Live findsCVE IntelResearchConsoleStart free
huntback / IP intelligence

193.233.220.65

RESIDENTIALoperator-submittedloot-ipmalwareopen-directorype-binarytunnel

Intelligence

ASN / OrgAS216246 · Aeza Group LLC
CountryRussia
NetworkRESIDENTIAL · risk 15/100
Threat score0/100
Open ports22, 80, 443, 4321, 8080, 8090, 8086, 8089, 8092
Loot harvested186 file(s), 22063 KB · c2, exploit, exposed-secret, malware, mozi, pe-binary

Open directory contents (186)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
XWormV3.1_clean.exePE6.9 MB
plugins_patched.zipZIP3.8 MB
cex.exePE1.4 MB
Form1120.binBIN1.3 MB
xeno_plugins3.zipZIP1.1 MB
mstsc.exePE1.1 MB
hijack_standalone.dllPE1.0 MB
expiry_dump.exePE1.0 MB
implant_xeno.zipZIP623 KB
implant.zipZIP581 KB
xeno_plugins2.zipZIP232 KB
hijack.dllPE228 KB
cex.binBIN142 KB
xwprobe_host.exePE110 KB
xeno_plugins_renamed.zipZIP99 KB
shell.binBIN93 KB
shell_new_fresh.binBIN93 KB
version.dllPE91 KB
xeno_inj.zipZIP84 KB
xeno_nobypass.zipZIP84 KB
xeno_desig.zipZIP84 KB
xeno_hide.zipZIP84 KB
xeno_mini.zipZIP84 KB
shell.binBIN83 KB
shell.binBIN83 KB
shell.binBIN83 KB
shell.binBIN83 KB
HVNC_final.dllPE81 KB
shell_amsi.binBIN75 KB
HVNC_mark3.dllPE74 KB
HVNC_patched.dllPE73 KB
hvnc_new.dllPE59 KB
hvnc_test.dllPE58 KB
payload_uia.binPE54 KB
version_orig.dllPE53 KB
shell.binBIN52 KB
hijack.dllPE41 KB
inject.ps1PS119 KB
inject_only.ps1PS119 KB
Uacbypass.dllPE19 KB
remote_test.dllPE18 KB
version.dllPE16 KB
hidden_launch.exePE15 KB
version.dllPE15 KB
version.dllPE15 KB
version.dllPE14 KB
hvx.dllPE10 KB
uia_test.exePE6 KB
sacloader.b64B645 KB
ax.dllPE4 KB
u3.ps1PS13 KB
hiddentest2.ps1PS13 KB
u4.ps1PS13 KB
inject_standalone.ps1PS13 KB
hiddentest.ps1PS13 KB
u7.ps1PS13 KB
hvdg3.ps1PS13 KB
hvdg2.ps1PS13 KB
block_fw.ps1PS13 KB
u6.ps1PS13 KB
hvdg.ps1PS13 KB
full_test.ps1PS13 KB
u8.ps1PS13 KB
abtest.ps1PS12 KB
u5.ps1PS12 KB
scan.ps1PS12 KB
mem2.ps1PS12 KB
t_stub.ps1PS12 KB
mem3.ps1PS12 KB
t_hvx.ps1PS12 KB
verify_hvnc.ps1PS12 KB
wincls.ps1PS12 KB
abtest2.ps1PS12 KB
u1.ps1PS12 KB
desks.ps1PS12 KB
cdp_real3.ps1PS12 KB
redump.ps1PS12 KB
final_verify.ps1PS12 KB
keylogger.ps1PS12 KB
stage_oneshot.ps1PS12 KB
scan_dump.ps1PS12 KB
t_dbg.ps1PS12 KB
t_cur.ps1PS11 KB
cdp_real.ps1PS11 KB
authprobe2.ps1PS11 KB
status_check.ps1PS11 KB
authprobe.ps1PS11 KB
cdp_real2.ps1PS11 KB
authprobe3.ps1PS11 KB
dump_scan2.ps1PS11 KB
DEPLOY.txtTXT1 KB
dump_scan3.ps1PS11 KB
dump_fresh.ps1PS11 KB
u2.ps1PS11 KB
cdp.ps1PS11 KB
authprobe4.ps1PS11 KB
