Live findsCVE IntelConsoleStart free
huntback / IP intelligence

43.161.243.73

DATACENTERoperator-submittedloot-ipcoinminerexposed-secretmalwareopen-directory

Intelligence

ASN / OrgAS132203 · Shenzhen Tencent Computer Systems Company Limited
CountryHong Kong
NetworkDATACENTER · risk 60/100
Threat score0/100
Open ports22, 6443, 8001, 8080, 8091, 8888, 18080, 18081, 31337, 8090, 8181, 9001, 1099, 1389, 1391, 1392
ServiceSimpleHTTP/0.6 Python/3.12.3 · Directory listing for /
Productsnginx
Loot harvested417 file(s), 700088 KB · c2, coinminer, elf-binary, exploit, exposed-secret, forced-loot

Open directory contents (400)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
‹redacted›.jarJAR56.8 MB
‹redacted›.jarJAR56.8 MB
jre8.tar.gzGZ39.5 MB
‹redacted›.jarJAR37.3 MB
JNDIExploit.v1.2.zipZIP34.3 MB
oob_http_18081.logLOG19.3 MB
frps-r2TXT18.5 MB
oob_s049.logLOG18.3 MB
s17-impTXT17.8 MB
r4cms-linTXT17.8 MB
tc_implant_srvTXT17.8 MB
r8tcTXT17.7 MB
sliver_xTXT17.6 MB
r3dmzTXT17.6 MB
s031beaconTXT16.4 MB
s058fjTXT16.4 MB
tc-implTXT16.4 MB
r3dubboTXT15.3 MB
r3geoTXT15.3 MB
im_cactiTXT15.3 MB
implant_geoTXT15.3 MB
implant_pgTXT15.3 MB
icTXT15.3 MB
implant_p2TXT15.3 MB
fscanTXT10.1 MB
‹redacted›.jarJAR9.9 MB
chiselELF8.9 MB
fscanELF6.8 MB
348_oob_capture.logLOG6.3 MB
server.logLOG5.1 MB
http.logLOG5.0 MB
srv47331.logLOG4.6 MB
gogoELF4.1 MB
http8000.logLOG3.6 MB
imppkg.tar.gzGZ3.5 MB
http8490.logLOG3.5 MB
http.logLOG3.3 MB
http.logLOG3.1 MB
httpP.logLOG3.0 MB
http8487.logLOG3.0 MB
http8489.logLOG3.0 MB
s026_httpcb.logLOG2.4 MB
httpd.logLOG2.3 MB
httpd.logLOG2.3 MB
http.logLOG2.3 MB
‹redacted›.jarJAR2.3 MB
http5555.logLOG2.2 MB
server.logLOG2.2 MB
http8917.logLOG2.1 MB
http.logLOG2.1 MB
http.logLOG2.0 MB
server.logLOG2.0 MB
s030_http.logLOG2.0 MB
server.logLOG2.0 MB
httpd.logLOG2.0 MB
httpd.logLOG2.0 MB
s046_www.logLOG2.0 MB
oob.logLOG2.0 MB
s035b_jndi.logLOG1.4 MB
s022_jndi.logLOG1.4 MB
requests.logLOG1.4 MB
s046_jndi.logLOG1.4 MB
s049_jndi.logLOG1.2 MB
s019_oob.logLOG898 KB
‹redacted›.jarJAR776 KB
s096_dns.logLOG700 KB
oob152.logLOG661 KB
http.logLOG538 KB
s018_oob2.logLOG482 KB
s080_r_exfil.tar.gzGZ428 KB
s044_ldap.logLOG422 KB
hit.logLOG329 KB
ftp.logLOG278 KB
ftp2121.logLOG258 KB
s087_cb.logLOG254 KB
rsyncd.logLOG253 KB
s096_tcp.logLOG244 KB
‹redacted›.jarJAR228 KB
oob_s022.logLOG226 KB
‹redacted›.jarJAR226 KB
s026_oob.logLOG209 KB
raw30057.logLOG179 KB
s052ldap.logLOG177 KB
