Live findsCVE IntelConsoleStart free
huntback / IP intelligence

212.232.23.75

RESIDENTIALoperator-submittedloot-ipelf-binaryexploitexposed-secretmalware

Intelligence

ASN / OrgAS215381 · ROCKHOSTER PRIVATE LIMITED
CountrySingapore
NetworkRESIDENTIAL · risk 15/100
Threat score0/100
Open ports22, 8877
ServiceSimpleHTTP/0.6 Python/3.10.4 · Directory listing for /
Loot harvested341 file(s), 20978 KB · elf-binary, exploit, exposed-secret, malware, mozi, pe-binary

Open directory contents (341)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
http_server.logLOG7.5 MB
xxe_http.logLOG2.6 MB
ncat.exePE2.2 MB
smtp_emails.txtTXT1.7 MB
smtp_server.logLOG974 KB
xxe_server.logLOG926 KB
xxe_stdout.logLOG813 KB
http_listener.logLOG584 KB
mofa_serverinfo.jsonJSON416 KB
redis_master.logLOG370 KB
JuicyPotato.exeEXE339 KB
jrmp.logLOG265 KB
sp_payloads.jsonJSON180 KB
mofa_sp_fire.pyPY56 KB
GodPotato.exeEXE56 KB
GodPotato2.exePE56 KB
ldap53_v2.logLOG30 KB
PrintSpoofer64.exeEXE26 KB
cve_50751.pyPY26 KB
cp_chain_exploit.pyPY25 KB
cp_asn1_rce.pyPY19 KB
cp_91843_p8.pyPY18 KB
cp_ssrf_exploit.pyPY18 KB
shell_srv.logLOG18 KB
cp_asn1_v2.pyPY18 KB
mofa_dnn.pyPY18 KB
cp_final.pyPY17 KB
cp_91843_p7.pyPY17 KB
cp_91843.pyPY17 KB
cp_91843_p6.pyPY16 KB
pip_install.logLOG16 KB
mofa_sp_exploit.pyPY16 KB
mofa_sp2010_exp.pyPY15 KB
idp2.logLOG15 KB
module.soELF15 KB
mofa_exploit.pyPY15 KB
mofa_sp_pwn.pyPY14 KB
cp_91843_p5.pyPY14 KB
mofa_exp2.pyPY14 KB
cp_psk.pyPY14 KB
mofa_multi.pyPY13 KB
mofa_cpanel.pyPY13 KB
mofa_sp_alt.pyPY13 KB
mofa_telerik.pyPY13 KB
mofa_exp4.pyPY13 KB
mofa_dnn_final.pyPY13 KB
cp_91843_p2.pyPY13 KB
mofa_sp_vs.pyPY13 KB
mofa_dnn_login.pyPY13 KB
mofa_exp3.pyPY13 KB
mofa_web_lr.pyPY12 KB
cp_userenum.pyPY12 KB
cp_91843_p4.pyPY12 KB
mofa_reg.pyPY12 KB
cp_ssrf_p2.pyPY12 KB
cp_91843_p3.pyPY12 KB
idp_srv_out.logLOG12 KB
mofa_deep2.pyPY12 KB
mofa_sp2010.pyPY12 KB
cp_multi.pyPY11 KB
big_cert.pemPEM11 KB
mofa_dnn_l2.pyPY11 KB
mofa_wm_attack.pyPY11 KB
mofa_rp.pyPY11 KB
mofa_deep.pyPY11 KB
revshell.logLOG11 KB
mofa_gql2.pyPY11 KB
rogue_redirect.logLOG10 KB
mofa_oidc.pyPY10 KB
cp_ssrf_p2b.pyPY10 KB
rogue_ldap.pyPY10 KB
cp_ssrf_p5.pyPY10 KB
mofa_gql.pyPY10 KB
mofa_token.pyPY10 KB
mofa_web2.pyPY10 KB
cp_adj.pyPY9 KB
post_log.txtTXT9 KB
alt_rce.pyPY9 KB
mofa_my.pyPY9 KB
mofa_recon.pyPY9 KB
baocao_deep.pyPY9 KB
mofa_wm_recon.pyPY9 KB
mofa_oidc_t.pyPY8 KB
mofa_wm2.pyPY8 KB
mofa_dnn_lf.pyPY8 KB
attack_baocao.pyPY8 KB
ldap53_v2.pyPY8 KB
mofa_rce3.pyPY8 KB
combo53.pyPY7 KB
redir.pyPY7 KB
oracle_rce.pyPY7 KB
realm_smtp.jsonJSON7 KB
auto_shell.pyPY7 KB
redirect_ssrf.logLOG7 KB
mofa_sp_recon.pyPY7 KB
read_files.pyPY7 KB
realm_update.jsonJSON6 KB
potato.pyPY6 KB
xxe_server.pyPY6 KB
mofa_sp_find.pyPY6 KB
ldap53_pure.pyPY6 KB
redis_timing.pyPY6 KB
rogue_jndi.pyPY6 KB
