Live findsCVE IntelResearchConsoleStart free
huntback / IP intelligence

23.19.231.52

DATACENTERexploitoperator-submittedloot-ipc2coinminerelf-binary

Intelligence

ASN / OrgAS395954 · Leaseweb USA, Inc.
CountryUnited States
NetworkDATACENTER · risk 60/100
Threat score85/100
Open ports22, 443, 8081, 8443, 80, 8080, 8088, 18081
Productsopen-proxy, nginx
Loot harvested577 file(s), 1167196 KB · c2, coinminer, elf-binary, exploit, exposed-secret, forced-loot

Open directory contents (400)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
GOU2.tgzTGZ505.1 MB
B.tgzTGZ90.1 MB
B.tgzTGZ85.3 MB
miner.gzGZ38.6 MB
minerTXT38.6 MB
cfTXT38.4 MB
ca_216.81.245.169.txtTXT32.2 MB
tw.tgzTGZ29.0 MB
11.tar.gzGZ25.6 MB
C.tgzTGZ24.7 MB
allf.txtTXT24.3 MB
cadv.jsonJSON14.7 MB
acgmain.tgzTGZ13.8 MB
14.tar.gzGZ12.9 MB
09.tar.gzGZ11.7 MB
chuhai.zipZIP11.6 MB
03.tar.gzGZ11.5 MB
pf.tgzTGZ11.4 MB
‹redacted›.debDEB11.3 MB
acg349.tgzTGZ11.0 MB
02.tar.gzGZ9.2 MB
charts.logLOG7.6 MB
‹redacted›.testELF7.5 MB
10.tar.gzGZ6.7 MB
04.tar.gzGZ4.3 MB
13.tar.gzGZ3.6 MB
00.tar.gzGZ2.7 MB
c2cap.logLOG2.4 MB
miner.part.00ELF2.4 MB
miner.part.01012.4 MB
miner.part.02022.4 MB
miner.part.03032.4 MB
miner.part.04042.4 MB
miner.part.05052.4 MB
miner.part.06062.4 MB
miner.part.07072.4 MB
miner.part.08082.4 MB
miner.part.09092.4 MB
miner.part.10102.4 MB
miner.part.11112.4 MB
miner.part.12122.4 MB
miner.part.13132.4 MB
miner.part.14142.4 MB
miner.part.15152.4 MB
beacon88.logLOG1.5 MB
index-DkEtfwWm.jsJS1.3 MB
.meth.tgzTGZ941 KB
chunk-726079dc.jsJS901 KB
06.tar.gzGZ786 KB
c_list.txtTXT745 KB
chunk-ff9a6638.jsJS499 KB
A.tgzTGZ471 KB
chunk-19ac40da.jsJS460 KB
15.tar.gzGZ428 KB
bz.jsJS336 KB
‹redacted›.outOUT302 KB
chunk.b64B64260 KB
acg_verified.jsonJSON259 KB
chunk-57220ebd.jsJS242 KB
access.logLOG236 KB
37fe53.htmlHTML227 KB
.fleet.tgzTGZ192 KB
‹redacted›.jsonlJSONL179 KB
acg_pool.jsonJSON169 KB
c2v4.logLOG156 KB
‹redacted›.jsonlJSONL151 KB
‹redacted›.jsonlJSONL115 KB
‹redacted›.jsonlJSONL115 KB
cid.htmlHTML109 KB
‹redacted›.outOUT104 KB
c2cmd.logLOG99 KB
‹redacted›.jsonlJSONL89 KB
c2v2.logLOG77 KB
big2.logLOG73 KB
chunk-2d0be333.jsJS71 KB
bak500.htmlHTML71 KB
bk1.zipZIP70 KB
chunk-684f1507.jsJS68 KB
__next_static_chunks_app_%28main%29_system_llm_page-c4081c4d637dd34c.jsJS67 KB
‹redacted›.jsonlJSONL64 KB
pg_schemaTXT60 KB
