Live findsCVE IntelConsoleStart free
huntback / IP intelligence

8.138.166.206

DATACENTERoperator-submittedc2exploitexposed-secretforced-lootmacho-binary

Intelligence

ASN / OrgAS37963 · Hangzhou Alibaba Advertising Co.,Ltd.
CountrySingapore
NetworkDATACENTER · risk 60/100
Threat score0/100
Open ports2222, 8000
ServiceSimpleHTTP/0.6 Python/3.10.12 · Directory listing for /
Loot harvested93 file(s), 56921 KB · c2, exploit, exposed-secret, forced-loot, macho-binary, malware

Open directory contents (93)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
‹redacted›.dmpDMP38.5 MB
‹redacted›.hivHIV12.5 MB
http8000.logLOG3.0 MB
‹redacted›.jarJAR614 KB
‹redacted›.jarJAR561 KB
exfil.logLOG124 KB
S4U2self.pyPY30 KB
nopac.tgzTGZ27 KB
‹redacted›.jarJAR24 KB
dcsyncclient.pyPY20 KB
secretsdump.pyPY19 KB
noPac.pyPY19 KB
domdacl.txtTXT18 KB
smbexec.pyPY16 KB
helper.pyPY13 KB
‹redacted›.outOUT13 KB
dirkjanm_CVE-2020-1472.zipZIP12 KB
callback_5555.logLOG12 KB
addcomputer.pyPY10 KB
scanner.pyPY7 KB
‹redacted›.jarJAR7 KB
README.mdMD6 KB
restorepassword.pyPY6 KB
cve-2020-1472-exploit.pyPY4 KB
callback_4444.logLOG4 KB
hax.cC4 KB
zl.zipZIP4 KB
nfsops.pyPY4 KB
dacledit-20261013-003627.bakBAK3 KB
‹redacted›.xmlXML3 KB
b.tgzTGZ3 KB
zerologon_tester.pyPY2 KB
cmd8.txtTXT2 KB
aclscan.pyPY2 KB
‹redacted›.xmlXML2 KB
‹redacted›.xmlXML2 KB
acldump2.pyPY2 KB
‹redacted›.classMACHO2 KB
domdump.txtTXT2 KB
‹redacted›.xmlXML2 KB
h28.htmlHTML2 KB
‹redacted›.classMACHO2 KB
‹redacted›.classMACHO2 KB
README.mdMD2 KB
brute.shSH1 KB
db.pyPY1 KB
.gitignoreGITIGN1 KB
‹redacted›.classMACHO1 KB
sshbrute.pyPY1 KB
spray.pyPY1 KB
cmd16.txtTXT1 KB
README.mdMD1 KB
acldbg.pyPY1 KB
‹redacted›.classMACHO1 KB
ldapdump.pyPY1 KB
LICENSETXT1 KB
dcsyncattack.pyPY1020 B
mysqlbrute.pyPY959 B
beacon_cmd.txtTXT791 B
ldapenum.pyPY790 B
nsc.pyPY752 B
ldapusers.pyPY736 B
ssh.logLOG727 B
cmd19.txtTXT707 B
exfil_server.pyPY691 B
smbenum.pyPY688 B
listener.pyPY636 B
send.shSH606 B
ldapgroups.pyPY591 B
cmd10.txtTXT540 B
diag.pyPY534 B
cmd5.txtTXT492 B
‹redacted›.xmlXML450 B
mysqlq.pyPY434 B
cmd13.txtTXT432 B
cmd7.txtTXT414 B
q1.sqlSQL411 B
lib.cC407 B
sids.pyPY401 B
id_ed25519TXT399 B
ws.shSH382 B
cmd26.txtTXT376 B
cmd9.txtTXT373 B
DockerfileTXT372 B
‹redacted›.xmlXML339 B
requirements.txtTXT291 B
MakefileTXT264 B
cmd25.txtTXT231 B
‹redacted›.xmlXML215 B
q2.sqlSQL141 B
x.cC134 B
pc.confCONF108 B
zl_exploit.pyTXT14 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

101.36.112.205confirmed
124.220.164.14confirmed
15.188.163.78confirmed
198.23.209.17confirmed
203.194.115.12confirmed
34.254.202.253confirmed
45.115.26.30confirmed
66.154.127.156confirmed
8.217.24.92confirmed
104.131.177.14lead
138.197.72.235lead
14.29.208.101lead
148.116.90.65lead
154.219.98.61lead
158.247.218.226lead