huntback / IP intelligence
5.129.198.149
Intelligence
ASN / OrgAS9123 · JSC "TIMEWEB"
CountryRussia
NetworkRESIDENTIAL · risk 15/100
Threat score0/100
Open ports21, 22, 25, 80, 110, 143, 443, 465, 587, 993, 995, 7777, 8080, 8888, 18080
Servicenginx/1.30.5 · FASTPANEL
Productsnginx
Loot harvested123 file(s), 14300 KB · c2, elf-binary, exploit, exposed-secret, malware, tunnel
Open directory contents (123)
Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.
| File | Type | Size |
|---|---|---|
| .bcffed3fb585f7fc-00000001.so | ELF | 5.3 MB |
| httpd.log | LOG | 1.2 MB |
| b_813_auto-manager-bundle.js | JS | 807 KB |
| b_167_social-bundle.js | JS | 578 KB |
| b_16_16.js | JS | 520 KB |
| b_282_assessment-bundle.js | JS | 506 KB |
| b_438_longtasks-bundle.js | JS | 485 KB |
| b_706_unauthenticated-app-bundle.js | JS | 423 KB |
| b_752_moderation-bundle.js | JS | 360 KB |
| suslov.html | HTML | 356 KB |
| v3.html | HTML | 356 KB |
| v4.html | HTML | 356 KB |
| vlad2.html | HTML | 356 KB |
| b_273_tools-bundle.js | JS | 341 KB |
| ext.html | HTML | 277 KB |
| rmsp_root.html | HTML | 277 KB |
| rmsp_stats.html | HTML | 267 KB |
| b_604_validator-bundle.js | JS | 229 KB |
| gen_site.py.bak | BAK | 216 KB |
| tv1.html | HTML | 157 KB |
| g.html | HTML | 91 KB |
| b_112_user-tasks-bundle.js | JS | 82 KB |
| fns-all.log | LOG | 30 KB |
| rmsp_s.html | HTML | 26 KB |
| sample_status.txt | TXT | 24 KB |
| sample.txt | TXT | 23 KB |
| newpages.php | PHP | 23 KB |
| b_666_assistant-bundle.js | JS | 22 KB |
| ‹redacted›.ru.js | JS | 21 KB |
| iph.gz | GZ | 20 KB |
| rmsp_about.html | HTML | 20 KB |
| osr.html | HTML | 20 KB |
| ‹redacted›.ru.js | JS | 18 KB |
| fns-oren.log | LOG | 17 KB |
| b_678_acl-bundle.js | JS | 15 KB |
| mk_two_tv.py | PY | 15 KB |
| fridge.py | PY | 15 KB |
| footer.sql | SQL | 15 KB |
| ‹redacted›.chunk.bak | BAK | 14 KB |
| rbt_dock_admin.sql | SQL | 14 KB |
| mk_xlsx.py | PY | 11 KB |
| ‹redacted›.mjs | MJS | 11 KB |
| vytjazhki.php | PHP | 11 KB |
| rbt-form.js | JS | 10 KB |
| fns-extra-oren.log | LOG | 10 KB |
| mk_tv_symptom.py | PY | 9 KB |
| fa-all.json | JSON | 7 KB |
| fridge2.py | PY | 6 KB |
| mk_xlsx2.py | PY | 6 KB |
| og.html | HTML | 6 KB |
| tv_update.py | PY | 6 KB |
| photos3.log | LOG | 5 KB |
| turls.txt | TXT | 5 KB |
| template9_new.php | PHP | 5 KB |
| tpl9_fixed.php | PHP | 5 KB |
| tv_price.py | PY | 5 KB |
| reset_dock.sql | SQL | 4 KB |
| snip_kblink.php | PHP | 4 KB |
| parallel_probe.py | PY | 4 KB |
| compare_probe.py | PY | 4 KB |
| mw_fix.py | PY | 4 KB |
| quality.py | PY | 3 KB |
| b10.log | LOG | 3 KB |
| b9.log | LOG | 3 KB |
| next-build.log | LOG | 3 KB |
| b6.log | LOG | 3 KB |
| b7.log | LOG | 3 KB |
| b8.log | LOG | 3 KB |
| patch_plata.py | PY | 3 KB |
| ‹redacted›.new.php | PHP | 3 KB |
| patch_spravka.py | PY | 3 KB |
| photos2.log | LOG | 3 KB |
| patch_css.py | PY | 3 KB |
| why_probe.py | PY | 3 KB |
| Local%20State | TXT | 3 KB |
| photos-samara.log | LOG | 3 KB |
| fridge3.py | PY | 3 KB |
| ua_quota.py | PY | 3 KB |
| tv_fix.py | PY | 3 KB |
| rbtreviews.php | PHP | 2 KB |
| ‹redacted›.now.php | PHP | 2 KB |
| rbtDock.php | PHP | 2 KB |
| probe_stream.py | PY | 2 KB |
| upd2501.sql | SQL | 2 KB |
| sweep_all.py | PY | 2 KB |
| restore_template.sql | SQL | 2 KB |
| race_test.py | PY | 2 KB |
| stability.py | PY | 2 KB |
| probe_stack.py | PY | 1 KB |
| race_abort_test.py | PY | 1 KB |
| quota_rate.py | PY | 1 KB |
| tv_links.py | PY | 1 KB |
| load_test2.py | PY | 1 KB |
| load_test.py | PY | 1 KB |
| canned_test.py | PY | 1 KB |
| chat_test.py | PY | 1 KB |
| add_proletarskaya.php | PHP | 1 KB |
| g_test2.php | PHP | 931 B |
| g_test.php | PHP | 888 B |
| test_chunk.php | PHP | 875 B |
| apply_prices.php | PHP | 791 B |
| chat_llm.py | PY | 779 B |
| tbl_test.php | PHP | 742 B |
| update_snippet.php | PHP | 721 B |
| chat_raw.py | PY | 719 B |
| quota_gap15.log | LOG | 694 B |
| poi_payload.json | JSON | 660 B |
| send_payload.json | JSON | 649 B |
| test_out2.php | PHP | 635 B |
| test_chunk2.php | PHP | 621 B |
| g_test3.php | PHP | 608 B |
| test_out3.php | PHP | 592 B |
| next-dev-3106.log | LOG | 563 B |
| test_snip.php | PHP | 555 B |
| test_out.php | PHP | 478 B |
| clear_cache.php | PHP | 439 B |
| next-dev-3105.log | LOG | 400 B |
| set_label.sql | SQL | 247 B |
| restore_label.sql | SQL | 214 B |
| check_one.sh | SH | 200 B |
| check_https.sh | SH | 141 B |
| gen-all.log | LOG | 114 B |
| gen-all2.log | LOG | 114 B |
Hunt this IP
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting freeRelated infrastructure
Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.
| 185.148.144.99 | confirmed |
| 45.39.190.176 | confirmed |
| 1.9.164.196 | lead |
| 1.92.135.98 | lead |
| 100.59.46.54 | lead |
| 104.131.190.92 | lead |
| 104.168.133.161 | lead |
| 107.172.100.254 | lead |
| 110.42.207.79 | lead |
| 119.61.26.55 | lead |
| 121.37.133.251 | lead |
| 124.71.163.149 | lead |
| 129.226.112.143 | lead |
| 131.226.204.180 | lead |
| 138.197.189.19 | lead |