Live findsCVE IntelResearchConsoleStart free
huntback / IP intelligence

43.135.35.8

DATACENTERoperator-submittedloot-ipc2exploitexposed-secretmacho-binary

Intelligence

ASN / OrgAS132203 · Shenzhen Tencent Computer Systems Company Limited
CountryHong Kong
NetworkDATACENTER · risk 60/100
Threat score0/100
Open ports22, 80, 7000, 9001
ServiceSimpleHTTP/0.6 Python/3.12.3 · Directory listing for /
Loot harvested582 file(s), 34227 KB · c2, exploit, exposed-secret, macho-binary, malware, mozi

Open directory contents (400)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
f_final.txtTXT8.3 MB
tail.binBIN3.8 MB
‹redacted›.outOUT3.8 MB
posts_raw.htmlHTML3.7 MB
b.jsJS2.6 MB
admin.jsJS2.2 MB
ug.jsJS1.8 MB
r1.txtTXT1.6 MB
qp_brute3.logLOG611 KB
index.jsJS440 KB
f1.txtTXT359 KB
acme.shSH294 KB
ex.binBIN254 KB
vendor-%40codemirror-CfmfA40d.jsJS251 KB
omega.bakBAK153 KB
‹redacted›.mobileconfigMOBILE137 KB
‹redacted›.mobileconfigMOBILE137 KB
vendor-%40vue-CpnZ42ug.jsJS115 KB
tjcms_app.jsJS111 KB
oast.logLOG103 KB
‹redacted›.outOUT100 KB
index-DapuN777.jsJS70 KB
cookies_CB1FIX.tsvTSV70 KB
p52TXT69 KB
cookies_CommonsBeanutils1.tsvTSV69 KB
nmap.logLOG67 KB
a1.htmlCOM56 KB
qp_brute2.logLOG56 KB
vendor-postcss-DJcOdXCf.jsJS55 KB
vendor-%40lezer-CLEUkI31.jsJS53 KB
xff_scan.logLOG53 KB
wp.htmlHTML51 KB
mymy_php_watch.logLOG44 KB
functions.jsJS44 KB
vendor-sortablejs-DX4Eo9OF.jsJS36 KB
tor_rt.logLOG35 KB
vendor-%40fingerprintjs-BzauNsPl.jsJS35 KB
list-CcuJWIVV.jsJS33 KB
statistics-aB4gN3vE.jsJS32 KB
site-BOPaRZdJ.jsJS31 KB
rapid.htmlHTML30 KB
nmap1.logLOG28 KB
index-CMlUX9F4.jsJS26 KB
xinzeng-CD8xuELs.jsJS26 KB
util.jsJS26 KB
vendor-vuex-D6ly1xU6.jsJS23 KB
nc.htmlHTML23 KB
words.txtTXT23 KB
kefu-front.jsJS23 KB
‹redacted›.jsonlJSONL23 KB
vendor-qrcode-BdQkpTM7.jsJS22 KB
2fa_live.htmlHTML21 KB
nmap2.logLOG21 KB
‹redacted›.mcMC20 KB
yh-CKPqUxCd.jsJS19 KB
route-map.txtTXT18 KB
apt2.logLOG18 KB
‹redacted›.mobileconfigMOBILE18 KB
config-4P80R8PD.jsJS17 KB
index-aX_d79nh.jsJS17 KB
prof.htmlHTML16 KB
vendor-fast-uri-CNBtHUA9.jsJS16 KB
px.logLOG15 KB
message-renderer.jsJS15 KB
vendor-sanitize-html-Cbh6nWn9.jsJS15 KB
index-DHdhoGUx.jsJS14 KB
api.htmlHTML14 KB
allapis.txtTXT13 KB
nmap_kefu.logLOG13 KB
admin-JRwz9x00.jsJS13 KB
u5zb_spray.pyPY12 KB
operationLog-D8hoTvjH.jsJS11 KB
u5zb_spray2.pyPY11 KB
chuhaitg_login.htmlHTML10 KB
createOneUser-DM0VQGYl.jsJS10 KB
tunnel.logLOG10 KB
eps.txtTXT10 KB
index-Bob3HT0s.jsJS10 KB
index-Ct5PZwyL.jsJS10 KB
index-D1ayRbZO.jsJS10 KB
index-qWg0JelG.jsJS9 KB
vendor-ajv-formats-FA_0-wtM.jsJS9 KB
000001.logLOG9 KB
index-CngRfidm.jsJS9 KB
‹redacted›.errERR9 KB
vendor-clipboard-Bjil2rha.jsJS9 KB
cookies_DNSFIX.tsvTSV8 KB
