Live findsCVE IntelConsoleStart free
huntback / IP intelligence

91.92.241.101

RESIDENTIALioc-tweetfeedloot-ipc2elf-binaryexploitexposed-secret

Intelligence

ASN / OrgAS202412 · Omegatech LTD
CountryThe Netherlands
NetworkRESIDENTIAL · risk 15/100
Threat score0/100
Open ports22, 25, 80, 443, 445, 4444, 8000, 8001, 8010, 8080, 8081, 8089, 8096, 8099, 8443, 8888
ServiceBaseHTTP/0.6 Python/3.12.3 · Rebind OK
Loot harvested332 file(s), 17741 KB · c2, elf-binary, exploit, exposed-secret, malware, mozi

Open directory contents (332)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
oob39527.logLOG1.5 MB
‹redacted›.bodyBODY1.4 MB
dbclientELF1.3 MB
http8877.logLOG1.1 MB
http.logLOG1.0 MB
‹redacted›.bodyBODY439 KB
evidence_round2.tgzTGZ374 KB
phpssh.tgzTGZ373 KB
‹redacted›.bodyBODY331 KB
homepage.htmlHTML289 KB
‹redacted›.bodyBODY279 KB
‹redacted›.min.jsJS253 KB
rest_all_schema.jsonJSON233 KB
‹redacted›.bodyBODY233 KB
.well-known_security.txt.b2B2207 KB
‹redacted›.bodyBODY207 KB
‹redacted›.bodyBODY207 KB
‹redacted›.bodyBODY207 KB
‹redacted›.bodyBODY207 KB
‹redacted›.bodyBODY207 KB
‹redacted›.bodyBODY207 KB
‹redacted›.bodyBODY207 KB
‹redacted›.bodyBODY207 KB
‹redacted›.bodyBODY207 KB
‹redacted›.bodyBODY207 KB
‹redacted›.bodyBODY207 KB
‹redacted›.bodyBODY207 KB
‹redacted›.bodyBODY207 KB
‹redacted›.bodyBODY207 KB
‹redacted›.bodyBODY207 KB
‹redacted›.bodyBODY207 KB
‹redacted›.bodyBODY206 KB
‹redacted›.bodyBODY206 KB
‹redacted›.bodyBODY206 KB
‹redacted›.bodyBODY206 KB
‹redacted›.bodyBODY206 KB
‹redacted›.bodyBODY206 KB
‹redacted›.bodyBODY206 KB
‹redacted›.bodyBODY206 KB
‹redacted›.bodyBODY206 KB
‹redacted›.bodyBODY206 KB
‹redacted›.mapMAP191 KB
jsonp_probe.txtTXT184 KB
rest_root.jsonJSON173 KB
customer_account_login.b2B2169 KB
evidence_recon.tgzTGZ146 KB
‹redacted›.min.jsJS138 KB
matomo_home.htmlHTML137 KB
login.htmlHTML137 KB
login2.htmlHTML137 KB
debug.logLOG119 KB
scripts.jsJS115 KB
CHANGELOG.mdMD107 KB
rapiddns.htmlHTML62 KB
‹redacted›.min.jsJS60 KB
scripts-nr.jsJS57 KB
‹redacted›.bodyBODY49 KB
cms_home.jsonJSON48 KB
content_discovery_bundle.tgzTGZ45 KB
‹redacted›.bodyBODY38 KB
mut_args.jsonJSON34 KB
‹redacted›.min.jsJS31 KB
surface_clean.txtTXT26 KB
‹redacted›.min.jsJS25 KB
evidence_round3.tgzTGZ25 KB
media_sitemaps.binBIN23 KB
gql_types.txtTXT22 KB
cdp_scan_hits.logLOG21 KB
get.php.binBIN21 KB
pyfuzz_www.jsonJSON20 KB
merchant_pay_scan.txtTXT20 KB
vamida_round2_20261010.tgzTGZ18 KB
vamida_evidence_20261010.tgzTGZ17 KB
‹redacted›.jsonlJSONL17 KB
evidence_round4.tgzTGZ17 KB
surface_uniq.txtTXT16 KB
magento_surface.txtTXT14 KB
‹redacted›.min.jsJS12 KB
pyfuzz_www.tsvTSV11 KB
evidence_sensitive.tgzTGZ11 KB
‹redacted›.min.jsJS11 KB
xss2shell_paw_poc.htmlHTML10 KB
‹redacted›.min.jsJS8 KB
session.sqliteSQLITE8 KB
pma_ChangeLog.txtTXT7 KB
FINDINGS_sensitive_paths.mdMD6 KB
cve_2022_44268.pyPY6 KB
SURFACE_REPORT.mdMD6 KB
cve44268_v2.pyPY6 KB
cdp_plant_chrome_svc.htmlHTML5 KB
cve44268_exfil.shSH5 KB
mut.jsonJSON5 KB
cdp_overwrite_container.htmlHTML5 KB
