Live findsCVE IntelConsoleStart free
huntback / IP intelligence

198.46.158.18

DATACENTERoperator-submittedc2exploitexposed-secretmalwaremozi

Intelligence

ASN / OrgAS36352 · HostPapa
CountryUnited States
NetworkDATACENTER · risk 60/100
Threat score0/100
Open ports22, 80, 8000, 8080, 8888, 9999, 18080, 1080, 3306, 9080, 9090, 9092, 9094, 9443
JARM2ad2ad0002ad2ad22c42d42d000000faabb8fd156aa8b4d8a37853e1063261
Loot harvested362 file(s), 19151 KB · c2, exploit, exposed-secret, malware, mozi, tunnel

Open directory contents (362)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
pos_idx.jsonJSON1.7 MB
graph.yamlYAML579 KB
graph.yamlYAML574 KB
graph.yamlYAML574 KB
graph.yamlYAML567 KB
graph.yamlYAML540 KB
graph.yamlYAML539 KB
graph.yamlYAML504 KB
graph.yamlYAML504 KB
graph.yamlYAML496 KB
graph.yamlYAML496 KB
graph.yamlYAML471 KB
graph.yamlYAML464 KB
graph.yamlYAML454 KB
apidocs_main.jsJS439 KB
graph.yamlYAML433 KB
graph.yamlYAML431 KB
graph.yamlYAML397 KB
i169_lk_wpjson.jsonJSON369 KB
graph.yamlYAML367 KB
graph.yamlYAML329 KB
graph.yamlYAML327 KB
graph.yamlYAML319 KB
graph.yamlYAML302 KB
graph.yamlYAML302 KB
graph.yamlYAML286 KB
graph.yamlYAML277 KB
graph.yamlYAML272 KB
graph.yamlYAML263 KB
graph.yamlYAML254 KB
graph.yamlYAML227 KB
graph.yamlYAML223 KB
graph.yamlYAML218 KB
graph.yamlYAML200 KB
graph.yamlYAML190 KB
oob_9092.logLOG185 KB
sc_255-87552e6e05b8e3aa.jsJS169 KB
255-cb395327542b56ef.jsJS168 KB
261-9d547bf554cee216.jsJS167 KB
graph.yamlYAML162 KB
wordlist_full.txtTXT161 KB
intercept4_events.jsonJSON143 KB
oob_9092.logLOG138 KB
index-kL8zLt1c.jsJS131 KB
graph.yamlYAML124 KB
probe_body.htmlHTML121 KB
chunk-JMJ3UQ3L-C5R2N5JT.jsJS121 KB
graph.yamlYAML110 KB
oob_9094.logLOG104 KB
bbb2.txtTXT83 KB
graph.yamlYAML65 KB
graph.yamlYAML65 KB
store_products.jsonJSON59 KB
PF6pl488_stg.phpPHP58 KB
base.phpPHP58 KB
graph.yamlYAML57 KB
PFEeBTLf888.htmlHTML55 KB
first_party_sets.dbDB48 KB
jsnlog.jsJS46 KB
graph.yamlYAML45 KB
graph.yamlYAML41 KB
dg_cp_login.htmlHTML38 KB
dg_2083.htmlHTML38 KB
i101_final_passwords.txtTXT37 KB
i101_passwords_all.txtTXT37 KB
port8008.htmlHTML34 KB
cj_common.js_v_le8g-3zv0JS_V_L31 KB
‹redacted›.min.jsJS30 KB
cj_purify.min.js_v_le8g-3zv0JS_V_L28 KB
dgl_form.phpPHP28 KB
intercept2_events.jsonJSON28 KB
cj_localizations.js_v_le8g-3zv0JS_V_L27 KB
cj_login.js_v_le8g-3zv0JS_V_L26 KB
c8080b.htmlHTML23 KB
cwp_2083.htmlHTML23 KB