cookies_TOP12.tsvTSV8 KB
wave2.logLOG8 KB
cookies_URLDNS.tsvTSV8 KB
l2.htmlHTML7 KB
l.htmlHTML7 KB
callback.logLOG7 KB
vendor-%40vueup-BnJThjuQ.jsJS7 KB
‹redacted›.pycPYC7 KB
‹redacted›.pycPYC7 KB
cf.logLOG7 KB
qp_rockyou2.logLOG6 KB
‹redacted›.pycPYC6 KB
api_wave2.pyPY6 KB
cf2.logLOG6 KB
‹redacted›.pycPYC6 KB
yzfs-CZrJk6LK.jsJS6 KB
api_wave7.pyPY6 KB
page-libo_xgram_me_telegram_login.htmlHTML6 KB
dl.txtTXT5 KB
z.9834909834905 KB
api_wave6.pyPY5 KB
oast.pyPY5 KB
lg.htmlHTML5 KB
r_d7c3b31b.binBIN5 KB
u5zb_spray3.pyPY5 KB
r_f41f15e6.binBIN5 KB
cq.pyPY5 KB
page-libo_xgram_me_register.htmlHTML5 KB
all_uapi.txtTXT5 KB
api_wave5.pyPY5 KB
page-libo_xgram_me_login.htmlHTML5 KB
nav.htmlHTML5 KB
‹redacted›.pycPYC5 KB
nav2.htmlHTML5 KB
wave3.logLOG5 KB
vps_write.pyPY5 KB
flconfig-Dklnj8H2.jsJS4 KB
api_surface_enum.pyPY4 KB
admTXT4 KB
sp_enum.pyPY4 KB
tenant.logLOG4 KB
pslist.txtTXT4 KB
‹redacted›.pycPYC4 KB
api_wave4.pyPY4 KB
tor_install.logLOG4 KB
‹redacted›.pycPYC4 KB
callback_tls.pyPY4 KB
nm3.logLOG4 KB
vps_write2.pyPY4 KB
wave7.logLOG3 KB
api_wave3.pyPY3 KB
fire2.pyPY3 KB
callback_server.pyPY3 KB
fire.pyPY3 KB
new_uapi.txtTXT3 KB
qzrpc.pyPY3 KB
a7TXT3 KB
adTXT3 KB
ad7TXT3 KB
brute8.pyPY3 KB
round1b.pyPY3 KB
brute7.pyPY3 KB
api_tenant_sweep.pyPY3 KB
brute6.pyPY3 KB
r_auth.logLOG3 KB
wave7-webhookinfo.jsonJSON3 KB
qp_brute.logLOG3 KB
page-libo_xgram_me_js_chong-js.js.htmlHTML3 KB
wk_connect.pyPY3 KB
brute_t.pyPY3 KB
chat-security.jsJS3 KB
prim.shSH3 KB
brute4.pyPY3 KB
sqltest2.pyPY3 KB
round1.pyPY2 KB
round2.pyPY2 KB
atlist.pyPY2 KB
brute9.pyPY2 KB
sqltest.pyPY2 KB
wk15001_unauth_poc.pyPY2 KB
‹redacted›.classMACHO2 KB
blogcred.pyPY2 KB
callback_https.logLOG2 KB
brute2.pyPY2 KB
fire3.pyPY2 KB
sqltest3.pyPY2 KB
tl_brute.pyPY2 KB
tl_brute2.pyPY2 KB
tc.shSH2 KB
rn.shSH2 KB
p.binBIN2 KB
‹redacted›.classMACHO2 KB
sx.shSH2 KB
clean.pyPY2 KB
brute3.pyPY2 KB
mysql_try.pyPY2 KB
se.shSH2 KB
nt12.shSH2 KB
wave5.logLOG2 KB
su.shSH2 KB
fin.pyPY2 KB
wave6.logLOG2 KB
sr.shSH2 KB
sv.shSH2 KB
tl_proxy.pyPY2 KB
sy.shSH2 KB
proxy_fetch.pyPY2 KB
b2.shSH2 KB
visitor-auth.jsJS2 KB
up3.pyPY2 KB
wave4.logLOG2 KB
owg.shSH2 KB
sb.shSH2 KB
nt13.shSH2 KB
up2.pyPY2 KB
brute.pyPY2 KB
userEdit-DkLEWWNT.jsJS2 KB
listener.pyPY2 KB
nt14.shSH2 KB
‹redacted›.javaJAVA2 KB
up.pyPY2 KB
vps_tor.pyPY2 KB
rr.shSH2 KB
v5.jsJS2 KB
tb.pyPY2 KB
shiro_gen.shSH2 KB
nt24.shSH2 KB
nt8.shSH2 KB
rq.shSH2 KB
nt17.shSH2 KB
nt6.shSH2 KB
t0.shSH2 KB
xss2.pyPY2 KB
sj.shSH2 KB
tl_probe.pyPY2 KB
aws-upfile-EJthEWxs.jsJS2 KB
g3.pyPY2 KB
dnslog_oracle.pyPY2 KB
re.shSH1 KB
wb_proxy.pyPY1 KB
nt22.shSH1 KB
tl.pyPY1 KB
prim3.shSH1 KB
nt1.shSH1 KB
ru.shSH1 KB
s37.shSH1 KB
nt3.shSH1 KB
shiro_build.shSH1 KB
prim2.shSH1 KB