cve44268_v3.pyPY5 KB
‹redacted›.min.jsJS5 KB
auth_retry.pyPY5 KB
cdp_exploit2.htmlHTML5 KB
cve44268_direct.shSH5 KB
auth_full.pyPY4 KB
‹redacted›.min.jsJS4 KB
pw_login.pyPY4 KB
admin_all.txtTXT4 KB
fuzz_wordlist.txtTXT4 KB
cdp_keys_shell.htmlHTML4 KB
name_control.shSH4 KB
php_fuzz.shSH4 KB
pw_fresh.pyPY4 KB
host_hunt.shSH3 KB
cdp_access.htmlHTML3 KB
oneshot_auth.pyPY3 KB
auth_diag.pyPY3 KB
cdp_exploit.htmlHTML3 KB
admin_uniq.txtTXT3 KB
pw_login2.pyPY3 KB
auth_final.pyPY3 KB
exec_test.shSH3 KB
phar_confirm.shSH3 KB
phar_abs.shSH3 KB
phar_probe.shSH3 KB
auth_keepalive.pyPY3 KB
cdp_restore2.htmlHTML3 KB
.env.bodyBODY3 KB
magento-admin-paths.txtTXT3 KB
phar_final.shSH3 KB
gql_auth.pyPY3 KB
‹redacted›.min.jsJS3 KB
auth_v3.pyPY3 KB
jwt-private.pemPEM3 KB
‹redacted›.test.pemPEM3 KB
jwt_private.pemPEM3 KB
backup_merged.txtTXT3 KB
auth_sweep.pyPY3 KB
pw_headed.pyPY3 KB
ssrf_scan.shSH3 KB
cdp_deep_plant.htmlHTML3 KB
cdp_cache_rce.htmlHTML3 KB
cdp_replant_enum.htmlHTML3 KB
fcgi_probe.phpPHP3 KB
capture_server.pyPY3 KB
admin_probe_all.tsvTSV2 KB
scan2.shSH2 KB
ajax_actions.txtTXT2 KB
amazon_config.jsonJSON2 KB
‹redacted›.min.jsJS2 KB
wp2shell_matrix.pyPY2 KB
cdp_restore.htmlHTML2 KB
magento-sensitive2.txtTXT2 KB
evidence_summary.jsonJSON2 KB
auth_flow.pyPY2 KB
auth_inspect.pyPY2 KB
face2faceafrica.com_wp-config-sample.phpPHP2 KB
probe_admin_all.tsvTSV2 KB
cdp_fix3.htmlHTML2 KB
fuzz_results.tsvTSV2 KB
cdp_chrome_only.htmlHTML2 KB
fcgi_exec.phpPHP2 KB
pw_headed2.pyPY2 KB
echo_server.pyPY2 KB
oembed_control.jsonJSON2 KB
ROUND2_SUMMARY.mdMD2 KB
cdp_wrap_only.htmlHTML2 KB
rest_schema_meta.txtTXT1 KB
cdp_wrap_fast.htmlHTML1 KB
phar_diag.shSH1 KB
static_urls.txtTXT1 KB
mailtm.pyPY1 KB
‹redacted›.min.jsJS1 KB
admin_probe_results.tsvTSV1 KB
matomo_probe.shSH1 KB
‹redacted›.min.jsJS1 KB
‹redacted›.min.jsJS1 KB
sensitive_backup.txtTXT1 KB
fuzz_final.tsvTSV1 KB
‹redacted›.min.jsJS1 KB
magento_paths.txtTXT1 KB
cdn.face2faceafrica.com_.envENV1 KB
apihook8.pyPY1 KB
ct_server.pyPY1 KB
patient_input.jsonJSON1 KB
magento_paths.txtTXT1 KB
rce_pdf.pyPY1 KB
magento-sensitive.txtTXT1 KB
apihook4.pyPY1 KB
apihook6.pyPY1 KB
oneshot_run.logLOG1 KB
fingerprint.shSH1 KB
apihook7.pyPY1009 B
‹redacted›.hdrHDR958 B
apihook3.pyPY956 B
plugin_inventory.csvCSV941 B
rd2.pyPY878 B
results.tsvTSV874 B
http_listener.logLOG873 B
apihook2.pyPY866 B
redir2.pyPY864 B
mkpoly.phpPHP841 B
‹redacted›.hdrHDR824 B
‹redacted›.hdrHDR819 B
‹redacted›.hdrHDR817 B
‹redacted›.hdrHDR817 B
‹redacted›.hdrHDR817 B
‹redacted›.hdrHDR817 B
‹redacted›.hdrHDR817 B
ssh_run.phpPHP810 B
apihook.pyPY807 B
jwt-public.pemPEM800 B
‹redacted›.test.pemPEM800 B
jwt_public.pemPEM800 B
appProdProjectContainer.phpPHP780 B
getChromeLauncherService.phpPHP740 B
getChromeLauncherService_Z5.phpPHP740 B
getChromeLauncherService_chvu.phpPHP710 B
http8877.pyPY680 B
mkphar.phpPHP664 B
‹redacted›.bodyBODY652 B
redir.pyPY649 B
rdfix.pyPY641 B
apihook5.pyPY634 B
magento_admin_paths.txtTXT617 B
‹redacted›.bodyBODY603 B
configTXT572 B
