUTINDEX.20022002218 KB
GUTINDEX.1996199673 KB
GUTINDEX.1998199870 KB
GUTINDEX.1999199955 KB
ProgramIndexTXT28 KB
PublicKey_2010TXT14 KB
README.htmlHTML10 KB
PublicKeyTXT6 KB
ls-lR.gzGZ1 KB
mirror-ubuntu.shSH524 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

91.236.251.14confirmed
91.236.251.34confirmed
91.236.251.35confirmed
91.236.251.38confirmed
1.14.93.149lead
1.15.114.102lead
101.32.108.79lead
101.36.118.185lead
101.47.134.222lead
101.47.15.229lead
102.203.200.45lead
102.68.86.43lead
103.111.114.29lead
103.113.104.49lead
103.116.52.164lead