nt2.shSH1 KB
p3.pyPY1 KB
wk_header_probe.pyPY1 KB
tb2.pyPY1 KB
s4.shSH1 KB
wb_proxy2.pyPY1 KB
rx.shSH1 KB
rp.shSH1 KB
last_show.txtTXT1 KB
tl2.pyPY1 KB
oob9001.logLOG1 KB
rv.shSH1 KB
s38.shSH1 KB
grab.pyPY1 KB
sp.shSH1 KB
edge.shSH1 KB
s17.shSH1 KB
test_ref.pyPY1 KB
‹redacted›.javaJAVA1 KB
s40.shSH1 KB
si.shSH1 KB
nt15.shSH1 KB
probe.shSH1 KB
p6.shSH1 KB
ssrf-export.txtTXT1 KB
sa.shSH1 KB
nt16.shSH1 KB
sk.shSH1 KB
biz6.shSH1 KB
shiro_run.shSH1 KB
rz.shSH1 KB
b3.shSH1 KB
pay2.pyPY1 KB
biz7.shSH1 KB
r5.shSH1 KB
sf.shSH1 KB
zipparse.pyPY1 KB
origin_ports.shSH1 KB
acme_issue.shSH1 KB
rj.shSH1 KB
scripts.pyPY1 KB
nt19.shSH1 KB
so.shSH1 KB
wave6-gate.jsonJSON1 KB
sq.shSH1 KB
s29.shSH1 KB
nt20.shSH1 KB
ro.shSH1 KB
s42.shSH1 KB
biz11.shSH1 KB
cmp.pyPY1 KB
s19.shSH1 KB
p3.shSH1 KB
nt10.shSH1 KB
sl.shSH1 KB
ry.shSH1 KB
biz13.shSH1 KB
diag.pyPY1 KB
biz10.shSH1 KB
nt23.shSH1 KB
pay_test.pyPY1 KB
nt9.shSH1 KB
st.shSH1 KB
ls.pyPY1 KB
mgr.shSH1 KB
sw.shSH1 KB
‹redacted›.rawRAW1 KB
s16.shSH1 KB
g2.pyPY1 KB
biz8.shSH1 KB
lst.shSH1 KB
cap4.b64B641 KB
s26.shSH1 KB
s45.shSH1 KB
xsscheck.pyPY1 KB
rd.shSH1 KB
s21.shSH1 KB
biz14.shSH1 KB
p5.shSH1 KB
r8.shSH1 KB
vendor-dijkstrajs-BpQx4zJP.jsJS1 KB
r7.shSH1 KB
p4.shSH1 KB
tor.logLOG1 KB
kps99_exploit_setup.logLOG1 KB
biz9.shSH1 KB
hitlogger.pyPY1 KB
p7.shSH1 KB
s7.shSH1 KB
tl_direct.pyPY1 KB
ovs.shSH1 KB
s8.shSH1 KB
s32.shSH1 KB
prim4.shSH1 KB
s43.shSH1 KB
biz12.shSH1 KB
bplan.shSH1 KB
r2.shSH1 KB
ssrf_listen.pyPY1 KB
sg.shSH1 KB
s41.shSH1 KB
ovm.shSH1 KB
recheck.pyPY1 KB
p8.shSH1 KB
t2.pyPY1 KB
p2.shSH1 KB
s6.shSH1 KB
s10.shSH1 KB
closeout.shSH1 KB
sm.shSH1 KB
nt4.shSH1 KB
mw.shSH1 KB
rc.shSH1 KB
acme_install.shSH1 KB
rb.shSH1 KB
rf.shSH1 KB
s27.shSH1 KB
clean80.shSH1018 B
‹redacted›.hdrHDR1010 B
s4.shSH1005 B
nt5.shSH993 B
wbproxy2.logLOG993 B
s15.shSH992 B
nt28.shSH988 B
s35.shSH988 B
sz.shSH977 B
s44.shSH968 B
st1b.shSH966 B
oast.pyPY965 B
‹redacted›.rawRAW962 B
g5.pyPY954 B
s3.shSH950 B
s6.shSH948 B
ae.shSH940 B
s36.shSH938 B
pd2.shSH934 B
nt11.shSH933 B
s9.shSH925 B
otx.shSH916 B
mysql.txtTXT911 B
ta.shSH907 B
b1.396952396952896 B
i.shSH890 B
probe2.shSH890 B
j64.shSH887 B
g4.pyPY882 B
s12.shSH873 B
tb.shSH852 B
g6.pyPY851 B
nt25.shSH845 B
probe.shSH845 B
origin_probe.shSH841 B
s22.shSH839 B
nt18.shSH833 B
hit5.logLOG832 B
‹redacted›.hdrHDR831 B
cap2.b64B64828 B
biz.shSH828 B
check_front.shSH827 B
ri.shSH827 B
‹redacted›.rawRAW826 B
ul.shSH818 B
keys_BeanShell1.txtTXT813 B
rig.shSH809 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

104.21.53.99confirmed
104.233.217.108confirmed
108.61.161.224confirmed
168.144.111.89confirmed
172.67.211.156confirmed
23.19.231.52confirmed
94.130.22.61confirmed