Live findsCVE IntelResearchConsoleStart free
huntback / IP intelligence

39.104.70.157

DATACENTERoperator-submittedloot-ipexploitexposed-secretmalwaremozi

Intelligence

ASN / OrgAS37963 · Hangzhou Alibaba Advertising Co.,Ltd.
CountryChina
NetworkDATACENTER · risk 60/100
Threat score0/100
Open ports22, 8000
ServiceSimpleHTTP/0.6 Python/3.12.3 · Directory listing for /
Loot harvested272 file(s), 4302 KB · exploit, exposed-secret, malware, mozi, tsunami

Open directory contents (272)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
‹redacted›.jarJAR2.4 MB
‹redacted›.jarJAR690 KB
http8000.logLOG397 KB
pwall.txtTXT158 KB
pw.txtTXT158 KB
‹redacted›.jarJAR93 KB
i882srv.logLOG29 KB
‹redacted›.outOUT8 KB
w895_w895_takeover.pyPY7 KB
http8911.logLOG6 KB
install2.pyPY4 KB
‹redacted›.jarJAR4 KB
w895_p_forge.pyPY3 KB
probe_nacos.pyPY3 KB
install7.pyPY3 KB
upload4.pyPY3 KB
upm_matrix.pyPY3 KB
install8.pyPY3 KB
w895_p_biz.pyPY3 KB
enable.pyPY2 KB
w867r10.pyPY2 KB
w895_probe2.pyPY2 KB
enable2.pyPY2 KB
upload5.pyPY2 KB
upload6.pyPY2 KB
poll_ins.pyPY2 KB
upload3.pyPY2 KB
w895_p_ssrf1.pyPY2 KB
ws.pyPY2 KB
did_sweep.pyPY2 KB
pg.pyPY2 KB
install_plugin.pyPY2 KB
cve22527c.pyPY2 KB
cve22527b.pyPY2 KB
nacos_probe2.pyPY2 KB
exp11.pyPY2 KB
‹redacted›.jarJAR2 KB
w895_p_inj.pyPY2 KB
w895_p_route2.pyPY2 KB
w895_p_id4.pyPY2 KB
ns_matrix2.pyPY2 KB
w867r58.pyPY2 KB
upmtok2.pyPY2 KB
nacos_bypass.pyPY2 KB
cve22515.pyPY2 KB
nacos_brute.pyPY2 KB
s3list.pyPY2 KB
w895_p_id3.pyPY2 KB
w867r20.pyPY2 KB
w867r49.pyPY2 KB
w895_p_id1.pyPY2 KB
nacos_nsbrute.pyPY2 KB
w895_p_audit.pyPY2 KB
websudo2.pyPY1 KB
ns_oracle2.pyPY1 KB
dbg_upm.pyPY1 KB
w867r3.pyPY1 KB
exp8.pyPY1 KB
w895_p_audit2.pyPY1 KB
check3.pyPY1 KB
w867r24.pyPY1 KB
w895_p_user2.pyPY1 KB
keyinfo.pyPY1 KB
w867r11.pyPY1 KB
sweep_public.pyPY1 KB
exp10.pyPY1 KB
exp21.pyPY1 KB
brute_t.pyPY1 KB
nacos_oracle.pyPY1 KB
w867r67.pyPY1 KB
cve22515b.pyPY1 KB
exp9.pyPY1 KB
w895_p_id2.pyPY1 KB
w895_p_audit3.pyPY1 KB
‹redacted›.outOUT1 KB
upload2.pyPY1 KB
nacos_tok.pyPY1 KB
w867r23.pyPY1 KB
conf_admin_info.pyPY1 KB
w867r35.pyPY1 KB
w867r16.pyPY1 KB
cve22527.pyPY1 KB
nacos_ns.pyPY1 KB
w867r29.pyPY1 KB
w895_p_sysauth.pyPY1 KB
cve22527d.pyPY1 KB
nacos_cfgmatrix.pyPY1 KB
w867r41.pyPY1 KB
w895_p_pathbypass.pyPY1 KB
exp13.pyPY1 KB
cve22515c.pyPY1 KB
w867r22.pyPY1 KB
nacos_login.pyPY1 KB
w895_p_routes.pyPY1 KB
exp1.pyPY1 KB
w867r63.pyPY1 KB
cve22515d.pyPY1 KB
v1auth.pyPY1 KB
w867r33.pyPY1 KB
w867r27.pyPY1 KB
w867r15.pyPY1 KB
w867r19.pyPY1 KB
w895_p_map1.pyPY1 KB
nacos_secret.pyPY1 KB
w867r34.pyPY1 KB
exp19.pyPY1 KB
exp5.pyPY1 KB
w867r14.pyPY1 KB
trav.pyPY1 KB
ep_enum.pyPY1 KB
exp22.pyPY1 KB
serv.pyPY1 KB
exp3.pyPY1 KB
websudo.pyPY1 KB
brute2.pyPY1 KB
w867r55.pyPY1 KB
upm_token.pyPY1 KB
jsgrep.pyPY1 KB
exp6.pyPY1 KB
w895_p_mcpres.pyPY1 KB
exp7.pyPY1 KB
w867r21.pyPY1 KB
brute_nacos.pyPY1 KB
ovpn_probe.pyPY1 KB
w867r43.pyPY1 KB
w867r26.pyPY1 KB
exp2.pyPY1 KB
conf_login.pyPY1 KB