oob8100.logLOG161 KB
http.logLOG160 KB
hit.logLOG133 KB
r4_http.logLOG98 KB
s040_ldap_8443.logLOG91 KB
cap_21391.logLOG90 KB
ftp.logLOG89 KB
hits.logLOG83 KB
rsyncd.logLOG80 KB
cap_21392.logLOG76 KB
http8488.logLOG74 KB
http.logLOG71 KB
http.logLOG71 KB
1390.logLOG53 KB
registry.logLOG53 KB
s073_j_exfil.tar.gzGZ49 KB
s045oob.logLOG48 KB
ldap.logLOG46 KB
recv2.logLOG44 KB
sniff-1393.logLOG41 KB
sniff-1394.logLOG40 KB
sniff-1392.logLOG40 KB
sniff-1391.logLOG39 KB
sniff-1395.logLOG39 KB
hits.logLOG39 KB
oob_range3.logLOG35 KB
redir.logLOG34 KB
s076_og_exfil.tar.gzGZ33 KB
jndi9.logLOG30 KB
ldap41389.logLOG28 KB
ldapN.logLOG27 KB
ldapT.logLOG22 KB
s019_ldap_21390.logLOG20 KB
s017_ldap_21397.logLOG20 KB
ldapP.logLOG19 KB
ldapR.logLOG19 KB
ldapS.logLOG19 KB
s017_ldap_21399.logLOG19 KB
s012_ldap_21394.logLOG19 KB
s012_ldap_21396.logLOG17 KB
s042_ldap_21393.logLOG17 KB
s017_ldap_21398.logLOG17 KB
ldapQ.logLOG17 KB
‹redacted›.err.logLOG16 KB
httpd.logLOG16 KB
rsyncd.logLOG16 KB
s056_cap.logLOG15 KB
http15.logLOG15 KB
http17780b.logLOG15 KB
s061_keeper.logLOG14 KB
s026_web.tgzTGZ14 KB
‹redacted›.javaJAVA13 KB
‹redacted›.classMACHO13 KB
libcry2.soELF13 KB
‹redacted›.stdoutSTDOUT13 KB
recv.logLOG12 KB
zx_localconfig_body.txtTXT12 KB
‹redacted›.decDEC12 KB
http.logLOG12 KB
http.logLOG11 KB
‹redacted›.classMACHO11 KB
rsyncd-s012.logLOG10 KB
jndi2.logLOG10 KB
s043_pane.txtTXT10 KB
server.logLOG9 KB
ldap_ref.logLOG9 KB
‹redacted›.outOUT9 KB
registry.logLOG9 KB
‹redacted›.classMACHO9 KB
jndi5.logLOG8 KB
‹redacted›.javaJAVA8 KB
zx_zimbra_xxe.pyPY7 KB
‹redacted›.javaJAVA7 KB
‹redacted›.outOUT6 KB
s061_cap.logLOG6 KB
‹redacted›.classMACHO6 KB
.selfT.binMACHO6 KB
‹redacted›.classMACHO6 KB
‹redacted›.classMACHO6 KB
http.logLOG6 KB
jndi6.logLOG6 KB
evil_registry.pyPY6 KB
http.logLOG6 KB
‹redacted›.classMACHO6 KB
‹redacted›.classMACHO5 KB
‹redacted›.classMACHO5 KB
‹redacted›.javaJAVA5 KB
‹redacted›.classMACHO5 KB
‹redacted›.classMACHO5 KB
fakeftp.pyPY5 KB
‹redacted›.javaJAVA5 KB
‹redacted›.javaJAVA5 KB
‹redacted›.classMACHO4 KB
oob_s016_39641.logLOG4 KB
‹redacted›.javaJAVA4 KB
zx_fileread.pyPY4 KB
s026_oob_stdout.logLOG4 KB
‹redacted›.javaJAVA4 KB
s046_ldap.logLOG4 KB
‹redacted›.javaJAVA4 KB
s25_redis_probe.pyPY4 KB
s061_rig.pyPY4 KB
‹redacted›.classMACHO4 KB
‹redacted›.classMACHO3 KB
‹redacted›.javaJAVA3 KB
‹redacted›.javaJAVA3 KB
fakecap_s040.pyPY3 KB
socat1401.logLOG3 KB
‹redacted›.classMACHO3 KB
