huntback / IP intelligence

51.81.244.207

DATACENTERloot-ipc2coinminerelf-binaryexploitexposed-secret

Intelligence

ASN / OrgAS16276 · OVH SAS
CountryUnited States
NetworkDATACENTER · risk 60/100
Threat score0/100
Open ports22, 80, 443, 3333, 5000, 8000, 8080, 18080, 18081, 8799, 9100, 18082
Servicenginx/1.18.0 (Ubuntu) · Download free programs for any device
Productsnginx
Loot harvested31 file(s), 20096 KB · c2, coinminer, elf-binary, exploit, exposed-secret, forced-loot

Open directory contents (31)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
.netdELF8.0 MB
kxELF7.9 MB
.netd.gzGZ3.4 MB
httpd.logLOG155 KB
redismodule.hH58 KB
b.soELF58 KB
exp.soELF44 KB
r8799.logLOG19 KB
rogue_8799.logLOG15 KB
rogue8799.logLOG14 KB
pgwide2.pyPY3 KB
pgwide.pyPY3 KB
n34002_rogue2.pyPY2 KB
pg_enum.pyPY2 KB
n34002_rogue.pyPY2 KB
r18081.logLOG2 KB
n34002_srv.pyPY1 KB
pg_probe2.pyPY1 KB
module_rce_n34002.cC1 KB
n38202b.shSH1 KB
n34002.shSH1 KB
n34002_start_rogue2.shSH918 B
n34002_start_rogue.shSH772 B
n34002_start_rogue3.shSH710 B
cmd.txtTXT481 B
http8080.logLOG324 B
http.logLOG287 B
rogue.logLOG44 B
rogue18081.logLOG44 B
beacon.logTXT3 B
configTXT2 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

100.21.82.169confirmed
101.42.136.73confirmed
101.47.156.26confirmed
102.204.222.159confirmed
102.210.149.166confirmed
103.107.181.47confirmed
103.252.72.150confirmed
103.46.185.169confirmed
104.223.41.172confirmed
104.233.150.138confirmed
107.151.238.8confirmed
108.61.219.168confirmed
109.122.196.149confirmed
109.238.87.159confirmed
111.223.247.165confirmed