check_sig.ps1PS11 KB
reflect_init.ps1PS11 KB
reflect_decrypt.ps1PS11 KB
p1_reg_kill_copy.ps1PS11 KB
sltest2.ps1PS11 KB
uia_enum.ps1PS11 KB
‹redacted›.csCS1 KB
sltest.ps1PS11 KB
setup.batBAT1 KB
capture8002.ps1PS11 KB
deploy_clean.ps1PS11 KB
reflect_class1.ps1PS11 KB
xclient2_diag.ps1PS11 KB
sltest3.ps1PS11 KB
sltest4.ps1PS11 KB
freshclone.ps1PS11 KB
find_xworm_reg.ps1PS11018 B
diag_state.ps1PS1997 B
probe.ps1PS1988 B
restart_check.ps1PS1954 B
check_net.ps1PS1953 B
ctx_search.ps1PS1930 B
find_client.ps1PS1923 B
setup_lisa.batBAT909 B
diag_standalone.ps1PS1903 B
upd.batBAT899 B
grab_client2.ps1PS1834 B
diag2.ps1PS1830 B
run_inject.ps1PS1828 B
reflect_fields.ps1PS1823 B
slcheck2.ps1PS1771 B
grab_client.ps1PS1760 B
revert_tpm.ps1PS1740 B
xclient2_direct.ps1PS1735 B
dump_full.ps1PS1733 B
p2_relaunch_collect.ps1PS1732 B
upload_v31.ps1PS1681 B
redeploy2.ps1PS1681 B
setup_xworm.batBAT676 B
setup.batBAT656 B
setup_inject.ps1PS1654 B
redeploy_dll3.ps1PS1653 B
redeploy_dll4.ps1PS1653 B
check_session.ps1PS1651 B
cleanup_hijack.ps1PS1647 B
redeploy_force.ps1PS1647 B
diag3.ps1PS1645 B
watchdog.batBAT643 B
pull_webdata.ps1PS1637 B
nettest.ps1PS1632 B
screenshot.ps1PS1632 B
pid2.ps1PS1631 B
poll8002.ps1PS1629 B
poll8002b.ps1PS1606 B
who8002.ps1PS1579 B
finddrop.ps1PS1578 B
check_state.ps1PS1572 B
build.batBAT569 B
check_hvnc_state.ps1PS1541 B
redeploy_dll5.ps1PS1537 B
check_profiles.ps1PS1513 B
chrome_ver.ps1PS1507 B
cleanup_inj.ps1PS1489 B
poller.batBAT451 B
dump_cookies.ps1PS1441 B
deploy_rdp.ps1PS1433 B
np.batBAT398 B
pid.ps1PS1385 B
list_client.ps1PS1370 B
get_abkey.ps1PS1365 B
launch_poller.ps1PS1335 B
check_inj.ps1PS1327 B
count.ps1PS1307 B
diag.batBAT300 B
run_expiry.ps1PS1288 B
check_cdp.ps1PS1272 B
auth.ps1PS1270 B
check_hash.ps1PS1267 B
redeploy_inj.ps1PS1263 B
launch_chrome.batBAT253 B
dl_inject.ps1PS1244 B
hash_shell.ps1PS1244 B
dl_inject_only.ps1PS1240 B
read_abkey.ps1PS1236 B
clean_stale.ps1PS1235 B
launch_chrome.ps1PS1216 B
cdp_check.batBAT212 B
run_panel.batBAT196 B
watchdog.batBAT168 B
configTXT2 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

100.21.82.169confirmed
101.42.136.73confirmed
101.47.156.26confirmed
102.204.222.159confirmed
102.210.149.166confirmed
103.46.185.169confirmed
104.223.41.172confirmed
104.233.150.138confirmed
108.61.219.168confirmed
109.238.87.159confirmed
111.223.247.165confirmed
117.50.80.107confirmed
117.55.226.237confirmed
118.107.13.102confirmed
118.107.41.239confirmed