huntback / IP intelligence
2.26.229.254
Intelligence
ASN / OrgAS215439 · PLAY2GO INTERNATIONAL LIMITED
CountryGermany
NetworkRESIDENTIAL · risk 15/100
Threat score0/100
Open ports22, 80, 443, 4321, 7000
Loot harvested43 file(s), 33964 KB · adaptix, c2, coinminer, elf-binary, exposed-secret, malware
Open directory contents (43)
Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.
| File | Type | Size |
|---|---|---|
| svchost.exe | PE | 6.2 MB |
| timesync.bin | ELF | 6.1 MB |
| PSTools.zip | ZIP | 5.0 MB |
| ms11-080.exe | PE | 4.2 MB |
| OpenSSH-Win64.zip | ZIP | 4.2 MB |
| ms11-080-AddUser.exe | PE | 3.6 MB |
| xmrig.zip | ZIP | 2.6 MB |
| nssm.exe | PE | 323 KB |
| http-server.log | LOG | 252 KB |
| MS11_80_k8.exe | PE | 168 KB |
| agent.x64_long_haul.exe | PE | 102 KB |
| dllhost.exe | PE | 102 KB |
| svhost.exe | PE | 102 KB |
| agent.x64.bin | BIN | 101 KB |
| lock.7z | 7Z | 47 KB |
| nyx.ps1 | PS1 | 39 KB |
| phoenix_installer.bat | BAT | 26 KB |
| ‹redacted›.sys | PE | 14 KB |
| .monero_install.bat.swp | SWP | 12 KB |
| monero_install.ps1 | PS1 | 9 KB |
| install.sh | SH | 7 KB |
| deploy_imlants.ps1 | PS1 | 5 KB |
| nyx_run.ps1 | PS1 | 4 KB |
| diag_watchdog.ps1 | PS1 | 3 KB |
| diag_binary_check.ps1 | PS1 | 2 KB |
| diag_wmi.ps1 | PS1 | 2 KB |
| config.json | JSON | 2 KB |
| deploy_imlants.bat | BAT | 2 KB |
| load_sc.ps1 | PS1 | 2 KB |
| diag_boot.ps1 | PS1 | 2 KB |
| diag_hub.ps1 | PS1 | 1 KB |
| monero_install.bat | BAT | 1 KB |
| ‹redacted›.cmd | CMD | 1 KB |
| diag_folder_check.ps1 | PS1 | 1 KB |
| ‹redacted›.cmd | CMD | 1023 B |
| ‹redacted›.cmd | CMD | 887 B |
| ‹redacted›.cmd | CMD | 821 B |
| SHA256SUMS | TXT | 748 B |
| nyx.bat | BAT | 406 B |
| timesync.bat | BAT | 78 B |
| ‹redacted›.cmd | CMD | 77 B |
| ‹redacted›.cmd | CMD | 61 B |
| ‹redacted›.cmd | CMD | 60 B |
Hunt this IP
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting freeRelated infrastructure
Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.
| 121.36.206.152 | confirmed |
| 176.103.62.56 | confirmed |
| 190.84.232.232 | confirmed |
| 38.60.227.210 | confirmed |
| 45.151.122.34 | confirmed |
| 89.36.231.178 | confirmed |
| 1.14.93.149 | lead |
| 1.15.114.102 | lead |
| 101.32.108.79 | lead |
| 101.36.118.185 | lead |
| 101.47.134.222 | lead |
| 101.47.15.229 | lead |
| 102.203.200.45 | lead |
| 102.68.86.43 | lead |
| 103.111.114.29 | lead |