exp6.soELF60 KB
ck_workspace.js%3Fv%3Dworkspace-entry-flow-2026.jsJS56 KB
chunk-d8a1f44a.jsJS55 KB
12.tar.gzGZ54 KB
.feed.tgzTGZ49 KB
c24.logLOG47 KB
chunk-4df3105a.jsJS43 KB
‹redacted›.jsonlJSONL42 KB
acg_misconf.jsonJSON42 KB
chunk-53586e95.jsJS42 KB
‹redacted›.CollectCOLLEC40 KB
‹redacted›.DatabaseDATABA40 KB
chunk-17eae384.jsJS39 KB
chuhaitg.htmlHTML39 KB
chunk-1ff7a04a.jsJS39 KB
chunk-504574dc.jsJS39 KB
acg310.jsJS38 KB
aj.jsJS36 KB
‹redacted›.jsonlJSONL35 KB
‹redacted›.jsonlJSONL35 KB
‹redacted›.jsonlJSONL35 KB
‹redacted›.jsonlJSONL35 KB
‹redacted›.jsonlJSONL35 KB
‹redacted›.jsonlJSONL35 KB
‹redacted›.jsonlJSONL34 KB
‹redacted›.jsonlJSONL33 KB
chunk-19a81756.jsJS33 KB
b.htmlHTML33 KB
biz.htmlHTML33 KB
acg_pool2_result.jsonJSON32 KB
‹redacted›.jsonlJSONL32 KB
‹redacted›.jsonlJSONL32 KB
c.htmlHTML32 KB
‹redacted›.jsonlJSONL31 KB
‹redacted›.jsonlJSONL31 KB
‹redacted›.jsonlJSONL31 KB
‹redacted›.jsonlJSONL31 KB
add.htmlHTML31 KB
‹redacted›.jsonlJSONL31 KB
‹redacted›.jsonlJSONL30 KB
chunk-cc739a60.jsJS30 KB
bt3.htmlHTML29 KB
bt_check.htmlHTML29 KB
bt_page.htmlHTML29 KB
bt_page_n.htmlHTML29 KB
‹redacted›.jsonlJSONL29 KB
au.jsonJSON29 KB
‹redacted›.phar.txtTXT28 KB
chk.jsonJSON28 KB
after.jsonJSON27 KB
c2v3.logLOG27 KB
‹redacted›.jsonlJSONL27 KB
‹redacted›.jsonlJSONL27 KB
a.jsonJSON27 KB
‹redacted›.jsonlJSONL27 KB
‹redacted›.jsonlJSONL27 KB
c2take.logLOG27 KB
‹redacted›.jsonlJSONL27 KB
chunk-73afdc93.jsJS26 KB
cc_reg.htmlHTML26 KB
acg_pool2.jsonJSON25 KB
cc_login.htmlHTML25 KB
chunk-336900ee.jsJS25 KB
‹redacted›.jsonlJSONL25 KB
chunk-3969c994.jsJS25 KB
chunk-62e1d869.jsJS24 KB
chunk-6bd9144a.jsJS24 KB
chunk-9165e9da.jsJS24 KB
chunk-22ab71e9.jsJS23 KB
chunk-b9e5ebaa.jsJS23 KB
chunk-23d10266.jsJS23 KB
chunk-c40df28a.jsJS23 KB
big.logLOG22 KB
chunk-bba10812.jsJS22 KB
‹redacted›.jsonlJSONL22 KB
chunk-004659ea.jsJS21 KB
2fa.htmlHTML21 KB
art.htmlHTML21 KB
chunk-ba84b802.jsJS21 KB
cl.jsonJSON21 KB
chunk-20d791d5.jsJS21 KB
chunk-0fa6d862.jsJS20 KB
biz2.htmlHTML20 KB
chunk-3fbd3c4a.jsJS19 KB
cb_g1.logLOG19 KB
‹redacted›.club.htmlHTML19 KB
body_H.txtTXT19 KB
chunk-7c2f7fd6.jsJS18 KB
c.binBIN18 KB
chunk-f9d70cea.jsJS17 KB
a5.binBIN16 KB
ap.jsonJSON16 KB
busu.htmlHTML16 KB
chunk-65461998.jsJS16 KB
‹redacted›.outOUT15 KB
chunk-7a2d7a80.jsJS15 KB
chunk-65cf8bd2.jsJS15 KB
