Live findsCVE IntelResearchConsoleStart free
huntback / IP intelligence

23.149.28.46

RESIDENTIALoperator-submittedioc-tweetfeedloot-ipc2elf-binaryexploit

Intelligence

ASN / OrgAS979 · NetLab Global
CountryUnited States
NetworkRESIDENTIAL · risk 15/100
Threat score0/100
Open ports22, 53, 389, 443, 465, 587, 8000, 8080, 8081, 8443, 18080
JARM3fd3fd20d00000021c43d43d00043d204204071741c36579e355f830d285a5
Loot harvested102 file(s), 1257998 KB · c2, elf-binary, exploit, exposed-secret, forced-loot, gafgyt

Open directory contents (102)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
sliver-server.bakBAK287.4 MB
sliver-serverTXT269.9 MB
sliver-server.bak2BAK2269.9 MB
rockyou.txtTXT133.4 MB
sliver-clientTXT61.7 MB
nuclei.zipZIP44.0 MB
win_svchost.exeEXE16.2 MB
linux_v2TXT15.2 MB
linux_moddedTXT15.2 MB
‹redacted›.min.jsJS15.2 MB
linux_fixedTXT15.2 MB
linux_netdTXT15.2 MB
6bfe5c84-95ef-4453-a444-b2d7724f33b1TXT15.2 MB
linux_arm64TXT11.3 MB
modules_metadata.jsonJSON10.9 MB
c2runELF6.1 MB
sysupdELF6.0 MB
sliver-2026-10-31T16-58-24.703.log.gzGZ3.9 MB
sliver-2026-10-31T19-14-52.943.json.gzGZ2.7 MB
cves.jsonJSON2.1 MB
c2.logLOG1.6 MB
.checksumCHECKS1.4 MB
store.logLOG1.2 MB
templates-checksum.txtTXT1.2 MB
.templates-indexTEMPLA1.1 MB
module_metadata_cache.jsonJSON1018 KB
sliver.dbDB944 KB
sliver.db-walDB-WAL768 KB
ncp.zipZIP590 KB
sliver-2026-11-01T13-01-51.369.json.gzGZ362 KB
TEMPLATES-STATS.jsonJSON318 KB
sliver-client.logLOG259 KB
‹redacted›.sumSUM101 KB
README_JP.mdMD61 KB
README_KR.mdMD60 KB
README_TR.mdMD59 KB
README_ES.mdMD59 KB
README_PT-BR.mdMD59 KB
README_ID.mdMD59 KB
README.mdMD58 KB
README_CN.mdMD58 KB
app.pyPY44 KB
LICENSETXT34 KB
nouns.txtTXT32 KB
sliver.db-shmDB-SHM32 KB
MakefileTXT17 KB
‹redacted›.modMOD16 KB
top2000.txtTXT15 KB
config.yaml15 KB
TEMPLATE-CREATION-GUIDE.mdMD14 KB
findings.pyPY14 KB
go-tests.ps1PS113 KB
TEMPLATE-REVIEW-GUIDE.mdMD12 KB
CONTRIBUTING.mdMD11 KB
adjectives.txtTXT11 KB
go-tests.shSH8 KB
README_JA.mdMD6 KB
README_KR.mdMD6 KB
README_CN.mdMD5 KB
DockerfileTXT3 KB
store.pyPY3 KB
config.yamlYAML2 KB
combined.pemPEM2 KB
ai.yamlYAML2 KB
.new-additionsNEW-AD2 KB
out.txtTXT2 KB
README.mdMD2 KB
CONTRIBUTING.mdMD1 KB
reporting-config.yaml1 KB
seagull.cfgCFG1 KB
key.pemPEM1 KB
PULL_REQUEST_TEMPLATE.mdMD1 KB
spoof-metadata.yamlYAML1 KB
.nuclei-ignore1 KB
LICENSETXT1 KB
theme.yamlYAML1 KB
c2_multi.pyPY1 KB
cert.pemPEM1 KB
framework.logLOG1 KB
c2_listener.pyPY974 B
AGENTS.mdMD906 B
custom_profile.jsonJSON840 B
stealth.jsonJSON812 B
.gitignoreGITIGN770 B
SECURITY.mdMD722 B
ist.logLOG683 B
server.yamlYAML635 B
.templates-config.jsonJSON551 B
go.envENV505 B
tui-settings.yamlYAML483 B
.golangci.ymlYML415 B
persist_tk1333.shSH402 B
persist_tkhonor.shSH402 B
id_ed25519TXT399 B
.dockerignoreDOCKER376 B
.bash_historyBASH_H272 B
database.yamlYAML257 B
historyTXT254 B
provider-config.yaml219 B
crack.yamlYAML92 B
codereview.cfgCFG52 B
versionTXT40 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

103.117.136.137confirmed
110.42.215.163confirmed
139.224.113.180confirmed
143.246.203.114confirmed
157.230.117.70confirmed
157.245.140.34confirmed
169.58.233.110confirmed
172.105.156.153confirmed
176.65.148.59confirmed
190.183.251.210confirmed
2.24.204.250confirmed
207.56.221.47confirmed
213.136.79.115confirmed
217.160.132.82confirmed
38.54.88.171confirmed