Live findsCVE IntelConsoleStart free
huntback / IP intelligence

198.23.209.17

DATACENTERoperator-submittedloot-ipc2elf-binaryexploitexposed-secret

Intelligence

ASN / OrgAS36352 · HostPapa
CountryUnited States
NetworkDATACENTER · risk 60/100
Threat score0/100
Open ports22, 80, 443, 8081, 8090, 8888, 18080
Servicenginx/1.24.0 (Ubuntu) · ZK-FAKE-SRC
Productsnginx
JARM27d40d40d00040d00042d43d0000007d20e9b9a3e87aa1ec17cb4d646ce9a5
Loot harvested135 file(s), 18760 KB · c2, elf-binary, exploit, exposed-secret, macho-binary, malware

Open directory contents (135)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
http8081.logLOG7.1 MB
‹redacted›.jarJAR3.4 MB
‹redacted›.jarJAR3.0 MB
‹redacted›.jarJAR2.2 MB
‹redacted›.jarJAR561 KB
‹redacted›.jarJAR398 KB
‹redacted›.jarJAR252 KB
‹redacted›.jarJAR240 KB
result.txtTXT198 KB
unpack200ELF186 KB
hits.logLOG166 KB
‹redacted›.jarJAR159 KB
http.logLOG37 KB
jexecELF22 KB
jawt.hH9 KB
orbdELF8 KB
tnameservELF8 KB
jinfoELF8 KB
jmapELF8 KB
jstackELF8 KB
jconsoleELF8 KB
clhsdbELF8 KB
hsdbELF8 KB
jdbELF8 KB
jsadebugdELF8 KB
appletviewerELF8 KB
jrunscriptELF8 KB
native2asciiELF8 KB
policytoolELF8 KB
rmiregistryELF8 KB
servertoolELF8 KB
extcheckELF8 KB
idljELF8 KB
jarELF8 KB
jarsignerELF8 KB
javacELF8 KB
javadocELF8 KB
javahELF8 KB
javapELF8 KB
jcmdELF8 KB
jdepsELF8 KB
jfrELF8 KB
jhatELF8 KB
jjsELF8 KB
jpsELF8 KB
jstatELF8 KB
jstatdELF8 KB
keytoolELF8 KB
pack200ELF8 KB
rmicELF8 KB
rmidELF8 KB
schemagenELF8 KB
serialverELF8 KB
wsgenELF8 KB
wsimportELF8 KB
xjcELF8 KB
javaELF8 KB
‹redacted›.outOUT5 KB
ldap2.pyPY5 KB
‹redacted›.serSER4 KB
rogue_ldap.pyPY4 KB
el_r1.txtTXT2 KB
el_rce.txtTXT2 KB
el_a6.txtTXT2 KB
el_r7.txtTXT2 KB
el_r2.txtTXT2 KB
el_rce3.txtTXT2 KB
el_a9.txtTXT2 KB
el_r10.txtTXT2 KB
el_r9.txtTXT2 KB
el_r4.txtTXT2 KB
el_a8.txtTXT2 KB
el_r3.txtTXT2 KB
‹redacted›.classMACHO2 KB
el_r8.txtTXT2 KB
el_r12.txtTXT2 KB
‹redacted›.classMACHO2 KB
‹redacted›.classMACHO2 KB
el_rce2.txtTXT2 KB
‹redacted›.classMACHO2 KB
el_r5.txtTXT2 KB
agent.shSH2 KB
‹redacted›.classMACHO2 KB
c2_server.pyPY1 KB
el_a7.txtTXT1 KB
el_r11.txtTXT1 KB
‹redacted›.classMACHO1 KB
el_a5.txtTXT1 KB
el_r6.txtTXT1 KB
‹redacted›.classMACHO1 KB
el_r13.txtTXT1 KB
el_r14.txtTXT1 KB
el_a4.txtTXT1 KB
start2.logLOG1 KB
‹redacted›.outOUT1 KB
‹redacted›.classMACHO1 KB
el_a10.txtTXT1 KB
el_a11.txtTXT1 KB
‹redacted›.javaJAVA1 KB
‹redacted›.classMACHO1 KB
probe.pyPY1 KB
‹redacted›.javaJAVA965 B
eltest.txtTXT956 B
‹redacted›.errERR906 B
‹redacted›.javaJAVA829 B
listen.pyPY791 B
listen2.pyPY757 B
start.shSH659 B
start3.shSH454 B
s_r1.shSH440 B
s_a10.shSH372 B
s_a11.shSH372 B
s4.shSH370 B
s_a4.shSH370 B
s_a5.shSH370 B
s_a6.shSH370 B
s_a7.shSH370 B
s_a8.shSH370 B
s_a9.shSH370 B
start.logLOG342 B
nc4444.logLOG312 B
start2.shSH306 B
start3.logLOG227 B
el_tmpl.txtTXT198 B
‹redacted›.outOUT188 B
el_a.txtTXT162 B
‹redacted›.outOUT155 B
el.txtTXT129 B
nc1099.logLOG75 B
credentialsTXT54 B
configTXT49 B
config.jsonJSON49 B
phpinfo.phpPHP49 B
HEADTXT47 B
.envENV42 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

124.220.164.14confirmed
198.44.46.122confirmed
8.138.166.206confirmed
102.213.181.90lead
103.117.148.247lead
103.118.245.63lead
103.127.98.10lead
103.142.25.154lead
103.146.23.195lead
103.175.219.40lead
103.180.134.215lead
103.85.59.78lead
107.155.87.214lead
109.122.196.126lead
109.122.196.95lead