cwp_fresh.htmlHTML23 KB
c2083.htmlHTML23 KB
dgl_form2.phpPHP22 KB
dgl_form3.phpPHP22 KB
dgl_form4.phpPHP22 KB
i108_targeted.txtTXT21 KB
sc_login2.htmlHTML21 KB
login_attempt.txtTXT20 KB
kahi_passwords_base.txtTXT20 KB
s1.htmlHTML20 KB
fuuffy-integration.phpPHP19 KB
‹redacted›.jsonlJSONL19 KB
cj_reqwest.js_v_le8g-3zv0JS_V_L19 KB
bak2.txtTXT18 KB
‹redacted›.min.jsJS16 KB
rsc_login.htmlHTML15 KB
rsc_login2.htmlHTML15 KB
oob_http.logLOG15 KB
wordlist_business.txtTXT15 KB
intercept_interesting.jsonJSON14 KB
resolve_full.logLOG12 KB
‹redacted›.pycPYC11 KB
intercept_req.jsonJSON11 KB
rc.htmlHTML11 KB
checkMobileBeforeSubmit.jsJS11 KB
sc_trav.htmlHTML11 KB
pa_merchant_signin.htmlHTML11 KB
lk_u1.htmlHTML10 KB
i093_wh.htmlHTML10 KB
i101_j_test.htmlHTML10 KB
i093_jessica.htmlHTML10 KB
i093_ez.htmlHTML10 KB
‹redacted›.min.jsJS10 KB
lk_nouser.htmlHTML10 KB
i101_noexist.htmlHTML10 KB
i093_noexist.htmlHTML10 KB
i093_kenny.htmlHTML10 KB
i093_ma.htmlHTML10 KB
i093_login_root.htmlHTML10 KB
oob_9094.logLOG9 KB
cj_store.js_v_le8g-3zv0JS_V_L8 KB
intercept5.pyPY8 KB
kahi_login_debug.htmlHTML8 KB
kc_.htmlHTML8 KB
intercept4.pyPY7 KB
i131_inject.pyPY7 KB
kahi_wplogin.htmlHTML7 KB
cj_apis.jsJS7 KB
mbox_root.htmlHTML7 KB
intercept3.pyPY6 KB
‹redacted›.outOUT6 KB
callbacks.logLOG6 KB
i095_probe.pyPY6 KB
cj_login-inline.jsJS6 KB
i171_coupon_flow.pyPY5 KB
googlepay-new.jsJS5 KB
‹redacted›.pycPYC5 KB
i131_battery1.pyPY5 KB
cj_webauthn.js_v_le8g-3zv0JS_V_L5 KB
cj_alert.js_v_le8g-3zv0JS_V_L5 KB
pa2_processing.phpPHP5 KB
sleek1.txtTXT5 KB
sleek_full.txtTXT4 KB
‹redacted›.sampleSAMPLE4 KB
intercept2.pyPY4 KB
‹redacted›.sampleSAMPLE4 KB
spray_crm.pyPY4 KB
www_challenge.jsJS4 KB
rcpt_full.logLOG4 KB
intercept_download.pyPY4 KB
mint_samples.pyPY4 KB
spray_crm2.logLOG4 KB
i135_smtp_enum.pyPY3 KB
‹redacted›.outOUT3 KB
‹redacted›.outOUT3 KB
i111_steps0to2.logLOG3 KB
‹redacted›.outOUT3 KB
i101_spray_wp.pyPY3 KB
i131_runner.pyPY3 KB
skin22_chain.pyPY3 KB
i105_mc_spray.pyPY3 KB
i089_track.pyPY3 KB
‹redacted›.outOUT3 KB
i162_tor_spray_par.pyPY3 KB
applepay.jsJS3 KB
mail_auth_test.pyPY3 KB
‹redacted›.sampleSAMPLE3 KB
chain_rebuild.pyPY3 KB
i162_tor_spray.pyPY3 KB
‹redacted›.outOUT3 KB
mk_h.htmlHTML3 KB
Local%20StateTXT3 KB
smug2.pyPY3 KB
turnstile_check.pyPY3 KB
i113_enum_users.pyPY2 KB
probe_resin_raw.pyPY2 KB
i118_enum2.pyPY2 KB
i113_enum_users2.pyPY2 KB
create_session.pyPY2 KB
