Live findsCVE IntelConsoleStart free
huntback / IP intelligence

202.162.109.6

DATACENTERloot-ipexploitexposed-secretgafgytmalwaremozi

Intelligence

ASN / OrgAS152194 · CTG Server Limited
CountryAustralia
NetworkDATACENTER · risk 60/100
Threat score0/100
Open ports22, 80, 443, 3000, 3306, 8000, 8001, 8088, 8091, 8095, 8096, 9000, 9443, 9999, 18080, 444
ServiceSimpleHTTP/0.6 Python/3.10.12
JARM2ad2ad0002ad2ad00042d42d000000ad9bf51cc3f5a1e29eecb81d0c7b06eb
Loot harvested91 file(s), 24077 KB · exploit, exposed-secret, gafgyt, macho-binary, malware, mozi

Open directory contents (91)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
svcupd.exePE9.4 MB
http_r9.logLOG2.7 MB
access.logLOG1.9 MB
mitm_r9.logLOG1.4 MB
out.logLOG1.4 MB
msupd_c03.b64B64976 KB
msupd_c06.b64B64976 KB
msupd_c09.b64B64976 KB
msupd_c10.b64B64976 KB
msupd_c13.b64B64976 KB
http8322.logLOG879 KB
msupd_c14.b64B64715 KB
shell18081.logLOG178 KB
httpd.logLOG66 KB
nc-8392.logLOG42 KB
cb.logLOG39 KB
jrmp-listener.logLOG12 KB
‹redacted›.javaJAVA9 KB
vps-watch.logLOG5 KB
mitm2.pyPY4 KB
mitm_vps.logLOG4 KB
h1_shell2.binBIN3 KB
h1_shell.binBIN3 KB
jeecms-attack.pyPY3 KB
jeecms-probe3.pyPY3 KB
cb1_perl85.binBIN2 KB
jeecms-sqli-diff2.pyPY2 KB
jeecms-sqli-diff.pyPY2 KB
jeecms-probe4.pyPY2 KB
jrmp-8394.logLOG2 KB
jrmp-8390.logLOG1 KB
jrmp-8393.logLOG1 KB
jrmp-8391.logLOG1 KB
jrmp-8385.logLOG1 KB
payload-cc6-win8323.binBIN1 KB
payload-cc6-win443.binBIN1 KB
‹redacted›.classMACHO1 KB
payload-cc6-lin8323.binBIN1 KB
payload-cc6-lin443.binBIN1 KB
vps-jrmp5.shSH1 KB
vps-jrmp2.shSH1004 B
vps-jrmp.shSH984 B
vps-jrmp4.shSH975 B
jeecms-attack.logLOG948 B
vps-jrmp3.shSH948 B
vps-nested2.shSH944 B
vps-nested-test.shSH937 B
stage_r9.shSH787 B
bridge.pyPY751 B
jrmp-80.logLOG729 B
‹redacted›.headersHEADER721 B
dlserve.pyPY703 B
jrmp-8384.logLOG551 B
persist.shSH510 B
listen18081.pyPY508 B
vps-listener.pyPY479 B
listen_log.pyPY446 B
vps-watch.shSH416 B
jeecms-sqli-diff.logLOG404 B
configBIN354 B
urldns.binBIN333 B
‹redacted›.jspJSP306 B
mitm80_r8.logLOG225 B
dl18083.logLOG134 B
bridge_r9.logLOG129 B
mitm_r8.logLOG82 B
http18082.logLOG70 B
configBIN70 B
configTXT68 B
configBIN43 B
configBIN43 B
configBIN43 B
mitm18086.logLOG41 B
mitm33306.logLOG41 B
configTXT40 B
bridge.logLOG31 B
configTXT28 B
configTXT25 B
ll18082.logLOG21 B
credentialsTXT20 B
d17a.phpPHP20 B
s16.phpPHP19 B
configTXT15 B
config.jsonJSON15 B
phpinfo.phpPHP15 B
HEADTXT13 B
listen18081_r9.logLOG13 B
.envENV8 B
configTXT4 B
configTXT3 B
configTXT2 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

111.223.247.165confirmed
143.92.57.247confirmed
202.162.109.5confirmed
103.39.79.102confirmed
104.21.23.192confirmed
106.75.77.231confirmed
109.122.196.145confirmed
129.121.62.230confirmed
131.123.43.239confirmed
138.68.153.82confirmed
139.87.74.49confirmed
139.87.80.68confirmed
154.217.251.226confirmed
154.36.183.100confirmed
157.173.115.165confirmed