deploy_trigger.pyPY6 KB
wmi_rce.pyPY6 KB
oracle_fix.pyPY6 KB
rogue_ldap_v2.pyPY6 KB
ldap53_pure.logLOG5 KB
minio_dl.pyPY5 KB
rogue_redirect.pyPY5 KB
mssql_rce.pyPY5 KB
idp2.pyPY5 KB
ssrf_proxy.logLOG5 KB
privesc.pyPY5 KB
redir_exfil.pyPY5 KB
exec2.pyPY5 KB
redirect_exfil.logLOG4 KB
proxylogon2.pyPY4 KB
redirect_srv.pyPY4 KB
ldap_v2.logLOG4 KB
minio_explore.pyPY4 KB
‹redacted›.outOUT4 KB
ldap_capture.pyPY4 KB
redir2.pyPY4 KB
ps_rce.pyPY4 KB
rogue_fixed.pyPY4 KB
redis_verify.pyPY4 KB
rogue_idp.pyPY4 KB
rogue_mysql.pyPY4 KB
idp_srv.pyPY4 KB
ldap_referral.pyPY4 KB
rogue_http.pyPY4 KB
exfil_srv.pyPY4 KB
oidc2_out.logLOG4 KB
mofa_sp_fire2.pyPY4 KB
ntlm_extract.pyPY3 KB
parse_export.pyPY3 KB
https_idp.pyPY3 KB
idp_exfil_srv.pyPY3 KB
ssrf_redir.pyPY3 KB
rogue_ldap_output.logLOG3 KB
scg_exploit.pyPY3 KB
ldap_bind_capture.logLOG3 KB
run103.shSH3 KB
docker_raw.pyPY3 KB
cpmi_overflow.pyPY3 KB
docker_redir.pyPY3 KB
ssrf_srv.pyPY3 KB
vpn_explore.pyPY3 KB
idp_server.logLOG3 KB
config_server.pyPY3 KB
bhxh_auth.pyPY3 KB
inner_scan.pyPY3 KB
rogue_fixed.logLOG3 KB
redir_srv.logLOG2 KB
payload_Jdk7u21.binBIN2 KB
module.cC2 KB
minio_test.pyPY2 KB
minio_webhook.pyPY2 KB
oracle_test.pyPY2 KB
payload_CommonsBeanutils1.binBIN2 KB
spray.ps1PS12 KB
heapdump_req.logLOG2 KB
rogue_mysql.logLOG2 KB
ntlm_info.pyPY2 KB
mofa_keyTXT2 KB
cert_exploit.pyPY2 KB
rogue_partial.pyPY2 KB
tcp_capture.pyPY2 KB
pwn_token.txtTXT2 KB
shell_srv.pyPY2 KB
mps_spray.pyPY2 KB
spray_ex2.pyPY2 KB
rogue_v3.pyPY2 KB
mssql_find.pyPY2 KB
fake_redis.pyPY2 KB
wq_script.pyPY2 KB
ssrf_proxy.pyPY2 KB
rogue_v2_out.logLOG2 KB
minio_console.pyPY2 KB
oidc_wrap_out.logLOG2 KB
ssh_brute.pyPY2 KB
rogue_ldap.logLOG2 KB
payload_CommonsCollections5.binBIN1 KB
meta_srv.pyPY1 KB
batch_exploit.pyPY1 KB
check_39.pyPY1 KB
ssh_brute2.pyPY1 KB
ldap_capture.logLOG1 KB
scg_crlf.pyPY1 KB
ntlm_spray.pyPY1 KB
http_serve.pyPY1 KB
mssql_brute.pyPY1 KB
redis_keyTXT1 KB
wq_search.pyPY1 KB
mssql_creds.pyPY1 KB
exfil_full.logLOG1 KB
smtp_server.pyPY1 KB
vpn_scan.pyPY1 KB
mysql_creds.txtTXT1 KB
big_key.pemPEM1 KB
idp_key.pemPEM1 KB
rogue_key.pemPEM1 KB
test_key.pemPEM1 KB
mgmt_test.pyPY1 KB
redis_test.pyPY1 KB
rogue_ldap_out.logLOG1 KB
redis_listener.pyPY1 KB
ldap_jndi.logLOG1 KB
probe_apps.pyPY1 KB
oidc_wrapper.pyPY1 KB
oracle_attack.pyPY1 KB
oidc2.pyPY1 KB
http_listener.pyPY1 KB
jdwp_test.pyPY1 KB
deser_payload.binBIN1 KB
payload_CommonsCollections7.binBIN1 KB
payload_CommonsCollections6.binBIN1 KB
payload_2.binBIN1 KB
payload_1.binBIN1 KB
cc6.binBIN1 KB
oracle_spray.pyPY1 KB
http_srv.pyPY1 KB
capture53.pyPY1 KB
listen.pyPY1 KB
oidc_wrap.pyPY1 KB
rogue_ldap_stdout.logLOG1 KB
oob_connections.logLOG1 KB
test_cert.pemPEM1 KB
idp_cert.pemPEM1 KB
rogue_cert.pemPEM1 KB
bcl_cap.pyPY1 KB
probe_217.pyPY1 KB
remote_check.pyPY1 KB
