Live findsCVE IntelResearchConsoleStart free
huntback / IP intelligence

47.236.83.240

DATACENTERoperator-submittedc2exploitexposed-secretmacho-binarymalware

Intelligence

ASN / OrgAS45102 · Alibaba (US) Technology Co., Ltd.
CountryUnited States
NetworkDATACENTER · risk 60/100
Threat score0/100
Open ports22, 80, 443, 8080, 8090, 8091, 8888, 8898, 8899, 50050
Servicenginx · NBtrx — Telegram Business Infrastructure
Productsnginx
Loot harvested65 file(s), 7975 KB · c2, exploit, exposed-secret, macho-binary, malware, pe-binary

Open directory contents (65)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
q8n2w5m9t4.exePE736 KB
zt7erwfbmc.exePE733 KB
entry1_type0x0a.binBIN495 KB
‹redacted›.dylibMACHO325 KB
‹redacted›.dylibMACHO325 KB
‹redacted›.dylibMACHO322 KB
‹redacted›.dylibMACHO293 KB
‹redacted›.dylibMACHO293 KB
‹redacted›.dylibMACHO277 KB
‹redacted›.dylibMACHO277 KB
‹redacted›.dylibMACHO257 KB
‹redacted›.dylibMACHO243 KB
‹redacted›.dylibMACHO242 KB
‹redacted›.dylibMACHO226 KB
‹redacted›.dylibMACHO225 KB
‹redacted›.dylibMACHO223 KB
377bed7460f7538f96bbad7bdc2b8294bdc54599.binBIN219 KB
‹redacted›.dylibMACHO192 KB
‹redacted›.dylibMACHO187 KB
‹redacted›.dylibMACHO186 KB
‹redacted›.silentSILENT170 KB
Stage3_VariantB.jsJS169 KB
38af3c8ba461079a0edc83585023f76843066dcf.binBIN153 KB
‹redacted›.dylibMACHO102 KB
‹redacted›.dylibMACHO87 KB
‹redacted›.dylibMACHO86 KB
‹redacted›.dylibMACHO86 KB
Stage2_16.3_16.5.1_seedbell.jsJS69 KB
‹redacted›.dylibMACHO67 KB
Stage1_15.6_16.1.2_bluebird.jsJS63 KB
‹redacted›.dylibMACHO50 KB
‹redacted›.dylibMACHO50 KB
‹redacted›.dylibMACHO49 KB
‹redacted›.dylibMACHO49 KB
Stage2_15.0_16.2_breezy15.jsJS41 KB
Stage1_16.2_16.5.1_terrorbird.jsJS40 KB
platform_module.jsJS32 KB
group.htmlHTML29 KB
group.html.bak.c2C229 KB
Stage2_17.0_17.2.1_seedbell.jsJS29 KB
‹redacted›.registerREGIST29 KB
utility_module.jsJS27 KB
entry4_type0x05.binBIN24 KB
Stage1_15.2_15.5_jacurutu.jsJS23 KB
entry1_type0x0a.binBIN22 KB
Stage2_16.6_17.2.1_seedbell_pre.jsJS21 KB
Stage2_16.6_16.7.12_seedbell.jsJS19 KB
x7k9p3m5w2q8.binBIN17 KB
7s32.binBIN13 KB
manifest.jsonJSON11 KB
ANALYSIS.mdMD8 KB
7a7d99099b035b2c6512b6ebeeea6df1ede70fbb.jsJS2 KB
raw.binBIN2 KB
7a7d99099b035b2c6512b6ebeeea6df1ede70fbb.binBIN1 KB
README.mdMD1 KB
cleanup.batBAT848 B
entry6_type0x07.binBIN468 B
entry5_type0x07.binBIN468 B
entry6_type0x07.binBIN468 B
entry4_type0x07.binBIN468 B
entry4_type0x07.binBIN468 B
‹redacted›.vbsVBS240 B
entry3_type0x07.binBIN49 B
.gitignoreGITIGN28 B
.gitignoreGITIGN10 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

185.216.68.66confirmed
64.111.92.149confirmed