Live findsCVE IntelResearchConsoleStart free
huntback / IP intelligence

18.136.195.202

DATACENTERoperator-submittedloot-ipelf-binaryexploitexposed-secretmalware

Intelligence

ASN / OrgAS16509 · Amazon.com, Inc.
CountrySingapore
NetworkDATACENTER · risk 60/100
Threat score0/100
Open ports22, 80, 8080, 8443, 8888, 9001
JARM2ad2ad0002ad2ad00042d42d000000ad9bf51cc3f5a1e29eecb81d0c7b06eb
Loot harvested213 file(s), 26638 KB · elf-binary, exploit, exposed-secret, malware, mozi, tunnel

Open directory contents (213)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
ncat-staticELF2.8 MB
lnd_restore_vps6.logLOG2.7 MB
target-complete.tar.gzGZ2.1 MB
x_exfil.txtTXT1.6 MB
target-files.tar.gzGZ1.1 MB
cve80521ELF1.0 MB
cve98260ELF1011 KB
cve98260_awsELF1011 KB
huge.jsonJSON976 KB
test_syscalls2ELF878 KB
test_sc3ELF878 KB
chage_pwn_x86ELF805 KB
exploitELF791 KB
.vcELF790 KB
btf_parserELF789 KB
read_btfELF785 KB
test_aioELF771 KB
test_syscallsELF751 KB
chage_pwnELF695 KB
lnd-restore.logLOG647 KB
prom_harvest.txtTXT578 KB
macaroon_capture.logLOG576 KB
auto_exploit.logLOG376 KB
auto_exploit.logLOG272 KB
monitor.logLOG119 KB
monitor.logLOG111 KB
aggressive_monitor.logLOG81 KB
aggressive_monitor.logLOG70 KB
php2shell.pyPY66 KB
poc.pyPY59 KB
run.shSH46 KB
macaroon_capture.logLOG43 KB
drain_v6.logLOG41 KB
redirector_hits.logLOG41 KB
readme_wp-mail-smtp.txtTXT40 KB
package-lock.jsonJSON37 KB
dirtycredELF36 KB
rtl_monitor_v2.logLOG36 KB
drain_v7_stdout.logLOG32 KB
drain_v7.logLOG32 KB
rtl_monitor_v2_stdout.logLOG32 KB
spring_harvest.txtTXT30 KB
x_exfil.txtTXT29 KB
exploit_ref.pyPY25 KB
readme_all-in-one-wp-migration.txtTXT25 KB
poc_109618.pyPY23 KB
poc_ref.pyPY23 KB
dirtycred.cC23 KB
drain_v6.logLOG22 KB
cf-relay-cleanup.logLOG20 KB
README.mdMD20 KB
README.mdMD18 KB
wp-login.phpPHP16 KB
cf-relay-cleanup.logLOG15 KB
node2shell_rce.cC14 KB
x_receiver.logLOG11 KB
rtl_exploit2.pyPY10 KB
drain_v7.shSH10 KB
drain_v3.shSH10 KB
rtl_exploit.pyPY10 KB
rtl_sso_nan_exploit.pyPY9 KB
rtl_monitor_v2.pyPY9 KB
readme_regenerate-thumbnails.txtTXT9 KB
wp_enum.logLOG9 KB
exploit_stock.pyPY8 KB
vuln_server.cC8 KB
test_oob.cC7 KB
README.mdMD7 KB
rtl_brute_reset.pyPY7 KB
test_copyfail.pyPY7 KB
scan_origin.logLOG7 KB
x_receiver.logLOG7 KB
offsets.pyPY7 KB
run_container.shSH7 KB
copyfail.pyPY6 KB
copyfail_fixed.pyPY6 KB
cve_73570_v2.pyPY6 KB
drain_v6.shSH6 KB
auto_exploit.pyPY5 KB
rtl_osint_crack.pyPY5 KB
‹redacted›.patchPATCH5 KB
drain_v5.shSH5 KB
copyfail.cC5 KB
rtl_aggressive_monitor.pyPY5 KB
HANDOFF.mdMD4 KB
build_image.shSH4 KB
gamma_v2_vps.shSH4 KB
drain_final.shSH4 KB
drain_fixed.shSH4 KB
dash_exploit_v2.pyPY4 KB
dash_exploit.pyPY4 KB
exploit_v2.pyPY4 KB
mail_auth_v6.pyPY4 KB
vuln_brotli.cC4 KB
grpc_leak.pyPY4 KB
harvest.pyPY4 KB
macaroon_listener.pyPY3 KB
drain_v4.shSH3 KB
drain_aggressive.shSH3 KB
scan_alby_443.shSH3 KB
rogue_mysql.pyPY3 KB
chage_pwn.cC3 KB
