Live findsCVE IntelResearchConsoleStart free
huntback / IP intelligence

206.189.167.156

DATACENTERoperator-submittedc2elf-binaryexploitexposed-secretmalware

Intelligence

ASN / OrgAS14061 · DigitalOcean, LLC
CountryUnited States
NetworkDATACENTER · risk 60/100
Threat score0/100
Open ports22, 443, 8099, 9443, 8443, 7222, 7223, 7224, 7225, 7226, 7227, 7228, 7229, 8102, 9913
Loot harvested326 file(s), 34374 KB · c2, elf-binary, exploit, exposed-secret, malware, mozi

Open directory contents (326)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
ssrf.logLOG5.6 MB
err.logLOG5.6 MB
calibration-safe.binBIN5.5 MB
template-position.binBIN5.5 MB
inc_main.jsJS2.6 MB
cmp.jsonJSON2.0 MB
libc.so.6ELF1.9 MB
a1.binBIN1.0 MB
ces_emails.txtTXT856 KB
apache2ELF724 KB
wp_cron.logLOG359 KB
sqlprov.phpPHP302 KB
oTXT175 KB
ghsa.htmlHTML141 KB
changelog.mdMD91 KB
php2shell_test_v2.pyPY71 KB
php2shell_test.pyPY49 KB
bombchain.pyPY45 KB
‹redacted›.pycPYC41 KB
qb.phpPHP39 KB
php2shell_stock_poc.pyPY37 KB
cve_2026_116512.pyPY36 KB
E2E-TOOL.mdMD32 KB
lexfo.htmlHTML31 KB
fm.phpPHP28 KB
cve_2026_119977_mass.pyPY26 KB
reproduce.pyPY26 KB
enr_form.htmlHTML25 KB
SCREENING.mdMD23 KB
commits.jsonJSON19 KB
PHP72-CHAIN.mdMD18 KB
php.logLOG18 KB
RELEASE-RECONCILIATION-2026-10-21.mdMD18 KB
cmm_main.phpPHP17 KB
README.mdMD17 KB
nb_send.pyPY16 KB
jwt_candidates.jsonJSON15 KB
ic_auth.htmlHTML15 KB
ic_home.htmlHTML15 KB
login.htmlHTML15 KB
test_graded_screen.pyPY15 KB
picedit_portal_enrollment_edit.htmlHTML15 KB
fofa_wp_vuln.txtTXT14 KB
php2shell_stock_chain.pyPY12 KB
php2shell_aslr_stock.pyPY11 KB
l.htmlHTML11 KB
domain_php2shell_scan.pyPY10 KB
‹redacted›.gdbGDB9 KB
mega-menu-walker.phpPHP9 KB
STOCK-CHAIN.mdMD9 KB
nb_leak.pyPY9 KB
picedit_portal_enrollment_pic_edit.htmlHTML8 KB
picedit_portal_enrollment_pic_edit_index.php.htmlHTML8 KB
ECOSYSTEM-ADVISORY.mdMD8 KB
build_body.pyPY7 KB
schema.jsonJSON7 KB
PUBLIC-CONTEXT-2026-10-21.mdMD6 KB
README.mdMD6 KB
ASLR-STOCK.mdMD6 KB
nb_pure.pyPY6 KB
php2shell_stock_b.pyPY6 KB
wp_poller.pyPY5 KB
php2shell_worker_saturation.pyPY5 KB
WAF-BYPASS.mdMD5 KB
ECOSYSTEM-UPDATE-2026-10-30.mdMD4 KB
up3.pyPY4 KB
test_builders.pyPY4 KB
dt.pyPY4 KB
bisekt_oracle_vps.pyPY4 KB
ut.pyPY4 KB
tg.pyPY4 KB
wd.pyPY4 KB
gdb_trace.pyPY4 KB
iso.pyPY3 KB
REPRODUCTION.mdMD3 KB
generate_template.pyPY3 KB
rce.pyPY3 KB
ajaxsearch.phpPHP3 KB
drive_peek.pyPY3 KB
nb_trial.shSH3 KB
