Live findsCVE IntelConsoleStart free
huntback / IP intelligence

31.128.39.24

RESIDENTIALoperator-submittedloot-ipc2exploitexposed-secretmalware

Intelligence

ASN / OrgAS198610 · Beget LLC
CountryRussia
NetworkRESIDENTIAL · risk 15/100
Threat score0/100
Open ports22, 9999
ServiceSimpleHTTP/0.6 Python/3.12.3 · Directory listing for /
Loot harvested402 file(s), 32303 KB · c2, exploit, exposed-secret, gafgyt, malware, mozi

Open directory contents (400)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
oob_listener.logLOG9.5 MB
contractor_combined.jsJS3.5 MB
sogaz-all.jsJS1.9 MB
lkjur_chunk2TXT1.8 MB
app_chunkTXT1.2 MB
app_fullTXT1.2 MB
old_main.jsJS1.1 MB
main_npo.jsJS1.1 MB
lk_main.jsJS1.1 MB
app_bundle.jsJS852 KB
pages__app-45f13ea2386b0c5c.jsJS852 KB
app_direct.jsJS852 KB
shop-template.jsJS757 KB
shop-header.jsJS756 KB
app.jsJS657 KB
sber247.jsJS604 KB
with_mwTXT219 KB
without_mwTXT219 KB
cp1.txtTXT213 KB
rsc1TXT117 KB
rsc_respTXT117 KB
normal1TXT117 KB
sberid_sdk.jsJS114 KB
appealTXT110 KB
appeal_formTXT110 KB
pro_pageTXT76 KB
resp2TXT74 KB
winnersTXT74 KB
ops_pageTXT66 KB
cache1TXT61 KB
cache2TXT61 KB
reflect2TXT61 KB
quote_testTXT61 KB
squote_testTXT61 KB
reflect1TXT61 KB
reflect5TXT61 KB
reflect6TXT61 KB
reflect3TXT61 KB
reflect4TXT61 KB
search_pageTXT61 KB
code.jsJS47 KB
wi.binBIN47 KB
8465-b3514c43d6462a23.jsJS39 KB
loginModule.jsJS37 KB
‹redacted›.chunk.jsJS34 KB
declarative_performance_observer.dbDB32 KB
appeal_chunk.jsJS27 KB
kc_brute.logLOG24 KB
sogaz-chunk3.jsJS24 KB
cached-certsTXT19 KB
exploit.pyPY18 KB
chunkTXT16 KB
lk_htmlTXT14 KB
resp_withTXT14 KB
resp_withoutTXT14 KB
chunk_dataTXT12 KB
successorTXT12 KB
sbertech_hunter.pyPY11 KB
reg_b.txtTXT11 KB
reghtmlTXT11 KB
README.mdMD11 KB
ssrf_test.pyPY10 KB
php2shell_poc.pyPY9 KB
tick16.shSH9 KB
tick15.shSH9 KB
tick15f.shSH8 KB
sqli_all.pyPY8 KB
tor.logLOG8 KB
tick18.shSH8 KB
tick17.shSH8 KB
references.mdMD8 KB
php2shell_race.pyPY7 KB
tick15d.shSH7 KB
tick16c.shSH7 KB
tick15e.shSH7 KB
‹redacted›.origORIG7 KB
www_fuzz.jsJS7 KB
tick15c.shSH7 KB
www_deep_browser.jsJS6 KB
www_crawl_forms.jsJS6 KB
www_full_interact.jsJS6 KB
tick_sourcemap.shSH6 KB
tick10.shSH6 KB
tick15b.shSH6 KB
www_browser_test.jsJS6 KB
www_sp_extract.jsJS6 KB