ldap_ref.pyPY3 KB
ldap_ref3.pyPY3 KB
r3_CommonsCollections4.binBIN3 KB
ldap_ref2.pyPY3 KB
pwn.cC3 KB
‹redacted›.classMACHO3 KB
‹redacted›.bodyBODY3 KB
s045oob.pyPY3 KB
‹redacted›.classMACHO3 KB
r3_CommonsCollections2.binBIN3 KB
s044oob.pyPY3 KB
‹redacted›.javaJAVA3 KB
s041_ldap.logLOG3 KB
s079_harvest_excerpt.logLOG2 KB
s061_keeper.pyPY2 KB
‹redacted›.javaJAVA2 KB
r3_px.binBIN2 KB
ldap44449.pyPY2 KB
xxe9381.logLOG2 KB
ldap44447.pyPY2 KB
ldap44448.pyPY2 KB
ldap44450.pyPY2 KB
ldap44445.pyPY2 KB
ldap44446.pyPY2 KB
ldap44444.pyPY2 KB
ldap44444.py.bak_s062BAK_S02 KB
ldap44444.py.bak_s064BAK_S02 KB
ldap44444.py.bak_s065BAK_S02 KB
ldap44444.py.bak_s066BAK_S02 KB
ldap44444.py.bak_s067BAK_S02 KB
ldap44444.py.bak_s072BAK_S02 KB
ldap44444.py.bak_s073BAK_S02 KB
ldap44444.py.bak_s076BAK_S02 KB
r4_collect.logLOG2 KB
r3_rr.binBIN2 KB
s25s2.pyPY2 KB
jndi.logLOG2 KB
http8484v2.pyPY2 KB
s047_ldap.logLOG2 KB
r3_combo.binBIN2 KB
‹redacted›.bodyBODY2 KB
run.logLOG2 KB
frps-r2.logLOG2 KB
ftp.pyPY2 KB
r3_pc.binBIN2 KB
http8484v2.py.bak_s076BAK_S02 KB
‹redacted›.javaJAVA2 KB
http8484v2.py.bak_s075BAK_S01 KB
‹redacted›.javaJAVA1 KB
ftplog.pyPY1 KB
http8484v2.py.bak_s072BAK_S01 KB
s026_recon.shSH1 KB
rec.shSH1 KB
r4xgo.shSH1 KB
http8484v2.py.bak_s066BAK_S01 KB
r3_base.binBIN1 KB
probe.shSH1 KB
http8484v2.py.bak_s065fixBAK_S01 KB
http8484v2.py.bak_s067BAK_S01 KB
jndi8.logLOG1 KB
r3_base2.binBIN1 KB
http8484v2.py.bak_s065BAK_S01 KB
probe_http.shSH1 KB
s040_fake.keyKEY1 KB
key.pemPEM1 KB
r3_dbg.binBIN1 KB
http8484v2.py.bak_s064BAK_S01 KB
r3_chk3.binBIN1 KB
r3_chk2.binBIN1 KB
http17780.logLOG1 KB
clean.phpPHP1 KB
http8484v2.py.bak_s062BAK_S01 KB
r4go2.shSH1 KB
r3_fg.binBIN1 KB
r3_rr2.binBIN1 KB
s049_ldap.logLOG1 KB
http8490.pyPY1 KB
http8488.pyPY1 KB
http.logLOG1 KB
r3_sd2.binBIN1 KB
r3_chk.binBIN1 KB
http8486.pyPY1 KB
http8489.pyPY1 KB
http8487.pyPY1 KB
ftp_s052.pyPY1 KB
r3_shell.binBIN1 KB
plaincap_s056.pyPY1 KB
r3_rev2.binBIN1 KB
r3_tools.binBIN1 KB
index.txtTXT1 KB
s012_probehttp.tar.gzGZ1 KB
s045oob.log.bakBAK1 KB
jndiexp.logLOG1 KB
ExploitB%241.classMACHO1 KB
r3_alive.binBIN1 KB
r3_CommonsCollections6.binBIN1 KB
Exploit%241.classMACHO1 KB
ExploitC%241.classMACHO1 KB
r4ex4go.shSH1 KB
r3_sleep.binBIN1 KB
jndi3.logLOG1 KB
listener.pyPY1 KB
rawlog.pyPY1 KB
tcplog.pyPY1 KB
r4ex3go.shSH1 KB
r4ex2go.shSH1 KB
s020w3_nohup.logLOG1 KB
step1.logLOG1 KB
probe2.shSH1 KB
sniff-1392c.logLOG1 KB
‹redacted›.javaJAVA1 KB