drive_stock.pyPY3 KB
one2.pyPY3 KB
priv.pyPY3 KB
resolve_zif.pyPY3 KB
ch.pyPY3 KB
tables2.pyPY3 KB
nb_fire.shSH3 KB
up1.pyPY3 KB
make_manifest.pyPY3 KB
p_dbg.txtTXT3 KB
NINEBIE-CLASS-PORT.mdMD3 KB
calibrate_series.pyPY3 KB
lean_scan.pyPY3 KB
tables.pyPY3 KB
PUBLIC-RELEASE-CHECKLIST.mdMD3 KB
ext.pyPY3 KB
f2.pyPY3 KB
pc.pyPY3 KB
ces_login_test.pyPY2 KB
p_stock.txtTXT2 KB
pc2.pyPY2 KB
shund_solve.pyPY2 KB
peek_worker.pyPY2 KB
‹redacted›.jarJAR2 KB
lab-up.shSH2 KB
‹redacted›.jarJAR2 KB
enum_actions.pyPY2 KB
seq.pyPY2 KB
END-TO-END.mdMD2 KB
post_sig.pyPY2 KB
sp.pyPY2 KB
ef.pyPY2 KB
post_sqli.pyPY2 KB
php2shell_stock_run.shSH2 KB
enum_sig.pyPY2 KB
ef2.pyPY2 KB
nb_env.pyPY2 KB
cpd.pyPY2 KB
lhh_deploy3.pyPY2 KB
orig.pyPY2 KB
o2.pyPY2 KB
js.pyPY2 KB
r2.pyPY2 KB
CLOUDFLARE-FEEDBACK.mdMD2 KB
repro.logLOG2 KB
r3.pyPY1 KB
pe.pyPY1 KB
ces_login2.pyPY1 KB
VALIDATION.mdMD1 KB
sqli_probe.pyPY1 KB
lhh_clean.pyPY1 KB
al2.pyPY1 KB
cpl.pyPY1 KB
probe.pyPY1 KB
enumctrl.pyPY1 KB
gdb_probe.pyPY1 KB
shund_pipe.pyPY1 KB
parse_leak.pyPY1 KB
fd.pyPY1 KB
scan_php.pyPY1 KB
t9.shSH1 KB
lhh_ct.pyPY1 KB
shund_warm.pyPY1 KB
compare_template.pyPY1 KB
os.pyPY1 KB
dns2.pyPY1 KB
byp2.shSH1 KB
verify_run.pyPY1 KB
lhh_chk.pyPY1 KB
lhh_chain.pyPY1 KB
osv.jsonJSON1 KB
lhh_wafmap.pyPY1 KB
PROOF-BOUNDARY.mdMD1 KB
lm.pyPY1 KB
lhh_stub.pyPY1 KB
osm_scan.pyPY1 KB
ot.pyPY1 KB
lhh_tag.pyPY1 KB
dbg.pyPY1 KB
upload_test.pyPY1 KB
cms.pyPY1 KB
calib.shSH1 KB
lhh_fix.pyPY1 KB
my.pyPY1 KB
lhh_deploy2.pyPY1 KB
sd.pyPY1 KB
dnsmap.pyPY1 KB
parse_pages.pyPY1 KB
fire2.shSH1 KB
efull.pyPY1 KB
bien.shSH1 KB
t5.shSH1 KB
usp.shSH1 KB
calibration-safe.bin.jsonJSON1 KB
advq.shSH1 KB
ssi.shSH1 KB
lhh_ladder.pyPY1 KB
fire.shSH1 KB
spray_glpi.shSH1 KB
ident.shSH1 KB
t10.shSH1 KB
xxe.pyPY1 KB
glpi_search2.shSH1 KB
osm.logLOG1 KB
iclogin.pyPY1 KB
bypass.shSH1 KB
menu.pyPY1 KB
crud.shSH1 KB
gen2.shSH1 KB
xxe.logLOG1 KB
fp.shSH1 KB
gdb3.shSH1 KB
up1.shSH1 KB
obs.logLOG1 KB
fetch_enrol.pyPY1017 B
av.shSH1015 B
rpt_test.shSH1009 B
up3.shSH1006 B
proj.shSH1001 B
t7.shSH996 B
wp_enum2.shSH985 B
recheck.shSH982 B
spray_glpi2.shSH980 B
preflight.shSH975 B
usp2.shSH972 B
t29.pyPY965 B
spray_wp.shSH963 B
rs_handler.pyPY956 B
upext.shSH953 B
probe2.shSH948 B
glpi_itemtype.shSH912 B
enum_actions2.pyPY906 B
glpi_sqltest.shSH906 B
test_scan.pyPY906 B
glpi_rack.shSH896 B
info.phpPHP888 B
genprobe.shSH868 B
wp_enum.shSH865 B
