Live findsCVE IntelResearchConsoleStart free
huntback / IP intelligence

178.16.53.67

RESIDENTIALioc-tweetfeedc2exploitexposed-secretmalwaremozi

Intelligence

ASN / OrgAS202412 · Omegatech LTD
CountryThe Netherlands
NetworkRESIDENTIAL · risk 15/100
Threat score0/100
Open ports22, 80, 443, 8443, 8899
Servicenginx
Productsnginx
JARM29d29d15d29d29d00042d42d0000008829d962df49d3a8bfde9e71d906bc88
Loot harvested154 file(s), 26999 KB · c2, exploit, exposed-secret, malware, mozi, pe-binary

Open directory contents (154)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
kr.tgzTGZ5.5 MB
bin_partial.zipZIP3.8 MB
HiddenAnydesk_patched.dllPE3.7 MB
build3_bigdecoy.exePE2.1 MB
confuser.zipZIP1.9 MB
all_rates.jsonJSON1.5 MB
fgt_lang.jsonJSON1.3 MB
api_resp.txtTXT311 KB
b2md.exePE299 KB
build2_managed_final.exePE299 KB
b2l1.exePE298 KB
b2l2.exePE298 KB
allpaths.txtTXT286 KB
build2_managed_obf.exePE261 KB
build2.exePE255 KB
bin_tail.zipZIP195 KB
jolokia_list.jsonJSON193 KB
build2_bundle_final.exePE127 KB
extracted.dllPE123 KB
build2_bundle.exePE116 KB
build2_bundle_b.exePE116 KB
build2_bundle_c.exePE116 KB
build3_bundle.exePE115 KB
build2_core3.exePE114 KB
lite3.exePE113 KB
lite2.exePE113 KB
‹redacted›.outOUT112 KB
ab_v2res.exePE107 KB
build2_core4.exePE107 KB
core1.exePE106 KB
core_l1.exePE103 KB
core_l2.exePE103 KB
bc.exePE103 KB
build2_core2.exePE103 KB
build3_b.exePE103 KB
build3_core.exePE103 KB
build3_pinned.exePE103 KB
build2_core.exePE102 KB
ab_v_dynlibgcc.exePE101 KB
ab_v_static.exePE101 KB
‹redacted›.vbsVBS99 KB
build2_core.batBAT98 KB
env30380.jsonJSON88 KB
build2_managed.exePE79 KB
build3_managed.exePE79 KB
‹redacted›.outOUT60 KB
block403.htmlHTML57 KB
dl200.txtTXT46 KB
live_chunk-57f71539.671138e3.jsJS41 KB
marker_hollow.exePE36 KB
cmarker_clr_dbg.exePE34 KB
cmarker_clr.exePE32 KB
bval_dexe.exePE29 KB
env_host_bad.exePE28 KB
env_host_ok.exePE28 KB
env_host_xor.exePE28 KB
env_mac.exePE28 KB
env_vol.exePE28 KB
bval.exePE26 KB
bval2.exePE26 KB
bval_aes.exePE26 KB
‹redacted›.outOUT26 KB
bat_bundle.exePE24 KB
bat_bundle2.exePE24 KB
dbg.exePE23 KB
dbg_bundle.exePE23 KB
‹redacted›.outOUT21 KB
‹redacted›.outOUT19 KB
‹redacted›.outOUT19 KB
dbg_bundle.cC18 KB
addvenmo.jsJS17 KB
configprops.jsonJSON16 KB
marker.exePE14 KB
‹redacted›.outOUT11 KB
loginjsTXT10 KB
acct.jsJS9 KB
‹redacted›.htaHTA8 KB
‹redacted›.vbsVBS8 KB
‹redacted›.vbsVBS7 KB
bsprobe2.exePE6 KB
manual_ny_test.phpPHP6 KB
bsprobe.exePE6 KB
maillogin.htmlHTML5 KB
ctx3.jsonJSON5 KB
ctx2.jsonJSON5 KB
ctx.jsonJSON5 KB
‹redacted›.vbsVBS5 KB
‹redacted›.vbsVBS4 KB
‹redacted›.vbsVBS4 KB
‹redacted›.vbsVBS4 KB
‹redacted›.vbsVBS4 KB
cmarker.exePE4 KB
final_req.txtTXT4 KB
boston_test.phpPHP4 KB
fake_amsi.dllPE4 KB
‹redacted›.outOUT3 KB
admin_login.htmlHTML3 KB
fprobe.exePE3 KB
marker_hidden.exePE3 KB
build_wordlist.pyPY2 KB
build_req.phpPHP2 KB
abp_test_tokens.jsonJSON2 KB
build_chain2.shSH2 KB
client_watch_run.shSH1 KB
aiconfig.binBIN1 KB
abp_test_tokens2.jsonJSON1 KB
box_watch_build.shSH1 KB
dbg3.pyPY1 KB
‹redacted›.vbsVBS1 KB
ctx2.phpPHP1 KB
dbg2.pyPY1 KB
‹redacted›.vbsVBS1 KB
ctx.phpPHP1 KB
build_chain.shSH1 KB
ec2.jsJS1 KB
breach_login.pyPY1 KB
ec.jsJS1 KB
acc_test.pyPY1 KB
dbg.pyPY1 KB
final_clean.ps1PS11 KB
hidden.exePE1 KB
elevstd3.ps1PS1901 B
extract_probe2.ps1PS1868 B
elevstd_test.ps1PS1783 B
extractor_test.ps1PS1777 B
fire_joeee.pyPY755 B
fb3.jsonJSON746 B
kill_parked.ps1PS1731 B
cradle_test.ps1PS1717 B
extract_probe.ps1PS1673 B
firstline.ps1PS1670 B
‹redacted›.vbsVBS647 B
fulltrace.ps1PS1643 B
dir_shotA.jsonJSON627 B
iso_clean.ps1PS1577 B
iso_verify.ps1PS1566 B
cs_check.ps1PS1521 B
elevstd2.ps1PS1514 B
detonate_bv.ps1PS1513 B
iso_check.ps1PS1501 B
box_deepclean.ps1PS1446 B
lua_check.ps1PS1435 B
marker.cC413 B
credscan.txtTXT371 B
.wolf_tokenWOLF_T358 B
‹redacted›.vbsVBS355 B
forged_zd_token.txtTXT348 B
clean_std.ps1PS1262 B
abp_none_token.txtTXT244 B
dl_server.logLOG188 B
dl_server2.logLOG188 B
fake_amsi.cC163 B
marker.shSH160 B
gauconfig.yamlYAML47 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Passive DNS

stark-c2.178.16.53.67
stark-c2.local

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

15.235.141.9lead
8.208.10.117lead
89.22.226.255lead