Live findsCVE IntelResearchConsoleStart free
huntback / IP intelligence

23.27.25.75

RESIDENTIALoperator-submittedc2exploitexposed-secretmalwaremozi

Intelligence

ASN / OrgAS149440 · Evoxt Sdn. Bhd.
CountryUnited States
NetworkRESIDENTIAL · risk 15/100
Threat score0/100
Open ports22, 80, 8888
ServiceSimpleHTTP/0.6 Python/3.13.5 · Directory listing for /
Loot harvested129 file(s), 13866 KB · c2, exploit, exposed-secret, malware, mozi, tunnel

Open directory contents (129)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
oob-listener.logLOG9.2 MB
hesabat.sqlSQL1.5 MB
naturamedpharm.zipZIP550 KB
vl_all.jsJS493 KB
mis_db%252003-06-226.sqlSQL295 KB
vl_complete_db.jsonJSON250 KB
mis_db.sqlSQL232 KB
bs.rarRAR116 KB
gps_main.jsJS91 KB
vl_admin_dump.jsonJSON90 KB
vl_audit_logs.csvCSV81 KB
hesabat_live_backup.sqlSQL78 KB
‹redacted›.pycPYC50 KB
novbe.rarRAR47 KB
irmis.rarRAR45 KB
etibarname.zipZIP37 KB
php2shell.pyPY36 KB
p2s-kit.tar.gzGZ33 KB
merge_broad_recon.pyPY22 KB
broad_recon.pyPY20 KB
renglernp.sqlSQL19 KB
cve_check.pyPY18 KB
vl_api.jsonJSON15 KB
winpin.pyPY11 KB
cacti_2025_24367.pyPY8 KB
vl_access.pyPY7 KB
lab_fidelity_recon.pyPY6 KB
vl_exp.pyPY6 KB
shodan_leads.pyPY5 KB
cacti_probe2.pyPY5 KB
gap_sweep.pyPY5 KB
deep_recon.pyPY5 KB
cacti_probe.pyPY5 KB
snappymail_rce.pyPY5 KB
chainc_oracle.pyPY4 KB
lead_probe2.pyPY4 KB
vl_audit.pyPY4 KB
p0_deep_recon.pyPY4 KB
mis_shell.pyPY4 KB
wider_sweep.pyPY4 KB
p0_fire.pyPY4 KB
voicelink_hunt.pyPY3 KB
gps_recon.pyPY3 KB
gitlab_quiet.pyPY3 KB
mass_check.pyPY3 KB
lead_liveness.pyPY3 KB
vl_dbpull.pyPY3 KB
winfleet_sweep.pyPY3 KB
sm_api.pyPY3 KB
vl_rce.pyPY3 KB
gitlab_attack.pyPY3 KB
exploit.pyPY3 KB
cacti_sess2.pyPY3 KB
vl_backend.pyPY3 KB
vl_dbclean.pyPY3 KB
gitlab_reg2.pyPY3 KB
ls_liveness.pyPY3 KB
data_and_shell.pyPY3 KB
oracle_94.20.222.60.pyPY3 KB
fire_mis.pyPY2 KB
vl_dump_all.pyPY2 KB
vl_jwt.pyPY2 KB
vl_cleanup.pyPY2 KB
vl_jwt2.pyPY2 KB
vl_relay2.pyPY2 KB
app_fingerprint.pyPY2 KB
vl_mysql.pyPY2 KB
batch2.pyPY2 KB
ht_shell.pyPY2 KB
cacti_34340.pyPY2 KB
oracle_v2.pyPY2 KB
login_fixed.pyPY2 KB
cacti_diag.pyPY2 KB
vl_v4.pyPY2 KB
gitlab_login.pyPY2 KB
xampp_probe.pyPY2 KB
vl_final_dump.pyPY2 KB
vl_v3.pyPY2 KB
vl_dump.pyPY2 KB
fire_vp.pyPY2 KB
benign_test.pyPY2 KB
vl_auth_bypass.pyPY2 KB
lead_probe.pyPY2 KB
vl_audio.pyPY2 KB
hesabat_recon.pyPY2 KB
cacti_pw.pyPY2 KB
cacti_sess3.pyPY2 KB
vl_sqli.pyPY2 KB
vl_files2.pyPY2 KB
cacti_34340_v2.pyPY2 KB
profiler_recon.pyPY2 KB
cacti_real.pyPY2 KB
cacti_sqli_probe.pyPY2 KB
vl_root.pyPY2 KB
vl_spring.pyPY2 KB
new_targets.pyPY2 KB
vl_refresh.pyPY1 KB
vl_err.pyPY1 KB
cacti_sqli2.pyPY1 KB
vl_8080.pyPY1 KB
vl_intel.pyPY1 KB
live_forms.pyPY1 KB
fire_split.pyPY1 KB
vl_audio_all.pyPY1 KB
vl_create.pyPY1 KB
vl_probe.pyPY1 KB
up_err.pyPY1 KB
vl_owned.pyPY1 KB
vl_final.pyPY1 KB
amp_test.pyPY1 KB
vl_files.pyPY1 KB
recipe_-831.logLOG1 KB
vl_bypass.pyPY1 KB
vl_relay.pyPY1 KB
vl_mysql3.pyPY1 KB
vl_audio2.pyPY1 KB
vl_auth.pyPY1 KB
vl_mysql2.pyPY1 KB
gps_mine.pyPY1 KB
recipe_5.logLOG1 KB
expand.pyPY1 KB
vl_files3.pyPY976 B
check00dd.shSH855 B
shell_recon.pyPY839 B
shell_vac.pyPY786 B
.bash_historyBASH_H600 B
vl_full.jsonJSON556 B
find_mysql.pyPY485 B
exec_recipe.logLOG85 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

85.132.34.10confirmed
151.243.11.240lead
151.243.11.241lead
159.223.40.78lead
185.216.68.66lead
194.55.166.170lead
202.95.17.200lead
204.168.131.234lead
209.99.191.184lead
217.142.239.53lead
38.60.91.186lead
46.250.255.73lead
64.177.47.135lead
66.42.33.224lead
83.172.138.182lead