chunk-16baac60.jsJS14 KB
acg_envscan.jsonJSON14 KB
acg_cards.jsonJSON14 KB
chunk-5c589cf7.jsJS14 KB
chunk-c7c7d9be.jsJS14 KB
c2fmt.logLOG14 KB
api.htmlHTML14 KB
chunk-f70ef844.jsJS13 KB
api.htmlHTML13 KB
adm3.htmlHTML13 KB
shared_bind.phpPHP12 KB
ck_quick-chat.js%3Fv%3Dvram-pricing-20260922.jsJS11 KB
chunk-833bd7e4.jsJS11 KB
apt.logLOG10 KB
cfg.jsJS10 KB
aws_pool.jsonJSON9 KB
acg_drained.jsonJSON8 KB
Bgv_Agh9.jsJS8 KB
bt_logs.jsonJSON8 KB
acg_pool3_result.jsonJSON8 KB
__next_static_chunks_app_%28auth%29_setup_page-7368bb567e115393.jsJS8 KB
p_d2g8_backup.shSH7 KB
sync.phpPHP7 KB
aws_creds.jsonJSON7 KB
cf.logLOG7 KB
as.shSH6 KB
17.tar.gzGZ6 KB
a.binBIN6 KB
c2v2_tasks.jsonJSON6 KB
p.shSH6 KB
‹redacted›.jsonlJSONL5 KB
‹redacted›.pycPYC5 KB
chaink8s_deploy.pyPY5 KB
chatchat_hunt.pyPY5 KB
c2_takeover.pyPY4 KB
c2_v4.pyPY4 KB
ap.shSH4 KB
c2_v3.pyPY4 KB
all_nvgd_keys.txtTXT4 KB
cloud_creds_harvest.pyPY4 KB
query_order.phpPHP3 KB
bifrost_plugin_name.pyPY3 KB
bifrost_dynamic_hunt.pyPY3 KB
bifrost_pool.pyPY3 KB
vt171-r6000TXT3 KB
a100_mgr_recon.pyPY3 KB
c2_v2.pyPY3 KB
bifrost_plugin_crud.pyPY3 KB
backdoor_install.pyPY3 KB
.nvgdkeys.tgzTGZ3 KB
acg_nocaptcha.jsonJSON3 KB
c2_fmt_probe.pyPY3 KB
aws_same_proc.pyPY3 KB
readme1.mdMD3 KB
ck_gpu3.pyPY3 KB
ck_gpu.pyPY3 KB
cert_h200_scan.pyPY3 KB
a1.htmlHTML3 KB
bifrost_plugin_probe.pyPY3 KB
qingli.phpPHP3 KB
ck_deploy3.pyPY3 KB
agent_v2.pyPY3 KB
ck_gpu2.pyPY3 KB
bifrost_cand_detail.pyPY3 KB
bifrost_enable_diag.pyPY3 KB
ck_deploy4.pyPY3 KB
ck_rpc.pyPY2 KB
bifrost_ver_cleanup.pyPY2 KB
ck_deploy2.pyPY2 KB
ck_miner.pyPY2 KB
bifrost_live_target.pyPY2 KB
%E5%AE%89%E8%A3%85%E5%90%8E%E8%A6%81%E6%B7%BB%E5%8A%A0%E7%9A%84%E4%BB%BB%E5%8A%A1.txtTXT2 KB
cfm_rce.pyPY2 KB
c2srv.pyPY2 KB
bug.shSH2 KB
af_check.pyPY2 KB
cleanup_rival.pyPY2 KB
aws_enum_perms.pyPY2 KB
aws_perm_probe.pyPY2 KB
ck_bcast.pyPY2 KB
111755_75471.binBIN2 KB
111812_92008.binBIN2 KB
111826_6360.binBIN2 KB
cadvisor_gpu_hunt.pyPY2 KB
cleanup_batch.pyPY2 KB
cadvisor_all.pyPY2 KB
ck_diag.pyPY2 KB
cds.pyPY2 KB
bmc_survey.pyPY2 KB
cf_nodes.pyPY2 KB
bech.pyPY2 KB
aws_creds_survey.pyPY2 KB
ck_access.pyPY2 KB
cf_write.pyPY2 KB
build3.pyPY2 KB
aws_slim.pyPY2 KB
big.shSH2 KB
body_F.txtTXT2 KB
build2.pyPY2 KB
boot.pyPY2 KB
bifrost_recon.pyPY2 KB
al2.pyPY2 KB
exp.cC2 KB
b365.htmlHTML2 KB
chatlogin.htmlHTML2 KB
