Live findsCVE IntelResearchConsoleStart free
huntback / IP intelligence

202.95.17.200

DATACENTERoperator-submittedc2exploitexposed-secretmalwaremozi

Intelligence

ASN / OrgAS152194 · CTG Server Limited
CountrySingapore
NetworkDATACENTER · risk 60/100
Threat score0/100
Open ports22, 8088, 18080, 18081
ServiceSimpleHTTP/0.6 Python/3.13.5 · Directory listing for /
Loot harvested104 file(s), 10365 KB · c2, exploit, exposed-secret, malware, mozi, tunnel

Open directory contents (104)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
ep227.tgzTGZ4.7 MB
httpd.logLOG4.2 MB
f015TXT546 KB
adv.jsonJSON200 KB
CHANGELOG.mdMD67 KB
lpm.tgzTGZ52 KB
‹redacted›.tsTS31 KB
f000TXT25 KB
docker.mdMD23 KB
‹redacted›.templateTEMPLA23 KB
‹redacted›.adocADOC14 KB
README.mdMD13 KB
‹redacted›.tmpTMP13 KB
README.mdMD12 KB
tsconfig.jsonJSON11 KB
alm2.htmlHTML11 KB
tg_aa.htmlHTML10 KB
p4_wp-login.phpPHP8 KB
createRelease.shSH7 KB
environ.txtTXT7 KB
dnslytics.htmlHTML6 KB
cookies.mdMD6 KB
.travis.ymlYML5 KB
alm.htmlHTML4 KB
l2.htmlHTML4 KB
p4__xmlrpc.phpPHP4 KB
p4_xmlrpc.phpPHP4 KB
p4_XMLRPC.PHPPHP4 KB
p4_xmlrpc.php_PHP_4 KB
p4_xmlrpc.php_x_1PHP_X_4 KB
‹redacted›.tmpTMP4 KB
w1.htmlHTML4 KB
xmlrpc_get.txtTXT4 KB
‹redacted›.tmpTMP4 KB
‹redacted›.emlEML3 KB
‹redacted›.adocADOC2 KB
‹redacted›.dev.ymlYML2 KB
settings.jsonJSON2 KB
‹redacted›.tsTS2 KB
login.htmlHTML2 KB
‹redacted›.tsTS2 KB
buildForWindows.shSH2 KB
‹redacted›.tsTS2 KB
‹redacted›.adocADOC2 KB
mt.pyPY1 KB
functions.shSH1 KB
docker-compose.ymlYML1 KB
fetch3.shSH1 KB
safeRun.shSH1 KB
f.pyPY1 KB
‹redacted›.tmpTMP1 KB
alm3.shSH1 KB
sendmail.shSH1 KB
mail2.shSH1 KB
‹redacted›.tsTS1 KB
installDeps.shSH1 KB
probe5.shSH1 KB
run.shSH1 KB
‹redacted›.configCONFIG1 KB
fetch2.shSH1 KB
fetch.shSH1 KB
tsconfig.jsonJSON1 KB
buildDebian.shSH1 KB
probe4.shSH1011 B
f014TXT985 B
k123.shSH979 B
installOnWindows.batBAT979 B
ports.shSH957 B
rest.shSH919 B
p4_xmlrpc.php_2fPHP_2F915 B
cleanRun.shSH896 B
‹redacted›.tsTS889 B
verify.shSH833 B
.env.dev.defaultDEFAUL765 B
.env.defaultDEFAUL703 B
debugRun.shSH700 B
ctrl.shSH697 B
start.batBAT667 B
wb_token.jsonJSON664 B
fastRun.shSH656 B
hostprobe.shSH616 B
‹redacted›.tmpTMP529 B
resp_aa_TXT529 B
tsconfig.jsonJSON527 B
mail_creds.jsonJSON466 B
tsconfig.jsonJSON444 B
push-after-release.shSH437 B
.gitignoreGITIGN433 B
beacon.htmlHTML391 B
nmap.logLOG365 B
f3.pyPY330 B
v1.pyPY322 B
f4.pyPY298 B
.editorconfigEDITOR292 B
updatePlugins.shSH266 B
.gitignoreGITIGN253 B
cred.pyPY217 B
api1.pyPY204 B
adm.pyPY175 B
‹redacted›.templateTEMPLA158 B
‹redacted›.tsTS144 B
.gitignoreGITIGN61 B
.gitignoreGITIGN22 B
.gitattributesGITATT19 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

13.215.184.109confirmed
172.105.156.153confirmed
49.234.49.58confirmed
54.158.237.206confirmed
151.243.11.240lead
151.243.11.241lead
159.223.40.78lead
185.216.68.66lead
194.55.166.170lead
204.168.131.234lead
209.99.191.184lead
217.142.239.53lead
23.27.25.75lead
38.60.91.186lead
46.250.255.73lead