t8.shSH843 B
fetch_cmm.shSH824 B
sw6.shSH822 B
fmt.shSH818 B
rs2.pyPY815 B
sw2.shSH809 B
sw5.shSH809 B
glpi_srch.shSH799 B
gdb1.shSH793 B
sw4.shSH775 B
glpi_fuzzy.shSH765 B
lab-reset.shSH762 B
audit_cmm.shSH758 B
wp_ver.shSH736 B
advq2.shSH733 B
t3.shSH729 B
SECURITY.mdMD725 B
glpi_ver2.shSH721 B
glpi_ver3.shSH721 B
probe_onprem.shSH715 B
up2.shSH704 B
trav.shSH697 B
sweep3.shSH694 B
maps.shSH693 B
glpi_fz2.shSH692 B
warm.shSH643 B
token_access.txtTXT620 B
glpi_upd.shSH619 B
groq_gen2.shSH615 B
ea3.shSH613 B
groq_gen.shSH603 B
sw3.shSH590 B
plesk.shSH589 B
gen_swag.shSH579 B
‹redacted›.jarJAR571 B
probe_ces.shSH563 B
echo.pyPY556 B
glpi_install.shSH553 B
‹redacted›.jarJAR537 B
‹redacted›.jarJAR537 B
‹redacted›.jarJAR537 B
‹redacted›.jarJAR537 B
glpi_ver.shSH532 B
sweep.shSH503 B
exout.txtTXT492 B
lab-stop.shSH477 B
rawlisten.pyPY471 B
t4.shSH471 B
glpi_faqep.shSH470 B
audit2.shSH467 B
drive_stock.logLOG458 B
lab-status.shSH451 B
gdb2.shSH439 B
lean_out.txtTXT429 B
sw_file.pyPY422 B
glpi_faq.shSH416 B
‹redacted›.jarJAR415 B
passlist.txtTXT398 B
gdbtest.shSH395 B
obs_host.shSH385 B
ht.binBIN384 B
ht.binBIN384 B
ht.binBIN384 B
ht.binBIN384 B
ht.binBIN384 B
ht.binBIN384 B
ht.binBIN384 B
ht.binBIN384 B
ht.binBIN384 B
ht.binBIN384 B
router.phpPHP383 B
t1.shSH373 B
constants.shSH369 B
scan_workers.shSH357 B
exec1.shSH349 B
run_mass.shSH343 B
token_jwt.txtTXT325 B
t6.shSH311 B
redir.pyPY305 B
configTXT284 B
t2.shSH255 B
groq_check.shSH251 B
mass_stdout.txtTXT245 B
launch_poller.shSH243 B
e2e.shSH227 B
tables2.logLOG209 B
lhh_shell.txtTXT182 B
reproduce.shSH174 B
‹redacted›.configCONFIG169 B
rl_8443.logLOG165 B
run_chainb.shSH151 B
.gitignoreGITIGN124 B
tables.logLOG113 B
packed-refsTXT112 B
.gitattributesGITATT101 B
‹redacted›.aspxASPX93 B
descriptionTXT73 B
rl_443.logLOG69 B
‹redacted›.aspxASPX63 B
‹redacted›.aspxASPX61 B
‹redacted›.aspxASPX60 B
sw5.logLOG48 B
shallowTXT41 B
ssrf_pdf.logLOG26 B
HEADTXT21 B
mhx.txtTXT19 B
index.phpPHP18 B
cmm.zipZIP9 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

1.234.83.89confirmed
101.36.112.205confirmed
102.209.224.40confirmed
103.131.51.199confirmed
103.133.216.219confirmed
103.195.188.128confirmed
103.254.63.94confirmed
103.35.216.13confirmed
104.192.42.94confirmed
104.200.73.97confirmed
104.223.62.197confirmed
106.52.174.151confirmed
107.150.20.139confirmed
107.191.102.241confirmed
107.191.113.100confirmed