sso_auto_exploit.shSH3 KB
flood_lndhub.pyPY3 KB
server-stock.jsJS3 KB
grpc_massive.pyPY2 KB
copyfail_root.cC2 KB
README.mdMD2 KB
probe_443_fast.pyPY2 KB
btcpay_links.txtTXT2 KB
grpc_unlimited.pyPY2 KB
spring_scan.shSH2 KB
delayed_exploit_output.logLOG2 KB
copyfail_ctypes.pyPY2 KB
jupyter_scan.shSH2 KB
zimbra_exploit.pyPY2 KB
gamma_v2_vps2.shSH2 KB
wp_enum.pyPY2 KB
server-crash.jsJS2 KB
webhook_redirector.pyPY2 KB
exploit_result.logLOG2 KB
zimbra_v2.pyPY2 KB
prom_scan.shSH2 KB
watchdog.shSH2 KB
watchdog_v2.shSH2 KB
gamma_v2_vps3.shSH2 KB
quick_auth.pyPY2 KB
monitor_all.shSH2 KB
‹redacted›.rceRCE2 KB
README.mdMD2 KB
gamma_v2_vps.logLOG2 KB
server.jsJS2 KB
README.mdMD2 KB
probe_443.shSH2 KB
server-plain.jsJS1 KB
gamma_v2_vps3.logLOG1 KB
check_origin.shSH1 KB
key.pemPEM1 KB
scan_alby.shSH1 KB
server.keyKEY1 KB
config.envENV1 KB
gamma_v2_vps2.logLOG1 KB
server.pemPEM1 KB
brotli_trap.pyPY1 KB
scan_origin.shSH1 KB
cert.pemPEM1 KB
LICENSETXT1 KB
continuous_alby_probe.shSH941 B
‹redacted›.asanASAN916 B
php-8.3.33-bookworm-amd64.jsonJSON858 B
php-8.3.35-bookworm-amd64.jsonJSON858 B
php-8.4.25-bookworm-amd64.jsonJSON845 B
php-8.4.26-bookworm-amd64.jsonJSON845 B
php-8.5.11-bookworm-amd64.jsonJSON845 B
x_receiver.pyPY844 B
.htaccessHTACCE831 B
_git_configGITCHE787 B
crash_rtl.pyPY768 B
connect_test.pyPY747 B
run_alby.shSH744 B
modsecurity-php2shell.confCONF628 B
php-lab.jsonJSON533 B
docker-compose.ymlYML501 B
php2shell.confCONF468 B
public_key.pemPEM451 B
btc_fp2_h.txtTXT432 B
btc_fp3_h.txtTXT432 B
watchdog.logLOG429 B
.gitignoreGITIGN407 B
package.jsonJSON382 B
php.iniINI362 B
‹redacted›.crashCRASH349 B
rtl_exploit.txtTXT346 B
rtl_exploit1.txtTXT344 B
SSO_EXPLOIT_SUCCESS.txtTXT333 B
‹redacted›.targetTARGET332 B
MakefileTXT328 B
http_listen.logLOG322 B
Caddyfile-snippetTXT308 B
configTXT295 B
apache.confCONF282 B
configTXT280 B
configTXT279 B
configTXT272 B
‹redacted›.stockSTOCK257 B
rogue_mysql.logLOG248 B
delayed_exploit.shSH243 B
tls.keyKEY227 B
csrf_gen.pyPY226 B
nc_listen.logLOG203 B
‹redacted›.gypGYP188 B
.gitignoreGITIGN136 B
packed-refsTXT114 B
packed-refsTXT112 B
packed-refsTXT112 B
packed-refsTXT112 B
watchdog_v2.logLOG92 B
descriptionTXT73 B
revshell.logLOG68 B
rtl_reset_out.txtTXT65 B
.gitignoreGITIGN37 B
configTXT36 B
nc_8080.logLOG27 B
nc_4444.logLOG26 B
nc_9001.logLOG26 B
HEADTXT23 B
nc443.logLOG22 B
theme_header.phpPHP22 B
HEADTXT21 B
chage_pwn.cTXT14 B
brotli_trigger.binBIN13 B
configTXT2 B
theme_footer.phpPHP2 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

111.223.247.165confirmed
178.16.52.154confirmed
204.168.152.129confirmed
213.177.179.14confirmed
4.193.248.52confirmed
45.152.149.32confirmed
5.75.252.79confirmed
94.130.22.61confirmed
1.234.83.89confirmed
100.21.82.169confirmed
101.36.112.205confirmed
101.42.136.73confirmed
101.47.156.26confirmed
101.89.149.227confirmed
102.204.222.159confirmed