rogue_partial.logLOG1 KB
impacket_smb_out.logLOG1 KB
scan_apps.pyPY1 KB
capture.pyPY1 KB
docker_ssrf.logLOG1 KB
impacket_smb.logLOG1023 B
jndi_listener.pyPY1014 B
impacket_smb.pyPY1007 B
run_sql.pyPY990 B
mssql2.pyPY941 B
ssh_192_168_1_10.pyPY923 B
ssh_192_168_1_20.pyPY923 B
ssh_192_168_1_32.pyPY923 B
redir_srv.pyPY911 B
r103s.pyPY907 B
oracle_search.pyPY875 B
hydra_ssh2.logLOG868 B
read1.pyPY858 B
callback_srv.pyPY825 B
meta_srv.logLOG821 B
tns_test.pyPY821 B
capture53.logLOG815 B
hydra_ssh.logLOG791 B
ntlm2.pyPY790 B
cb_srv.pyPY779 B
cb.pyPY750 B
wq_sql.pyPY742 B
xml_serve.pyPY720 B
banner.pyPY705 B
rogue_http.logLOG699 B
http_logger.pyPY682 B
http_cb.logLOG678 B
cb_server.logLOG675 B
scan_nearby.pyPY669 B
‹redacted›.warWAR665 B
mssql_test.pyPY663 B
idp_exfil.logLOG658 B
scan_kc.pyPY647 B
rr.pyPY639 B
tcp_capture.logLOG637 B
wq.pyPY618 B
‹redacted›.xmlXML609 B
winqt_cmd.pyPY601 B
wq_file.pyPY600 B
htpasswd.txtTXT597 B
redis_listener.logLOG596 B
minio_backdoor.shSH584 B
wordlist.txtTXT579 B
scan_217.pyPY574 B
hydra_mssql.logLOG564 B
api_dl.logLOG549 B
rogue_idp.logLOG548 B
mc_dl.logLOG540 B
nc.logLOG496 B
‹redacted›.javaJAVA494 B
ldap_ref_out.logLOG490 B
saml_xxeTXT444 B
raw_jdwp.pyPY443 B
https_idp.logLOG413 B
bcl_client.jsonJSON412 B
test_keyTXT411 B
ciba.jsonJSON408 B
docker_idp.jsonJSON402 B
bcl2.jsonJSON378 B
sqlwl.txtTXT353 B
passwords.txtTXT338 B
bcl_capture.logLOG334 B
payload_URLDNS.binBIN320 B
raw_dock.pyPY319 B
jwks_docker.jsonJSON315 B
cp_revshell.logLOG312 B
ldap53.logLOG293 B
payload_JRMPClient.binBIN284 B
shell.logLOG267 B
reg.jsonJSON259 B
passwords2.txtTXT258 B
oidc_metadata.jsonJSON234 B
ldap_deser.logLOG225 B
redis_install.logLOG212 B
mc_restart.logLOG204 B
SHELL_PROOF.txtTXT202 B
mc_update.logLOG150 B
dtdTXT149 B
xml_serve.logLOG98 B
smtp2.logLOG86 B
portscan.logLOG85 B
combo53_stdout.logLOG78 B
smb_capture.logLOG77 B
httpd9999.logLOG75 B
shell_log.txtTXT69 B
ssrf_srv_out.logLOG65 B
jndi.logLOG55 B
db_pip.logLOG38 B
exfil_target.txtTXT36 B
jndi_listener.logLOG36 B
config.logLOG30 B
capture53_out.logLOG29 B
cp_shell.logLOG26 B
nc7777.logLOG26 B
out_6389.logLOG26 B
out_8765.logLOG26 B
shell_5555.logLOG26 B
http_serve.logLOG23 B
capture.logLOG21 B
smtp.logLOG16 B
smtp_data.binBIN10 B
ssrf_redirect.logJSP1 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Passive DNS

ip-212-232-23-75.rockhoster.net

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

104.131.123.136confirmed
121.36.206.152confirmed
14.29.208.101confirmed
15.188.163.78confirmed
157.90.175.209confirmed
184.154.107.45confirmed
203.194.115.12confirmed
32.236.62.30confirmed
38.60.227.210confirmed
45.115.26.30confirmed
51.159.105.208confirmed
51.159.21.191confirmed
67.215.232.25confirmed
8.133.234.121confirmed
87.251.64.224confirmed