huntback / IP intelligence
52.128.241.77
Intelligence
ASN / OrgAS45753 · Netsec Limited
CountryHong Kong
NetworkRESIDENTIAL · risk 15/100
Threat score0/100
Open ports22, 8000, 8080, 9443
ServiceSimpleHTTP/0.6 Python/3.12.3 · Directory listing for /
Loot harvested257 file(s), 32795 KB · c2, exploit, exposed-secret, malware, mozi, pe-binary
Open directory contents (257)
Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.
| File | Type | Size |
|---|---|---|
| svcmon_9443.exe | PE | 6.8 MB |
| svcmon.exe | PE | 6.8 MB |
| forms-index.js | JS | 3.1 MB |
| SysDiag.exe | PE | 2.3 MB |
| loader_padded.exe | PE | 2.2 MB |
| loader.exe | PE | 2.2 MB |
| GoSpoof.bin | PE | 1.8 MB |
| GoSpoof.exe | PE | 1.8 MB |
| GoSpoof2.bin | PE | 1.8 MB |
| SysDiag_upx.bin | PE | 1.4 MB |
| loader_upx.bin | PE | 928 KB |
| admin_admin.html | HTML | 90 KB |
| admin_login.html | HTML | 90 KB |
| ‹redacted›.cs | CS | 57 KB |
| ‹redacted›.cs | CS | 57 KB |
| main.go | GO | 35 KB |
| main.go | GO | 34 KB |
| plogin.html | HTML | 34 KB |
| gp5.bin | BIN | 26 KB |
| godpotato.bin | BIN | 26 KB |
| main.go | GO | 15 KB |
| ‹redacted›.aspx.txt | TXT | 7 KB |
| .gitignore | GITIGN | 5 KB |
| ws_downgrade_remote.py | PY | 5 KB |
| replay_full.py | PY | 5 KB |
| resp_zzbeaconping_1.html | HTML | 4 KB |
| webshell_master2.py | PY | 4 KB |
| ws_downgrade_gc3.py | PY | 4 KB |
| downgrade.py | PY | 4 KB |
| probe_write.py | PY | 4 KB |
| deploy_ws2.py | PY | 4 KB |
| ws_rebuild.py | PY | 4 KB |
| probe_dir3.py | PY | 4 KB |
| ws_downgrade_gc.py | PY | 4 KB |
| probe_bisect.py | PY | 4 KB |
| replay_inline.py | PY | 4 KB |
| webshell_master.py | PY | 4 KB |
| probe_dir.py | PY | 4 KB |
| probe_dir2.py | PY | 4 KB |
| probe_certutil_echo2.py | PY | 4 KB |
| probe_certutil_readall.py | PY | 4 KB |
| probe_certutil_echo.py | PY | 3 KB |
| probe_webclient.py | PY | 3 KB |
| probe_qs2.py | PY | 3 KB |
| replay_v6.py | PY | 3 KB |
| diag_drop.py | PY | 3 KB |
| probe_echo_readall.py | PY | 3 KB |
| probe_path.py | PY | 3 KB |
| drop_beacon_echo.py | PY | 3 KB |
| probe_qs.py | PY | 3 KB |
| probe_certutil_exists.py | PY | 3 KB |
| probe_disk.py | PY | 3 KB |
| probe_webclient2.py | PY | 3 KB |
| reput_and_probe.py | PY | 3 KB |
| probe_certutil2.py | PY | 3 KB |
| probe_certutil.py | PY | 3 KB |
| probe_webclient3.py | PY | 3 KB |
| drop_beacon_final.py | PY | 3 KB |
| replay_v7.py | PY | 3 KB |
| httpd_80.log | LOG | 3 KB |
| gp5_dl.exe | EXE | 3 KB |
| ghidra_run2.log | LOG | 3 KB |
| drop_beacon_v3.py | PY | 3 KB |
| drop_beacon_v2.py | PY | 3 KB |
| drop_beacon.py | PY | 3 KB |
| README.md | MD | 3 KB |
| probe_full.py | PY | 3 KB |
| drop_beacon80.py | PY | 3 KB |
| probe_proc.py | PY | 3 KB |
| ssr_postback.py | PY | 3 KB |
| drop_download.py | PY | 3 KB |
| run_ghidra2.py | PY | 3 KB |
| drop_download2.py | PY | 3 KB |
| probe_multiline.py | PY | 3 KB |
| ws_csc.py | PY | 2 KB |