tick14.shSH6 KB
tick15g.shSH6 KB
deep_interact.jsJS6 KB
r28_boost.jsJS6 KB
tick20.shSH6 KB
tick16b.shSH6 KB
tick12.shSH6 KB
kc_login_timing.pyPY6 KB
hunt_www.pyPY6 KB
tick19b.shSH6 KB
sqli_test.pyPY6 KB
exploit10.pyPY5 KB
bx_actions.jsJS5 KB
new_comps.jsJS5 KB
tick19.shSH5 KB
rate_display.jsJS5 KB
hunt8.pyPY5 KB
tick11.shSH5 KB
chain2.jsJS5 KB
reverse_mainjs.jsJS5 KB
exploit11.pyPY5 KB
tick_new.shSH5 KB
h_withTXT5 KB
h_withoutTXT5 KB
tick13.shSH5 KB
www_action_crawl.jsJS5 KB
tick_npo2.shSH5 KB
tick_deep.shSH5 KB
lk_app_jsTXT5 KB
php2shell_check.shSH5 KB
tick_srcmap.shSH5 KB
tick_bitrix_npo.shSH5 KB
tick_bitrix_cve.shSH5 KB
hunt_www4.pyPY5 KB
tick_version.shSH5 KB
www_sp2.jsJS5 KB
sber247_widget.jsJS5 KB
webhooks_deep.jsJS5 KB
tick11b.shSH5 KB
sopd_dl.jsJS5 KB
insurance_form.jsJS5 KB
find-spray-landing.pyPY5 KB
tick_cors_npo_fix.shSH5 KB
tick_npo_headers.shSH5 KB
hunt_www3.pyPY5 KB
tick_sms_pds.shSH4 KB
exploit9.pyPY4 KB
jwt_confusion.pyPY4 KB
exploit57.pyPY4 KB
exploit3.pyPY4 KB
insurance_deep.jsJS4 KB
tick10b.shSH4 KB
landing_deep.jsJS4 KB
tick_cors.shSH4 KB
brute-sweep.pyPY4 KB
www_stealth.jsJS4 KB
kc_direct_login.pyPY4 KB
tick_npo.shSH4 KB
form_rate_new.jsJS4 KB
www_xss_verify.jsJS4 KB
exploit28.pyPY4 KB
exploit55.pyPY4 KB
pm_check.jsJS4 KB
hunt6.pyPY4 KB
auction_test.jsJS4 KB
submit_form.jsJS4 KB
exploit24.pyPY4 KB
landing_submit.jsJS4 KB
exploit44.pyPY4 KB
hunt_www2.pyPY4 KB
exploit32.pyPY4 KB
exploit5.pyPY4 KB
LAB-RCE-PROOF.mdMD4 KB
tick_esia.shSH4 KB
exploit23.pyPY4 KB
exploit.pyPY4 KB
exploit59.pyPY4 KB
exploit34.pyPY4 KB
more_traces.jsJS4 KB
kc_timing.pyPY4 KB
upload_hunt.jsJS4 KB
README.mdMD4 KB
kc_test.pyPY4 KB
hunt5.pyPY4 KB
filter_sqli.jsJS4 KB
pages_unsubscribe-c5f4be5571e02f55.jsJS4 KB
sopd_deep.jsJS4 KB
insurance_calc.jsJS4 KB
exploit29.pyPY4 KB
csi_submit.jsJS4 KB
new_deep.jsJS4 KB
iblock_content.jsJS4 KB
polis_upload.jsJS4 KB
last_vec.jsJS4 KB
comagic_exploit.jsJS4 KB
exploit33.pyPY4 KB
landing_sp.jsJS4 KB
file_errors.jsJS4 KB
exploit14.pyPY4 KB
zakupki_deep.jsJS4 KB
keycloak_deep.pyPY4 KB
php2shell_exploit.shSH4 KB
exploit21.pyPY4 KB
km_booking.jsJS4 KB
exploit47.pyPY4 KB
checkinn.jsJS4 KB
exploit15.pyPY4 KB
trace_hunt.jsJS4 KB
exploit2.pyPY3 KB
exploit18.pyPY3 KB
