huntback / IP intelligence

5.129.198.149

RESIDENTIALoperator-submittedloot-ipc2elf-binaryexploitexposed-secret

Intelligence

ASN / OrgAS9123 · JSC "TIMEWEB"
CountryRussia
NetworkRESIDENTIAL · risk 15/100
Threat score0/100
Open ports21, 22, 25, 80, 110, 143, 443, 465, 587, 993, 995, 7777, 8080, 8888, 18080
Servicenginx/1.30.5 · FASTPANEL
Productsnginx
Loot harvested123 file(s), 14300 KB · c2, elf-binary, exploit, exposed-secret, malware, tunnel

Open directory contents (123)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
.bcffed3fb585f7fc-00000001.soELF5.3 MB
httpd.logLOG1.2 MB
b_813_auto-manager-bundle.jsJS807 KB
b_167_social-bundle.jsJS578 KB
b_16_16.jsJS520 KB
b_282_assessment-bundle.jsJS506 KB
b_438_longtasks-bundle.jsJS485 KB
b_706_unauthenticated-app-bundle.jsJS423 KB
b_752_moderation-bundle.jsJS360 KB
suslov.htmlHTML356 KB
v3.htmlHTML356 KB
v4.htmlHTML356 KB
vlad2.htmlHTML356 KB
b_273_tools-bundle.jsJS341 KB
ext.htmlHTML277 KB
rmsp_root.htmlHTML277 KB
rmsp_stats.htmlHTML267 KB
b_604_validator-bundle.jsJS229 KB
gen_site.py.bakBAK216 KB
tv1.htmlHTML157 KB
g.htmlHTML91 KB
b_112_user-tasks-bundle.jsJS82 KB
fns-all.logLOG30 KB
rmsp_s.htmlHTML26 KB
sample_status.txtTXT24 KB
sample.txtTXT23 KB
newpages.phpPHP23 KB
b_666_assistant-bundle.jsJS22 KB
‹redacted›.ru.jsJS21 KB
iph.gzGZ20 KB
rmsp_about.htmlHTML20 KB
osr.htmlHTML20 KB
‹redacted›.ru.jsJS18 KB
fns-oren.logLOG17 KB
b_678_acl-bundle.jsJS15 KB
mk_two_tv.pyPY15 KB
fridge.pyPY15 KB
footer.sqlSQL15 KB
‹redacted›.chunk.bakBAK14 KB
rbt_dock_admin.sqlSQL14 KB
mk_xlsx.pyPY11 KB
‹redacted›.mjsMJS11 KB
vytjazhki.phpPHP11 KB
rbt-form.jsJS10 KB
fns-extra-oren.logLOG10 KB
mk_tv_symptom.pyPY9 KB
fa-all.jsonJSON7 KB
fridge2.pyPY6 KB
mk_xlsx2.pyPY6 KB
og.htmlHTML6 KB
tv_update.pyPY6 KB
photos3.logLOG5 KB
turls.txtTXT5 KB
template9_new.phpPHP5 KB
tpl9_fixed.phpPHP5 KB
tv_price.pyPY5 KB
reset_dock.sqlSQL4 KB
snip_kblink.phpPHP4 KB
parallel_probe.pyPY4 KB
compare_probe.pyPY4 KB
mw_fix.pyPY4 KB
quality.pyPY3 KB
b10.logLOG3 KB
b9.logLOG3 KB
next-build.logLOG3 KB
b6.logLOG3 KB
b7.logLOG3 KB
b8.logLOG3 KB
patch_plata.pyPY3 KB
‹redacted›.new.phpPHP3 KB
patch_spravka.pyPY3 KB
photos2.logLOG3 KB
patch_css.pyPY3 KB
why_probe.pyPY3 KB
Local%20StateTXT3 KB
photos-samara.logLOG3 KB
fridge3.pyPY3 KB
ua_quota.pyPY3 KB
tv_fix.pyPY3 KB
rbtreviews.phpPHP2 KB
‹redacted›.now.phpPHP2 KB
rbtDock.phpPHP2 KB
probe_stream.pyPY2 KB
upd2501.sqlSQL2 KB
sweep_all.pyPY2 KB
restore_template.sqlSQL2 KB
race_test.pyPY2 KB
stability.pyPY2 KB
probe_stack.pyPY1 KB
race_abort_test.pyPY1 KB
quota_rate.pyPY1 KB
tv_links.pyPY1 KB
load_test2.pyPY1 KB
load_test.pyPY1 KB
canned_test.pyPY1 KB
chat_test.pyPY1 KB
add_proletarskaya.phpPHP1 KB
g_test2.phpPHP931 B
g_test.phpPHP888 B
test_chunk.phpPHP875 B
apply_prices.phpPHP791 B
chat_llm.pyPY779 B
tbl_test.phpPHP742 B
update_snippet.phpPHP721 B
chat_raw.pyPY719 B
quota_gap15.logLOG694 B
poi_payload.jsonJSON660 B
send_payload.jsonJSON649 B
test_out2.phpPHP635 B
test_chunk2.phpPHP621 B
g_test3.phpPHP608 B
test_out3.phpPHP592 B
next-dev-3106.logLOG563 B
test_snip.phpPHP555 B
test_out.phpPHP478 B
clear_cache.phpPHP439 B
next-dev-3105.logLOG400 B
set_label.sqlSQL247 B
restore_label.sqlSQL214 B
check_one.shSH200 B
check_https.shSH141 B
gen-all.logLOG114 B
gen-all2.logLOG114 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

185.148.144.99confirmed
45.39.190.176confirmed
1.9.164.196lead
1.92.135.98lead
100.59.46.54lead
104.131.190.92lead
104.168.133.161lead
107.172.100.254lead
110.42.207.79lead
119.61.26.55lead
121.37.133.251lead
124.71.163.149lead
129.226.112.143lead
131.226.204.180lead
138.197.189.19lead