Live findsCVE IntelResearchConsoleStart free
huntback / IP intelligence

178.104.231.250

DATACENTERoperator-submittedc2exploitexposed-secretforced-lootmalware

Intelligence

ASN / OrgAS24940 · Hetzner Online GmbH
CountryGermany
NetworkDATACENTER · risk 60/100
Threat score0/100
Open ports22, 80, 443, 2222, 7443, 8000, 8090, 8443, 18080
Productsnginx
JARM28d28d28d00028d00042d42d000000e1ea2a807a629b496b664cf07ad7c08d
Loot harvested125 file(s), 153638 KB · c2, exploit, exposed-secret, forced-loot, malware, mozi

Open directory contents (125)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
hunter-danya.sqlite3SQLITE147.6 MB
yt.htmlHTML1.2 MB
yth-setup-0643.exeEXE255 KB
v.jsonJSON124 KB
src.tgzTGZ115 KB
yth-0664.tgzTGZ104 KB
yth-0667.tgzTGZ91 KB
yth-0665.tgzTGZ77 KB
ff.logLOG75 KB
yth-0666.tgzTGZ72 KB
bibinto_move.sql.gzGZ45 KB
accfarm.tgzTGZ33 KB
j6cc_emails.txtTXT18 KB
cached-certsTXT17 KB
cached-certsTXT17 KB
cached-certsTXT17 KB
cached-certsTXT17 KB
cached-certsTXT17 KB
cached-certsTXT17 KB
RUNBOOK.mdMD11 KB
dp4l_emails.txtTXT11 KB
status_server.pyPY6 KB
faketls_e2e.pyPY5 KB
test_llm_route.pyPY4 KB
probe_wall.pyPY4 KB
logTXT4 KB
logTXT3 KB
swap_photo.pyPY3 KB
probe_bot.pyPY3 KB
logTXT3 KB
‹redacted›.mjsMJS3 KB
migrate_2026-08-16-apps.sqlSQL3 KB
logTXT3 KB
yt.jsonJSON3 KB
logTXT2 KB
logTXT2 KB
probe_menu.pyPY2 KB
send_dm.pyPY2 KB
feed_update.pyPY2 KB
peek.sqlSQL2 KB
maskcheck.pyPY2 KB
lipsync_test.pyPY2 KB
yth-gleb.jsJS1 KB
dump_chat.pyPY1 KB
yth-rescrape.jsJS1 KB
yth-diag2.jsJS1 KB
dry1.pyPY1 KB
probe.pyPY1 KB
getapi.pyPY1 KB
peek3.sqlSQL1 KB
run_verify.pyPY1 KB
read_bot.pyPY1 KB
peek2.sqlSQL1 KB
probe_faketls.pyPY1 KB
walk1.pyPY1 KB
yth-forms2.shSH1 KB
read_service.pyPY1 KB
lim2.sqlSQL1 KB
stat.sqlSQL1 KB
‹redacted›.mjsMJS1 KB
lim4.sqlSQL1 KB
.envENV1 KB
quota.sqlSQL1022 B
q3.sqlSQL1004 B
‹redacted›.mjsMJS925 B
yth-flip.shSH918 B
lim.sqlSQL896 B
requirements.txtTXT855 B
‹redacted›.mjsMJS818 B
final.sqlSQL801 B
stat2.sqlSQL800 B
yth-rate2.shSH795 B
lim3.sqlSQL792 B
cfg.jsonJSON775 B
.gitignoreGITIGN760 B
‹redacted›.mjsMJS701 B
q20.sqlSQL684 B
yth-rate.shSH665 B
q2.sqlSQL633 B
move_all.sqlSQL612 B
likes2.sqlSQL585 B
hist.shSH527 B
make_note_only.pyPY507 B
q19.sqlSQL482 B
gest.sqlSQL457 B
v1203d.sqlSQL456 B
‹redacted›.mjsMJS445 B
q.jsJS442 B
‹redacted›.mjsMJS437 B
w6.sqlSQL416 B
v1203.sqlSQL384 B
rp9c_analysis2.shSH382 B
prem.sqlSQL380 B
w1203.sqlSQL380 B
lk.sqlSQL370 B
w8.sqlSQL362 B
curve.shSH348 B
us2check.shSH311 B
watch.sqlSQL311 B
tr.pyPY303 B
rp9c_analysis.shSH297 B
q.sqlSQL288 B
watch2.sqlSQL282 B
likes.sqlSQL280 B
v1203c.sqlSQL268 B
reg.sqlSQL261 B
w7.sqlSQL241 B
now.sqlSQL235 B
config_danya_paris.pyPY232 B
v1203b.sqlSQL216 B
wake.sqlSQL213 B
us2check2.shSH192 B
likes3.sqlSQL155 B
move.sqlSQL141 B
send.sqlSQL114 B
‹redacted›.rcRC112 B
‹redacted›.rcRC112 B
‹redacted›.rcRC112 B
‹redacted›.rcRC112 B
‹redacted›.rcRC112 B
‹redacted›.rcRC112 B
restart.sqlSQL94 B
start.sqlSQL92 B
r2.sqlSQL82 B
.gitignoreGITIGN52 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

1.95.73.45lead
101.34.209.211lead
101.53.135.104lead
103.112.185.51lead
103.112.185.93lead
103.127.99.152lead
103.151.5.208lead
103.159.50.137lead
103.226.249.70lead
103.248.25.149lead
103.31.78.47lead
106.55.243.186lead
108.165.233.230lead
109.122.196.145lead
109.122.196.149lead