i108_wp_spray.pyPY2 KB
i106_console.logLOG2 KB
i176_fuzz.pyPY2 KB
‹redacted›.sampleSAMPLE2 KB
i118_rcpt_kahi.logLOG2 KB
diag_full.pyPY2 KB
mail_oracle2.pyPY2 KB
i118_enum.pyPY2 KB
i108_targeted_spray.pyPY2 KB
spray_crm2.pyPY2 KB
i131_probe.pyPY2 KB
probe_16606.pyPY2 KB
cj_loader.js_v_le8g-3zv0JS_V_L2 KB
‹redacted›.sampleSAMPLE2 KB
kahi_spray2_tmux.txtTXT2 KB
i171_coupon_flow.logLOG2 KB
i171_order_enum.pyPY2 KB
i175_export_variants.pyPY2 KB
parse_sleek.pyPY2 KB
creditcard-new.jsJS2 KB
rcpt_full.pyPY2 KB
diag1043.pyPY1 KB
i174_sqli.pyPY1 KB
i181_probe.pyPY1 KB
s.binBIN1 KB
AGENTS.mdMD1 KB
‹redacted›.hdrHDR1 KB
probe_dom.pyPY1 KB
cl2.htmlHTML1 KB
probe_export.pyPY1 KB
‹redacted›.headersHEADER1 KB
‹redacted›.headersHEADER1 KB
pos_probe.pyPY1 KB
i174_ipn.pyPY1 KB
bad_body.htmlHTML1 KB
i137_login_bad.txtTXT1 KB
‹redacted›.outOUT1 KB
cl.htmlHTML1 KB
probe_16602_greet.pyPY1 KB
cc_bad.htmlHTML1 KB
login_resp.htmlHTML1 KB
crm_login_resp.htmlHTML1 KB
crm_post_tor.htmlHTML1 KB
liq_body_sqli2.htmlHTML1 KB
liq_body_sqli3.htmlHTML1 KB
i035_probe.pyPY1 KB
actTXT1 KB
i035_smtp_enum.pyPY1 KB
pacing_test2.pyPY1 KB
i124_decode1.jsJS1 KB
bak3.txtTXT1 KB
i174_more.pyPY1 KB
‹redacted›.sampleSAMPLE1 KB
reason_output.jsonJSON1 KB
cvp2.pyPY1 KB
i184_cm_deep.pyPY1 KB
i118_rcpt1.pyPY1 KB
msvc_probe.pyPY1 KB
i174_allparams.pyPY1 KB
i096_conn_test.pyPY1 KB
pacing_test.pyPY1 KB
‹redacted›.sampleSAMPLE1 KB
signin_headers.txtTXT1 KB
i035_enum.pyPY1 KB
smug_probe.pyPY1 KB
i174_uuid_enum.pyPY1 KB
probe3.pyPY1 KB
test_headers.shSH1 KB
i184_probe2.pyPY1 KB
translatepress-multilingual.yamlYAML1 KB
i175_session.pyPY1 KB
i035_proxyconn.pyPY1 KB
i174_proc.pyPY1 KB
i172_enum_test.pyPY1 KB
i105_console.logLOG1 KB
probe_export2.pyPY1 KB
seo-by-rank-math.yamlYAML1 KB
probe_oracle.pyPY1 KB
‹redacted›.sampleSAMPLE1 KB
cwp_probe.pyPY1 KB
elementor.yamlYAML1 KB
wp-file-manager.yamlYAML1 KB
pa_probe.pyPY1 KB
i172_surge_diff.pyPY1 KB
‹redacted›.hdrHDR1 KB
i105_mc_spray.logLOG1 KB
probe_paths.pyPY1 KB
classify_users.pyPY1 KB
signed_api.shSH1 KB
i172_exim_test.pyPY1 KB
i174_baseline.pyPY1 KB
cve44877_test.pyPY1 KB
i035_enum2.pyPY1 KB
banner_test.pyPY1 KB
i171_reg.pyPY1 KB
probe_pull2.shSH1 KB
probe2.pyPY1 KB
diff_fuzz.shSH1 KB
probe_gen.shSH1 KB
i103_highvalue.pyPY1 KB
check_ep.shSH1 KB
rcpt_reset_test.pyPY1 KB
pa_verify_new.pyPY1 KB
i105_oob.logLOG1 KB
i124_solve.pyPY1 KB
i101_supp_passwords.txtTXT1 KB
