Live findsCVE IntelResearchConsoleStart free
huntback / IP intelligence

185.28.119.18

DATACENTERshodan-opendirmalicious-opendirhot:CVE-2026-97229:cve-2026-97229exploit-files:ahsay_rce_avbypass.py,ahsay_rce_poc.py,cve-2026-97229/,cve-2026-97229-lab/loot-ipc2

Intelligence

ASN / OrgAS62005 · BlueVPS OU
CountryUnited Kingdom
NetworkDATACENTER · risk 60/100
Threat score0/100
Open ports8089, 80, 631, 56777
ServiceSimpleHTTP/0.6 Python/3.12.3 · Directory listing for /
Loot harvested159 file(s), 19425 KB · c2, exploit, exposed-secret, malware, mozi, tunnel

Open directory contents (159)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
wp_all.txt.bakBAK7.1 MB
wordpress_usa.json.gzGZ6.6 MB
php_usa.json.gzGZ1.8 MB
identified.jsonJSON466 KB
identified_v2.csvCSV386 KB
hostmap.jsonJSON357 KB
identified.csvCSV245 KB
aggregate2.csvCSV228 KB
aggregate.csvCSV221 KB
gitlab_us.json.gzGZ203 KB
hostnames.csvCSV185 KB
php2shell_scan.pyPY67 KB
sweep2_input.tsvTSV58 KB
‹redacted›.pycPYC51 KB
exploit.pyPY49 KB
report-2026-10-23-medi-de-assessment.mdMD46 KB
extender.json.gzGZ44 KB
versions_raw.txtTXT39 KB
php2shell_assess.pyPY37 KB
CVE-2026-85102.pyPY36 KB
php2shell.pyPY35 KB
php_sites_detailed.txtTXT35 KB
prompt.mdMD31 KB
safechecker.pyPY28 KB
target2.txtTXT27 KB
poc.pyPY25 KB
prompt_web.mdMD24 KB
run3.mdMD24 KB
components_table.mdMD23 KB
fp_classify.pyPY23 KB
coercer_syf.logLOG23 KB
coercer_hades.logLOG22 KB
php2shell_core.pyPY21 KB
phase2b.logLOG20 KB
README.mdMD19 KB
subdomains.mdMD17 KB
ahsay_rce_poc.pyPY17 KB
sub_version_detect.mdMD17 KB
petitpotam.pyPY16 KB
report-20261020-thepros.mdMD16 KB
php2shell_operational_chain.mdMD15 KB
phase1.logLOG15 KB
cp_postex.pyPY15 KB
gen_run3.pyPY14 KB
poc.pyPY14 KB
coercer_ws.logLOG13 KB
vpn_login_page.htmlHTML12 KB
README.mdMD11 KB
CVE-2026-106173.pyPY11 KB
extender_4433.json.gzGZ11 KB
ran1.mdMD10 KB
coercer_ws2.logLOG10 KB
printerbug.pyPY10 KB
ran2.mdMD9 KB
fp_parse.pyPY9 KB
verify.pyPY8 KB
run1_instruction.mdMD8 KB
spray.logLOG8 KB
setup.pyPY7 KB
README.mdMD7 KB
wg_download_page.htmlHTML7 KB
target.txtTXT6 KB
README.mdMD6 KB
README.mdMD6 KB
README.mdMD6 KB
README.zh-CN.mdMD6 KB
recon-results.txtTXT6 KB
README.mdMD6 KB
best_candidate_for_rce.mdMD6 KB
README.mdMD6 KB
finger_prompt.mdMD6 KB
MANIFEST.mdMD6 KB
README.mdMD5 KB
p1_results.mdMD5 KB
wht_not_reverse_shellTXT5 KB
cas_php.json.gzGZ5 KB
php2shell_exploit.pyPY5 KB
prompt.mdMD5 KB
fp_one.shSH5 KB
php2shell_detection_prompt.mdMD4 KB
fp_hostmap.pyPY4 KB
kspray_full.logLOG4 KB
‹redacted›.ovpnOVPN4 KB
SUMMARY_RCE_surface.mdMD4 KB
fp_one2.shSH4 KB
‹redacted›.ovpnOVPN4 KB
fp_classify2.pyPY4 KB
php_subdomains_inventory.mdMD3 KB
fp_follow.pyPY3 KB
poc.pyPY3 KB
result_wp_200.txtTXT3 KB
openvpn.logLOG3 KB
PROVENANCE.mdMD3 KB
poc_scan.pyPY3 KB
zerologon_tester.pyPY2 KB
README.mdMD2 KB
verify_target.pyPY2 KB
README.mdMD2 KB
scope.mdMD2 KB
EXPLOIT.mdMD2 KB
phase1-internal-recon.shSH2 KB
gpp-hunt.shSH2 KB
README.mdMD2 KB
lab_name_tests.pyPY2 KB
analyze_php_sites.shSH1 KB
phase2b.shSH1 KB
check_result.pyPY1 KB
scan_versions.shSH1 KB
prompt.mdMD1 KB
kspray2.shSH1 KB
LICENSETXT1 KB
check-installed-gitlab.shSH1 KB
extract_link.pyPY1 KB
GITHUB.mdMD1 KB
LICENSETXT1 KB
LICENSETXT1 KB
fingerprint.shSH1 KB
LICENSETXT1 KB
SECURITY.mdMD1 KB
relay2.logLOG998 B
check_200.shSH981 B
relay.logLOG967 B
project_name.txtTXT944 B
themed-seeds.txtTXT942 B
fp_sweep_input.pyPY896 B
‹redacted›.cffCFF881 B
DISCLAIMER.mdMD852 B
kspray.shSH775 B
scan_php_fingerprint.shSH763 B
spray.shSH714 B
watch-tunnel.shSH684 B
relay3.logLOG652 B
scan-firebox.logLOG570 B
fp_sweep2.shSH518 B
systext.pyPY516 B
zlg_hades.logLOG504 B
fp_sweep.shSH489 B
watch-tun0.shSH462 B
fp.logLOG365 B
watch-unblock.shSH297 B
scan-firebox.shSH270 B
fp_ptr.shSH254 B
while.shSH220 B
while.shSH205 B
zlg_hades2.logLOG204 B
scan.logLOG163 B
.gitignoreGITIGN147 B
.gitignoreGITIGN147 B
zlg_syf.logLOG90 B
.gitignoreGITIGN61 B
.gitignoreGITIGN54 B
run-v4.logLOG51 B
kspray.logLOG47 B
.gitignoreGITIGN45 B
.gitignoreGITIGN44 B
requirements.txtTXT38 B
.gitignoreGITIGN29 B
requirements.txtTXT16 B
dfscoerce.pyTXT14 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

101.36.112.205confirmed
111.68.4.13confirmed
152.42.162.237confirmed
163.52.135.151confirmed
168.144.111.89confirmed
173.212.244.40confirmed
18.136.195.202confirmed
203.194.115.12confirmed
217.160.132.82confirmed
31.56.228.136confirmed
34.254.202.253confirmed
41.223.30.7confirmed
45.115.26.30confirmed
45.39.190.176confirmed
49.51.187.59confirmed