Live findsCVE IntelResearchConsoleStart free
huntback / IP intelligence

16.16.63.239

DATACENTERioc-tweetfeedc2forced-lootmalwaremoziopen-directory

Intelligence

ASN / OrgAS16509 · Amazon.com, Inc.
CountrySweden
NetworkDATACENTER · risk 60/100
Threat score0/100
Open ports443, 22, 8080, 8081, 8099, 8443, 50050, 8444, 22222, 50051, 50052
JARM3fd3fd0003fd3fd00043d43d00043d3bef2bf79cd6719851e8198c1e8f9a14
Loot harvested12 file(s), 28264 KB · c2, forced-loot, ioc-match, malware, mozi, pe-binary

Open directory contents (12)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
‹redacted›.cplCPL12.1 MB
‹redacted›.cplPE5.9 MB
‹redacted›.cplPE5.9 MB
repro-beacon.exePE2.0 MB
beacon.binBIN590 KB
beacon.rc4RC4590 KB
beacon3.woff2abcdWOFF2A590 KB
ld_dbg.ps1PS11 KB
ld.ps1PS11 KB
ld_stage_dbg.ps1PS1928 B
stager_http.binBIN891 B
ld_stage.ps1PS1736 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

100.21.206.203lead
101.99.94.29lead
103.143.81.147lead
103.214.172.153lead
103.214.172.191lead
103.214.172.6lead
103.229.127.213lead
103.234.53.173lead
103.76.85.239lead
104.248.202.120lead
107.172.111.162lead
107.173.3.53lead
109.120.150.41lead
109.120.186.239lead
109.122.197.204lead