w867r51.pyPY1 KB
nacos_sid.pyPY1 KB
final_probe.pyPY1 KB
v1check.pyPY1 KB
exp17.pyPY1 KB
w867r2.pyPY1 KB
nacos_put.pyPY1 KB
w895_p_idmcp.pyPY1 KB
w895_p_brute1.pyPY1 KB
w895_p_mem.pyPY1 KB
w867r17.pyPY1 KB
w867r1.pyPY1 KB
exp23.pyPY1 KB
exp16.pyPY1 KB
q.pyPY1 KB
exp18.pyPY1 KB
tcp443_probe.pyPY1 KB
w867r60.pyPY1 KB
w895_p_env2.pyPY1 KB
‹redacted›.javaJAVA1 KB
exp24.pyPY1 KB
exp20.pyPY1 KB
exp4.pyPY1 KB
w867r39.pyPY1 KB
rc.pyPY1 KB
js_recon.pyPY1 KB
check2.pyPY1 KB
w895_w895_lsn.pyPY1 KB
w867r64.pyPY1 KB
exp12.pyPY1 KB
p10.pyPY1 KB
w867r47.pyPY1 KB
w895_p_pids.pyPY1 KB
fp_internal.pyPY1 KB
w867r52.pyPY1017 B
exec_cf.pyPY994 B
leaksearch.pyPY976 B
trav2.pyPY969 B
w867r48.pyPY957 B
forensics.shSH943 B
srv8001.pyPY938 B
w867r40.pyPY938 B
cf_test.pyPY937 B
w895_probe1.pyPY931 B
w895_p_brute2.pyPY915 B
w895_p_apidocs3.pyPY902 B
w895_p_suid.pyPY887 B
exp15.pyPY881 B
w867r25.pyPY876 B
http.logLOG873 B
fetch_cfg.pyPY860 B
w895_recon.pyPY855 B
check_plugin.pyPY854 B
w895_chk4.pyPY853 B
w895_findcode.pyPY838 B
uprobe.pyPY827 B
w867r30.pyPY808 B
w867r28.pyPY800 B
probe8091.pyPY760 B
w867r53.pyPY748 B
biz_act.pyPY742 B
w895_p_scan.pyPY721 B
js3.pyPY713 B
w867r13.pyPY703 B
w867r31.pyPY696 B
w895_recon2.pyPY692 B
w895_p_scan2.pyPY686 B
w867r32.pyPY677 B
oob_server.pyPY670 B
‹redacted›.javaJAVA669 B
wrap.shSH668 B
w867r4.pyPY655 B
curated.txtTXT654 B
w867r61.pyPY650 B
w867r50.pyPY636 B
w895_p_dns.pyPY628 B
w895_p_env3.pyPY619 B
w895_p_core.pyPY610 B
w867r37.pyPY594 B
w867r12.pyPY590 B
w895_p_apidocs.pyPY583 B
js2.pyPY580 B
scan.pyPY578 B
w895_p_fcap.pyPY576 B
scan2.pyPY571 B
w867r36.pyPY570 B
w895_p_apidocs2.pyPY545 B
w895_rc11.pyPY534 B
w867r42.pyPY511 B
w867r56.pyPY505 B
w895_readcode.pyPY498 B
w895_p_mount.pyPY497 B
w895_p_health.pyPY492 B
w867r5.pyPY490 B
w895_rc7.pyPY486 B
w895_chk2.pyPY481 B
w895_p_cap.pyPY475 B
probe.shSH463 B
w895_w895_start2.pyPY462 B
leak.logLOG451 B
w867r66.pyPY445 B
w895_chk3.pyPY435 B
w867r54.pyPY417 B
w867r65.pyPY408 B
w895_rc9.pyPY391 B
w867r38.pyPY389 B
pchk.pyPY375 B
w895_p_core2.pyPY356 B
w895_readcode3.pyPY353 B
w867r44.pyPY344 B
w895_p_health2.pyPY331 B
w895_rc4.pyPY329 B
w895_rc5.pyPY329 B
w867r59.pyPY327 B
w867r45.pyPY321 B
w895_readcode2.pyPY321 B
w895_chk.pyPY320 B
mrun.shSH306 B
state.pyPY285 B
x.shSH242 B
w867r6.pyPY239 B
qrun2.shSH236 B
w867r9.pyPY235 B
w867r57.pyPY219 B
w895_rc6.pyPY218 B
mqcompile.shSH202 B
qrun.shSH187 B
q.txtTXT178 B
w867r7.pyPY178 B
w867r18.pyPY175 B
compile.shSH173 B
mqrun.shSH169 B
r.shSH162 B
w867r46.pyPY162 B
run.shSH161 B
w895_rc8.pyPY161 B
w895_rc10.pyPY160 B
w867r62.pyPY147 B
w895_readssrf.pyPY119 B
p.txtTXT114 B
oob_hits.logLOG110 B
w867r8.pyPY96 B
mfetch.shSH94 B
w867big.pyPY35 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

178.62.235.52confirmed
198.44.116.69confirmed
204.168.225.59confirmed
207.56.221.47confirmed
43.161.243.73confirmed
46.166.162.142confirmed
49.51.230.17confirmed
91.92.241.101confirmed