enum_pull2.pyPY1 KB
check_proxy.pyPY1 KB
listener.pyPY1 KB
i108_targeted.logLOG1 KB
i174_like.pyPY1 KB
i162_oracle_test.pyPY1 KB
www_playwright.pyPY1 KB
i184_probe1.pyPY1 KB
probe_pull.shSH1 KB
fuzz_files.shSH1 KB
probe_ssrf.shSH1021 B
enum_pull.pyPY970 B
cwp_lostpass.pyPY969 B
i175_hdr.pyPY962 B
fuzz_files2.shSH945 B
i175_probe.pyPY934 B
i162_parallel_test.pyPY924 B
probe_pull3.shSH918 B
‹redacted›.sampleSAMPLE896 B
pos_probe.shSH856 B
fixpath_probe.shSH837 B
oracle_check_i099.pyPY806 B
i176_wl_admin.txtTXT797 B
i170_probe.shSH784 B
i162_speed_test.pyPY782 B
probe_pull4.shSH756 B
probe_pull5.shSH754 B
cj_loader2.js_v_le8g-3zv0JS_V_L747 B
mysql_user_oracle.pyPY739 B
do_portscan.pyPY659 B
oob9096_i009.logLOG643 B
i162_tor_spray_par.logLOG641 B
i103_account_oracle.pyPY605 B
probe_params.shSH600 B
probe_processing.shSH593 B
i070_test_endpoints.shSH589 B
sign_get.shSH567 B
‹redacted›.sampleSAMPLE544 B
retest_fwd.pyPY532 B
probe_i095.shSH509 B
oracle_test.pyPY492 B
‹redacted›.sampleSAMPLE478 B
check_direct.pyPY478 B
i176_wl_adminphp.txtTXT477 B
‹redacted›.sampleSAMPLE424 B
i180_qtrans.jsonJSON422 B
‹redacted›.outOUT422 B
query_transaction.jsonJSON422 B
‹redacted›.sampleSAMPLE416 B
decode_jwt.pyPY355 B
gpay_config.jsonJSON318 B
i180_gpay.jsonJSON318 B
gpay_pay.jsonJSON300 B
cj_password-rules.js_v_le8g-3zv0JS_V_L256 B
i170_apppass.jsonJSON252 B
i180_gpay_notoken.jsonJSON243 B
i180_qtrans_notoken.jsonJSON243 B
i181_payresp.htmlHTML243 B
pay_fake_resp.txtTXT243 B
pay_resp1.htmlHTML243 B
excludeTXT240 B
changelang.jsonJSON235 B
i105_oob9096.logLOG209 B
crm_config.php.bakBAK199 B
bf.binBIN196 B
‹redacted›.sampleSAMPLE189 B
nc_9093.logLOG162 B
i162_tor_spray.logLOG151 B
‹redacted›.jarTXT131 B
‹redacted›.config.jsonJSON110 B
i170_elem_integrations.jsonJSON101 B
configTXT92 B
fwd16602.logLOG78 B
mfwd3307.logLOG75 B
descriptionTXT73 B
pa2_pull_result.phpPHP38 B
i.binBIN26 B
HEADTXT23 B
pa2_start.phpPHP19 B
sh.binBIN16 B
crm_export.phpPHP9 B
configTXT2 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

101.36.112.205confirmed
103.131.51.199confirmed
103.163.246.138confirmed
103.39.79.102confirmed
103.73.189.190confirmed
104.160.169.204confirmed
104.21.23.192confirmed
107.189.1.175confirmed
109.122.196.145confirmed
111.223.247.165confirmed
114.80.34.158confirmed
115.29.202.62confirmed
117.196.219.39confirmed
118.25.25.81confirmed
122.166.178.204confirmed