Live findsCVE IntelResearchConsoleStart free
huntback / IP intelligence

209.38.235.232

DATACENTERoperator-submittedloot-ipc2elf-binaryexploitexposed-secret

Intelligence

ASN / OrgAS14061 · DigitalOcean, LLC
CountryGermany
NetworkDATACENTER · risk 60/100
Threat score0/100
Open ports22, 80, 443, 9999, 6080, 18789
Loot harvested118 file(s), 250883 KB · c2, elf-binary, exploit, exposed-secret, forced-loot, gafgyt

Open directory contents (118)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
database-20260608T090547.sqliteSQLITE164.9 MB
state.dbDB51.4 MB
gateway.log.225.0 MB
agent.log.335.0 MB
agent.log.225.0 MB
models_dev_cache.jsonJSON4.7 MB
gateway.logLOG2.8 MB
agent.logLOG1.4 MB
database.sqliteSQLITE948 KB
errors.logLOG507 KB
request_dump_20260608_141622_36041d_20260608_162502_594571.jsonJSON467 KB
request_dump_20260615_073112_ba8112ed_20260615_075356_973707.jsonJSON448 KB
uvxELF340 KB
Local%20StateTXT188 KB
request_dump_20260608_162553_8669a8_20260608_162554_282801.jsonJSON128 KB
request_dump_20260615_093750_4403e1_20260615_094040_228960.jsonJSON104 KB
request_dump_20260615_093750_4403e1_20260615_093948_077419.jsonJSON104 KB
kanban.dbDB104 KB
rfb.jsJS103 KB
tig-brand-gap-update-before-20260528T091254Z.jsonJSON88 KB
tig-workflows-before-credential-swap-20260528T081758Z.jsonJSON76 KB
uaa-before-credential-and-active-history-sync-20260528T093207Z.jsonJSON76 KB
first_party_sets.dbDB68 KB
.org.chromium.Chromium.YxDb4cYXDB4C60 KB
.com.google.Chrome.HdHtJsHDHTJS59 KB
config.yaml.bak.20260528_07343720260559 KB
ui.jsJS56 KB
tig-write-article-node-before-explicit-style-rules-20260528T084628Z.jsonJSON52 KB
tig-article-prompts-before-language-update-20260528T084318Z.jsonJSON42 KB
uaa01-before-dedup-dataflow-fix-20260528T103312Z.jsonJSON42 KB
byline-marketing-full-kit.tar.gzGZ41 KB
tig-article-writing-articletext-fix-before-20260528T180930Z.jsonJSON37 KB
registry.sqlite-walSQLITE36 KB
tig-article-title-source-rule-before-20260528T153145Z.jsonJSON35 KB
tig-prompt-audit-current.mdMD35 KB
byline-leads-seg1-founders.csvCSV33 KB
keysym.jsJS33 KB
tig-article-writing-brief-json-cleanup-before-20260528T144157Z.jsonJSON33 KB
database-20260608T090547.sqlite-shmSQLITE32 KB
registry.sqlite-shmSQLITE32 KB
tig-article-writing-category-propagation-before-20260528T142453Z.jsonJSON31 KB
4WtheoYKzTCnw0nc-before-token-completion-guard-20260528T150808Z.jsonJSON30 KB
tig-social-dataflow-fix-before-20260528T111725Z.jsonJSON30 KB
tig-social-sheet-marker-fix-before-20260528T110228Z.jsonJSON29 KB
uaa02-before-restore-known-good-active-history-20260528T103133Z.jsonJSON29 KB
tig-social-openai-credential-body-fix-before-20260528T104647Z.jsonJSON29 KB
tig-wf4-reenable-controlled-images-before-20260528T142842Z.jsonJSON20 KB
byline-cold-email-kit.mdMD19 KB
byline-leads-seg2-agencies.csvCSV19 KB
byline-affiliate-kit.mdMD17 KB
display.jsJS15 KB
tig-social-before-pause-and-rework-20260528T114610Z.jsonJSON15 KB
vnc.htmlHTML14 KB
byline-30-day-launch-strategy.mdMD14 KB
byline-instantly-architecture.mdMD13 KB
config.yamlYAML12 KB
tig-wp-publishing-category-fallback-before-20260528T142453Z.jsonJSON11 KB
tig-wp-publishing-before-disable-auto-featured-image-20260528T115116Z.jsonJSON11 KB
openclaw.json.bak.4411 KB
openclaw.json.bak.3311 KB
openclaw.json.bakBAK11 KB
openclaw.json.bak.1111 KB
openclaw.json.bak.2211 KB
openclaw.jsonJSON11 KB
des.jsJS10 KB
tig-ingestion-categorization-before-20260528T142453Z.jsonJSON10 KB
websock.jsJS10 KB
gateway-shutdown-diag.logLOG8 KB
openclaw.json.clobbered.2026-04-20T18-10-46-922Z2026-07 KB
auth.jsonJSON6 KB
novnc_proxyTXT6 KB
vnc_lite.htmlHTML6 KB
util.jsJS5 KB
.usage.jsonJSON5 KB
webutil.jsJS5 KB
tig-auto-image-plugin-before-controlled-fallback-20260528.phpPHP4 KB
base64.jsJS4 KB
registry.sqliteSQLITE4 KB
jobs.json.bakBAK3 KB
jobs.jsonJSON3 KB
el.jsonJSON3 KB
ru.jsonJSON3 KB
.bash_historyBASH_H3 KB
ja.jsonJSON3 KB
gateway-exit-diag.logLOG3 KB
nl.jsonJSON2 KB
fr.jsonJSON2 KB
ko.jsonJSON2 KB
cs.jsonJSON2 KB
pt_BR.jsonJSON2 KB
de.jsonJSON2 KB
pl.jsonJSON2 KB
tr.jsonJSON2 KB
sv.jsonJSON2 KB
es.jsonJSON2 KB
zh_CN.jsonJSON2 KB
zh_TW.jsonJSON2 KB
MEMORY.mdMD2 KB
channel_directory.jsonJSON1 KB
processes.jsonJSON1 KB
google_token.jsonJSON1 KB
google-drive-token.jsonJSON1003 B
update.logLOG966 B
tig-auto-image-plugin-before-site-polish-20260528T1443Z.phpPHP546 B
google_client_secret.jsonJSON470 B
device.jsonJSON416 B
google-client-secret.jsonJSON408 B
b64-to-binary.plPL392 B
.curator_stateCURATO341 B
discord-pairing.jsonJSON323 B
telegram-pairing.jsonJSON318 B
CREDITSTXT157 B
.envENV93 B
.gitconfigGITCON85 B
.token_seedTOKEN_74 B
configTXT56 B
auth-profile-secret-keyTXT44 B
passwdTXT8 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

101.35.210.248confirmed
101.43.25.15confirmed
122.166.178.204confirmed
154.12.86.207confirmed
172.105.156.153confirmed
34.22.116.191confirmed
38.224.162.188confirmed
38.76.199.210confirmed
38.97.253.252confirmed
39.99.242.80confirmed
47.96.255.147confirmed
51.159.184.76confirmed
64.20.61.134confirmed
8.212.181.6confirmed