cf_oom.pyPY2 KB
b300_peek.pyPY2 KB
analyze_entry.pyPY1 KB
cli8101.logLOG1 KB
agent_key.shSH1 KB
ck_auth.pyPY1 KB
cf_check.pyPY1 KB
‹redacted›.jsonlJSONL1 KB
cb_g1.pyPY1 KB
autowait.shSH1 KB
ck_chat.pyPY1 KB
cadvisor_probe.pyPY1 KB
br2.pyPY1 KB
c2_pyexec.pyPY1 KB
clore_auth.pyPY1 KB
a800_user_probe.pyPY1 KB
c1.jsonJSON1 KB
bt_js_login.jsJS1 KB
basic_brute.pyPY1 KB
cf_deploy.pyPY1 KB
build.pyPY1 KB
ck_models.pyPY1 KB
ck_verify.pyPY1 KB
agent_priv.pyPY1 KB
adm_login.pyPY1 KB
ckr3.pyPY1 KB
bt_panel_hunt.shSH1 KB
ck_find.pyPY1 KB
ckb2.pyPY1 KB
check_both.shSH1 KB
abs.pyPY1 KB
ccd.pyPY1 KB
btc.pyPY1 KB
analyze2.pyPY1 KB
bk.pyPY1 KB
ck_ws.pyPY1 KB
agent_api.shSH1 KB
ck_tariff.pyPY1 KB
ap.pyPY1 KB
ck2.pyPY1 KB
ck_acc.pyPY1 KB
ckr.pyPY1 KB
ck_js.pyPY1 KB
ar.pyPY1 KB
ccv.pyPY1 KB
agent_state.shSH1 KB
ckbuild.pyPY1 KB
111757_77139.binBIN1 KB
111816_96011.binBIN1 KB
cl8b.pyPY1 KB
apk.pyPY1 KB
bf8899.pyPY1 KB
apk2.pyPY1 KB
bmc.pyPY1 KB
am.pyPY1 KB
b.binBIN1 KB
aid.pyPY1 KB
aa.pyPY1 KB
aws_sts_test.pyPY1 KB
clore_use.pyPY1 KB
cam.pyPY1 KB
act2.pyPY1 KB
c2_send_rev.pyPY1 KB
c2_deep.shSH1 KB
ac.binBIN1 KB
ckr2.pyPY1 KB
a100.pyPY1 KB
br.pyPY1 KB
ajenti_probe.shSH1 KB
cad.pyPY1 KB
bj.pyPY1 KB
ban.pyPY1 KB
af5.pyPY1 KB
cl8c.pyPY1 KB
acg_probe.pyPY1 KB
body.pyPY1 KB
a8b.pyPY1 KB
bf97.pyPY1 KB
ag2.pyPY1 KB
blk.pyPY1 KB
c2_from_vt171.pyPY1 KB
apk4.pyPY1 KB
aarm.pyPY1 KB
apis.pyPY1 KB
aws_verify.pyPY1 KB
ca.pyPY1 KB
ck_url.pyPY1 KB
api3.pyPY1 KB
cl8.pyPY1 KB
af7.pyPY1 KB
af.pyPY1 KB
ad118.htmlHTML1019 B
c60.pyPY1017 B
ck_auth2.pyPY1010 B
bf.pyPY998 B
cam3.pyPY996 B
auth_map.shSH988 B
ch2.pyPY985 B
a1111.pyPY980 B
ad3.pyPY980 B
ck_cfg.pyPY971 B
cam4.pyPY969 B
bt.pyPY966 B
ag.pyPY958 B
cad6.pyPY956 B
act.pyPY954 B
apis2.pyPY952 B
check_after_scale.shSH952 B
ad6.pyPY948 B
b64.pyPY945 B
bento.pyPY944 B
act.shSH937 B
cc.pyPY937 B
cadvisor_deep.shSH935 B
af8.pyPY900 B
agg.pyPY898 B
ai.pyPY883 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

100.21.82.169confirmed
101.36.112.205confirmed
101.42.136.73confirmed
101.47.156.26confirmed
101.89.149.227confirmed
102.204.222.159confirmed
102.210.149.166confirmed
103.131.51.199confirmed
103.131.61.143confirmed
103.163.246.138confirmed
103.35.216.13confirmed
103.46.185.169confirmed
103.73.189.190confirmed
103.80.88.106confirmed
104.131.161.161confirmed