Live findsCVE IntelResearchConsoleStart free
huntback / IP intelligence

3.26.94.147

DATACENTERoperator-submittedloot-ipc2exploitexposed-secretforced-loot

Intelligence

ASN / OrgAS16509 · Amazon.com, Inc.
CountryAustralia
NetworkDATACENTER · risk 60/100
Threat score0/100
Open ports22, 8080
ServiceSimpleHTTP/0.6 Python/3.14.4 · Directory listing for /
Loot harvested67 file(s), 200847 KB · c2, exploit, exposed-secret, forced-loot, malware, mozi

Open directory contents (67)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
c2_store.dbDB36.0 MB
beacon.exeEXE30.5 MB
‹redacted›.pkgPKG30.1 MB
‹redacted›.pkgPKG30.1 MB
submit_to_boss_FINAL.exeEXE24.8 MB
svchost.exeEXE12.1 MB
update.exePE8.4 MB
implant.exePE8.4 MB
‹redacted›.pkgPKG8.0 MB
tvnserver.exePE1.8 MB
base_library.zipZIP1.3 MB
base_library.zipZIP1.3 MB
base_library.zipZIP1.3 MB
xref-beacon.htmlHTML984 KB
xref-implant.htmlHTML265 KB
‹redacted›.tocTOC129 KB
‹redacted›.tocTOC129 KB
hookldr.exePE104 KB
‹redacted›.tocTOC86 KB
screenhooks64.dllPE84 KB
warn-beacon.txtTXT27 KB
c2_server.logLOG27 KB
beacon.pyPY26 KB
‹redacted›.tocTOC24 KB
‹redacted›.tocTOC24 KB
‹redacted›.tocTOC22 KB
‹redacted›.tocTOC22 KB
c2_server.pyPY20 KB
sas.dllPE18 KB
operator_cli.pyPY16 KB
d3des.pyPY11 KB
aws_cloudflare_setup.mdMD8 KB
AWS_SETUP_GUIDE.mdMD7 KB
build.logLOG5 KB
cleanup.pyPY4 KB
README_STEALTH.mdMD4 KB
recon.pyPY4 KB
persistence.pyPY4 KB
exfil.pyPY3 KB
lateral.pyPY3 KB
‹redacted›.vbsVBS3 KB
‹redacted›.csCS2 KB
vnc_capture.pyPY2 KB
stage1.jsJS2 KB
stage1.batBAT2 KB
warn-implant.txtTXT2 KB
vnc_relay.pyPY1 KB
update_c2_host.pyPY1 KB
generate.pyPY1 KB
server.keyKEY1 KB
README.mdMD1 KB
driveby.jsJS1 KB
implant.pyPY1 KB
dropper.ps1PS1962 B
get_aws_info.pyPY959 B
fake_update.htmlHTML918 B
‹redacted›.htaHTA852 B
config.pyPY785 B
README_WEB.mdMD759 B
‹redacted›.specSPEC701 B
‹redacted›.specSPEC699 B
dropper_stealth.ps1PS1417 B
relay.logLOG304 B
check_sessions.pyPY255 B
amsi_bypass.ps1PS1195 B
‹redacted›.vbsVBS179 B
dropper.jsJS163 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

104.200.73.97lead
107.148.227.57lead
119.45.236.76lead
16.171.12.83lead
178.104.188.135lead
3.84.186.180lead
34.254.202.253lead
38.9.96.215lead
85.198.101.85lead
95.133.253.15lead