‹redacted›.classMACHO1 KB
cert.pemPEM1 KB
r4ex8go.shSH1 KB
r4ex6go.shSH1 KB
r4ex7go.shSH1 KB
http8484.pyPY1 KB
r4chkgo.shSH1 KB
r3_inner_px.shSH1 KB
zx.logLOG1 KB
‹redacted›.classMACHO1 KB
‹redacted›.classMACHO1 KB
‹redacted›.javaJAVA1 KB
listen_18099.pyPY1 KB
‹redacted›.javaJAVA1 KB
listen_18031.pyPY1 KB
imapfake.pyPY1007 B
p.phpPHP993 B
cap.pyPY961 B
s026_httplogger.pyPY931 B
s047wrap.pyPY904 B
conn_18443.logLOG894 B
http18080.logLOG873 B
‹redacted›.xmlXML872 B
cb_srv.pyPY867 B
tcplog.pyPY843 B
r3_inner_rr.shSH833 B
ref-ser.binBIN828 B
r4ex5go.shSH809 B
rawlog.pyPY800 B
run.logLOG773 B
s074_oob.pyPY751 B
.selfTB.binMACHO749 B
ExploitH%24Both.classMACHO749 B
ExploitN%24Both.classMACHO749 B
ExploitO%24Both.classMACHO749 B
ExploitR%24Both.classMACHO749 B
‹redacted›.xmlXML742 B
s039oob.pyPY732 B
r4ex5bgo.shSH719 B
‹redacted›.classMACHO680 B
s060-oob.pyPY677 B
server.pyPY676 B
jndi7.logLOG649 B
s.shSH637 B
r4mkgo.shSH635 B
httpd.pyPY635 B
stderr.logLOG623 B
r3_inner_pc.shSH606 B
s059_round4_excerpt.logLOG593 B
collect.pyPY544 B
r5inv.logLOG528 B
rawlog.pyPY521 B
tcplog.pyPY515 B
‹redacted›.outOUT505 B
‹redacted›.xmlXML494 B
redir.pyPY484 B
probe.shSH480 B
rawlsn.pyPY477 B
s047wrap.logLOG461 B
jndi4.logLOG455 B
fakecap_s040_run.logLOG453 B
echo_last.txtTXT431 B
‹redacted›.xmlXML376 B
chisel_srv.logLOG372 B
‹redacted›.xmlXML370 B
sniff.pyPY353 B
rawserve.pyPY341 B
r4chk.sqlSQL334 B
diag2.shSH325 B
zxfr.logLOG309 B
r4_udt.sqlSQL303 B
r3_inner_dbg.shSH297 B
pc.plPL296 B
diag.shSH284 B
cap_imap_events.logLOG272 B
1389.logLOG270 B
s040_cap.logLOG256 B
cap_imaptls_events.logLOG232 B
ssrf_cb.logLOG222 B
tcpdump.logLOG207 B
s17-http40080.logLOG205 B
srv.logLOG205 B
sniff-1392b.logLOG199 B
s074-oob.logLOG185 B
rsyncd.confCONF170 B
evil.dtd.http8100.bakBAK167 B
hits.logLOG145 B
‹redacted›.dtdDTD134 B
h9000.logLOG133 B
s018_listener.logLOG129 B
connections.logLOG129 B
s.shSH120 B
dns15353.logLOG117 B
egress_test.logLOG92 B
s044oob.logLOG87 B
‹redacted›.outOUT84 B
out.logLOG81 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

101.42.136.73confirmed
102.204.222.159confirmed
102.210.149.166confirmed
103.214.172.114confirmed
103.46.185.169confirmed
108.61.219.168confirmed
111.223.247.165confirmed
118.107.13.102confirmed
118.107.41.239confirmed
118.25.25.81confirmed
122.10.110.72confirmed
122.10.17.49confirmed
139.224.113.180confirmed
149.30.245.147confirmed
15.188.163.78confirmed