exploit30.pyPY3 KB
sessid_reuse.jsJS3 KB
exploit35.pyPY3 KB
webhooks_full.jsJS3 KB
comagic_deep.jsJS3 KB
kc_reset.pyPY3 KB
exploit39.pyPY3 KB
exploit31.pyPY3 KB
exploit56.pyPY3 KB
erid_vote.jsJS3 KB
form_fields.jsJS3 KB
exploit40.pyPY3 KB
exploit26.pyPY3 KB
auction_fcu.jsJS3 KB
exploit36.pyPY3 KB
cors_exfil_poc.pyPY3 KB
captcha_bypass.shSH3 KB
p2s_race.pyPY3 KB
exploit53.pyPY3 KB
final_scan.jsJS3 KB
sp_reuse.jsJS3 KB
comagic_upload.jsJS3 KB
submit_all.jsJS3 KB
textplain_other.jsJS3 KB
exploit48.pyPY3 KB
vhtml.jsJS3 KB
ssrf_oob.pyPY3 KB
find_upload.jsJS3 KB
exploit6.pyPY3 KB
exploit17.pyPY3 KB
keycloak_xss_test.pyPY3 KB
www_webhooks.jsJS3 KB
vue3_new.jsJS3 KB
exploit25.pyPY3 KB
hunt7.pyPY3 KB
exploit52.pyPY3 KB
tick_payment.shSH3 KB
waf_bypass_verify.jsJS3 KB
portal_browser_test.jsJS3 KB
find_comp.jsJS3 KB
exploit46.pyPY3 KB
polis_arfiles.jsJS3 KB
rest_brute.jsJS3 KB
kc_extract.pyPY3 KB
formcode.jsJS3 KB
vue3_main.jsJS3 KB
exploit27.pyPY3 KB
more_comps.jsJS3 KB
exploit12.pyPY3 KB
all_comps.jsJS3 KB
portal_sberid.jsJS3 KB
exploit16.pyPY3 KB
exploit8.pyPY3 KB
exploit43.pyPY3 KB
vote_csi.jsJS3 KB
exploit22.pyPY2 KB
xss_render.jsJS2 KB
client_pages.jsJS2 KB
extract_all.jsJS2 KB
compliance_xss.jsJS2 KB
qrator_fetch.pyPY2 KB
targeted.jsJS2 KB
contractor_deep.jsJS2 KB
admin_browser.jsJS2 KB
portal_recovery.jsJS2 KB
bypass_waf.pyPY2 KB
exploit50.pyPY2 KB
exploit37.pyPY2 KB
csi_rate.jsJS2 KB
exploit49.pyPY2 KB
exploit58.pyPY2 KB
ws_intercept.jsJS2 KB
exploit38.pyPY2 KB
debug_sp.jsJS2 KB
exploit7.pyPY2 KB
last_tests.jsJS2 KB
ws_test.pyPY2 KB
discover-addresses.shSH2 KB
portal_auth_bypass.jsJS2 KB
contractor_ds.jsJS2 KB
exploit20.pyPY2 KB
comps_light.jsJS2 KB
sopd_sp.jsJS2 KB
portal_fetch.jsJS2 KB
exploit41.pyPY2 KB
r7t12.shSH2 KB
extract_sp.jsJS2 KB
brusnika_admin.pyPY2 KB
exploit19.pyPY2 KB
exploit51.pyPY2 KB
dns_brute.shSH2 KB
compliance_sp.jsJS2 KB
urls_hunt.jsJS2 KB
exploit4.pyPY2 KB
exploit45.pyPY2 KB
r7t6.shSH2 KB
full_sp.jsJS2 KB
exploit54.pyPY2 KB
rest_browser.jsJS2 KB
formvue_test.jsJS2 KB
smuggle.pyPY2 KB
crawl_actions.jsJS2 KB
r7t11.shSH2 KB
exploit13.pyPY2 KB
portal_oauth_flow.jsJS2 KB
read_stored.jsJS2 KB
hunt_browser.pyPY2 KB
chat_browser.jsJS2 KB
inn_check.jsJS2 KB
bypass_waf2.pyPY2 KB