xmlrpc_multicall_resp.txtTXT566 B
rdfix_pt.pyPY504 B
‹redacted›.xmlXML403 B
systemd-tmpfiles.phpPHP392 B
rd.pyPY387 B
‹redacted›.bodyBODY385 B
redir9.pyPY362 B
redir3.pyPY342 B
Slack.phpPHP315 B
‹redacted›.bodyBODY305 B
admin_frontnames.txtTXT304 B
config.ini.phpPHP282 B
png_phar.binBIN259 B
storeconfig.jsonJSON250 B
upload.binBIN246 B
nuclei_paw.txtTXT246 B
ContainerAuto.phpPHP244 B
pyfuzz_www.logLOG230 B
‹redacted›.mslMSL226 B
‹redacted›.psPS221 B
‹redacted›.min.jsJS217 B
‹redacted›.dtdDTD209 B
‹redacted›.xmlXML203 B
‹redacted›.mslMSL191 B
real_phar.binBIN187 B
gql_token_as_admin.jsonJSON161 B
‹redacted›.xmlXML158 B
‹redacted›.metaMETA154 B
gql_storeconfig2.jsonJSON154 B
‹redacted›.metaMETA153 B
‹redacted›.metaMETA143 B
x.shSH133 B
gql_storeconfig.txtTXT129 B
ContainerX.phpPHP123 B
‹redacted›.bodyBODY121 B
‹redacted›.bodyBODY117 B
‹redacted›.bodyBODY111 B
‹redacted›.metaMETA108 B
‹redacted›.metaMETA107 B
‹redacted›.metaMETA105 B
‹redacted›.metaMETA104 B
‹redacted›.metaMETA104 B
‹redacted›.metaMETA103 B
‹redacted›.metaMETA101 B
‹redacted›.metaMETA99 B
‹redacted›.metaMETA97 B
‹redacted›.metaMETA94 B
‹redacted›.bodyBODY93 B
‹redacted›.metaMETA91 B
‹redacted›.metaMETA87 B
‹redacted›.metaMETA86 B
‹redacted›.metaMETA83 B
‹redacted›.metaMETA83 B
‹redacted›.metaMETA83 B
‹redacted›.metaMETA83 B
‹redacted›.metaMETA82 B
‹redacted›.metaMETA82 B
‹redacted›.metaMETA82 B
‹redacted›.metaMETA81 B
‹redacted›.metaMETA81 B
‹redacted›.metaMETA81 B
‹redacted›.metaMETA80 B
‹redacted›.metaMETA80 B
‹redacted›.metaMETA80 B
‹redacted›.metaMETA79 B
‹redacted›.metaMETA79 B
‹redacted›.metaMETA79 B
‹redacted›.metaMETA78 B
‹redacted›.metaMETA78 B
‹redacted›.metaMETA78 B
‹redacted›.metaMETA78 B
‹redacted›.metaMETA78 B
‹redacted›.metaMETA76 B
‹redacted›.metaMETA76 B
‹redacted›.metaMETA76 B
‹redacted›.metaMETA75 B
‹redacted›.metaMETA74 B
‹redacted›.metaMETA73 B
‹redacted›.metaMETA72 B
‹redacted›.metaMETA72 B
plain.phpPHP70 B
‹redacted›.metaMETA65 B
‹redacted›.metaMETA65 B
‹redacted›.metaMETA63 B
‹redacted›.bodyBODY60 B
‹redacted›.metaMETA59 B
‹redacted›.metaMETA59 B
‹redacted›.metaMETA57 B
‹redacted›.metaMETA55 B
‹redacted›.metaMETA54 B
‹redacted›.metaMETA53 B
marker.phpPHP52 B
‹redacted›.bodyBODY52 B
‹redacted›.metaMETA49 B
‹redacted›.metaMETA47 B
‹redacted›.metaMETA46 B
‹redacted›.metaMETA44 B
‹redacted›.metaMETA43 B
configBIN42 B
‹redacted›.bodyBODY42 B
‹redacted›.metaMETA42 B
‹redacted›.metaMETA41 B
shell.ph%2570PH%25737 B
‹redacted›.metaMETA37 B
shell.phpPHP33 B
deploy.shSH30 B
‹redacted›.bodyBODY17 B
configTXT13 B
‹redacted›.bodyBODY10 B
‹redacted›.bodyBODY9 B
configTXT2 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

101.42.136.73confirmed
102.204.222.159confirmed
102.210.149.166confirmed
103.46.185.169confirmed
108.61.219.168confirmed
111.223.247.165confirmed
118.107.13.102confirmed
118.107.41.239confirmed
122.10.110.72confirmed
122.10.17.49confirmed
149.30.245.147confirmed
15.188.163.78confirmed
153.52.111.73confirmed
154.217.251.226confirmed
154.94.233.136confirmed