smuggle_tecl.pyPY2 KB
modules.jsJS2 KB
kc9.txtTXT2 KB
vue3_analyze.jsJS2 KB
token_login.jsJS2 KB
read_rate.jsJS2 KB
r7t15.shSH2 KB
r7t7.shSH2 KB
landing_vue.jsJS2 KB
bf_keycloak.pyPY2 KB
comp_ajax.jsJS2 KB
login_state.jsJS2 KB
fetch_js.pyPY2 KB
exploit42.pyPY2 KB
r7t9.shSH2 KB
detail_test.jsJS2 KB
SECURITY.mdMD2 KB
r7t13.shSH2 KB
auth_bypass.jsJS2 KB
tor_deep.shSH2 KB
upload_chunks.jsJS2 KB
search_xss.jsJS1 KB
r7t5.shSH1 KB
kc7.txtTXT1 KB
sqli_test.shSH1 KB
deploy_new.jsJS1 KB
vhtml2.jsJS1 KB
django_hunt.pyPY1 KB
search_reflect.jsJS1 KB
spa_routes.jsJS1 KB
qrator_bypass.pyPY1 KB
verify.shSH1 KB
ajax_enum.jsJS1 KB
r7bx.shSH1 KB
r7t8.shSH1 KB
portal_admin_route.jsJS1 KB
token_exchange.shSH1 KB
portal_routes.jsJS1 KB
scan_all.pyPY1 KB
vote_sp.jsJS1 KB
bitrix_deep.shSH1 KB
LICENSETXT1 KB
smuggle_test.pyPY1 KB
chunk_scan.pyPY1 KB
quick_ajax.jsJS1 KB
r7t16.shSH1 KB
gigachat.shSH1 KB
xss_test.shSH1 KB
nginx.confCONF1 KB
compliance_check.jsJS1 KB
000001.logLOG1 KB
analyze_js.shSH1 KB
ins.jsJS1 KB
kc_brute.shSH1 KB
hr2.binBIN1 KB
hr.binBIN1 KB
hr_write.binBIN1 KB
c.jsJS1 KB
so.jsJS1 KB
ssrf_server.pyPY1 KB
r7t14.shSH1 KB
r7.shSH1 KB
gra_respTXT1 KB
server.pyPY1 KB
check.jsJS1022 B
r7t10.shSH1021 B
ntlmrelayx.logLOG931 B
test_cve_2025_29927.shSH859 B
‹redacted›.patchedPATCHE850 B
pp_test.htmlHTML844 B
ntlm_trap.pyPY842 B
getsp.jsJS811 B
sni_bypass.shSH799 B
oob_listener.pyPY769 B
test_cve_2026_18963.shSH753 B
docker-compose.ymlYML748 B
oob_hits.logLOG740 B
bf_keycloak2.logLOG717 B
DockerfileTXT716 B
r7t4.shSH630 B
setup.shSH619 B
cors_token.txtTXT549 B
ssrf_listener.logLOG322 B
configTXT288 B
.gitignoreGITIGN278 B
entrypoint.shSH203 B
qrator_status.logLOG128 B
act.binBIN118 B
packed-refsTXT112 B
act2.binBIN110 B
act3.binBIN110 B
device.txtTXT93 B
descriptionTXT73 B
media_listener.logLOG73 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

1.234.83.89confirmed
101.36.112.205confirmed
102.209.224.40confirmed
103.117.136.137confirmed
103.131.51.199confirmed
103.133.216.219confirmed
103.35.216.13confirmed
110.93.250.7confirmed
114.110.182.150confirmed
115.29.202.62confirmed
118.25.25.81confirmed
122.166.178.204confirmed
122.186.156.66confirmed
128.30.224.82confirmed
13.140.130.141confirmed