| ws_verify_system2.py | PY | 2 KB |
| ws_download_compile.py | PY | 2 KB |
| probe_aspx.py | PY | 2 KB |
| ws_downgrade_rest.py | PY | 2 KB |
| README.md | MD | 2 KB |
| ws_download2.py | PY | 2 KB |
| db_gateway.ps1 | PS1 | 2 KB |
| build_beacon_9443.py | PY | 2 KB |
| run_ghidra.py | PY | 2 KB |
| ws_downgrade_final.py | PY | 2 KB |
| ws_gp_build2.py | PY | 2 KB |
| db_flow2.ps1 | PS1 | 2 KB |
| recompile.py | PY | 2 KB |
| ws_downgrade_final2.py | PY | 2 KB |
| post_page.py | PY | 2 KB |
| probe_upload_resp.py | PY | 2 KB |
| ws_gp_build.py | PY | 2 KB |
| ws_rerun2.py | PY | 2 KB |
| .gitattributes | GITATT | 2 KB |
| ws_downgrade_ap.py | PY | 2 KB |
| ws_netstat3.py | PY | 2 KB |
| patch_ps.py | PY | 2 KB |
| ws_dll_reflect.py | PY | 2 KB |
| ws_fix_and_compile.py | PY | 2 KB |
| ws_disable.py | PY | 2 KB |
| ws_gp_compile.py | PY | 2 KB |
| ws_compile4.py | PY | 2 KB |
| ws_loader_test.py | PY | 2 KB |
| ws_upx_test.py | PY | 2 KB |
| ws_rerun.py | PY | 2 KB |
| ws_padded_test.py | PY | 2 KB |
| db_sample.ps1 | PS1 | 2 KB |
| ws_enum3.py | PY | 2 KB |
| brute_xor.py | PY | 2 KB |
| ws_kill_defender.py | PY | 2 KB |
| ws_net5.py | PY | 2 KB |
| db_gateway2.ps1 | PS1 | 2 KB |
| ws_bypass1.py | PY | 2 KB |
| ws_csc6.py | PY | 2 KB |
| ws_check_defender.py | PY | 2 KB |
| ws_enum4.py | PY | 2 KB |
| db_synergy.ps1 | PS1 | 2 KB |
| ws_defender.py | PY | 2 KB |
| db_pgstat.ps1 | PS1 | 2 KB |
| ws_dll.py | PY | 2 KB |
| ws_proc_detail.py | PY | 2 KB |
| ws_csc5.py | PY | 2 KB |
| put_site.py | PY | 2 KB |
| ws_csc7.py | PY | 2 KB |
| ws_kill2.py | PY | 2 KB |
| ws_run_hostdiag.py | PY | 2 KB |
| ‹redacted›.java | JAVA | 2 KB |
| ws_csc2.py | PY | 2 KB |
| ws_dl_hosting.py | PY | 2 KB |
| ws_chain.py | PY | 2 KB |
| ws_chain2.py | PY | 2 KB |
| ws_check2.py | PY | 2 KB |
| ws_enum2.py | PY | 2 KB |
| ws_csc8.py | PY | 2 KB |
| probe_upload.py | PY | 2 KB |
| db_pan.ps1 | PS1 | 2 KB |
| ws_check_proc.py | PY | 2 KB |
| ws_netstat2.py | PY | 1 KB |
| db_deep.ps1 | PS1 | 1 KB |
| ws_dl_final.py | PY | 1 KB |
| ws_dl_retry.py | PY | 1 KB |
| ws_csc_diag.py | PY | 1 KB |
| ws_compile2.py | PY | 1 KB |
| ws_dl_exec.py | PY | 1 KB |
| ws_dl_exec_go2.py | PY | 1 KB |
| ws_dl_exec_upx.py | PY | 1 KB |
| ws_dl_exec_go.py | PY | 1 KB |
| ws_disdef.py | PY | 1 KB |
| ws_net4.py | PY | 1 KB |
| ws_enum_privesc.py | PY | 1 KB |
| ws_recon2.py | PY | 1 KB |
| ws_compile3.py | PY | 1 KB |
| ws_dl_gp.py | PY | 1 KB |
| ws_csc_find.py | PY | 1 KB |
| ws_dl_ps_post.py | PY | 1 KB |
| ws_compile5.py | PY | 1 KB |
| ws_exec_capture.py | PY | 1 KB |
| ws_df_replace.py | PY | 1 KB |
| ws_final.py | PY | 1 KB |
| ‹redacted›.java | JAVA | 1 KB |
| decrypt_c2.py | PY | 1 KB |
| ws_netcheck.py | PY | 1 KB |
| ws_privesc_enum.py | PY | 1 KB |
| ws_debug_df.py | PY | 1 KB |
| ws_verify_system.py | PY | 1 KB |
| db_cvv.ps1 | PS1 | 1 KB |
| ws_verify3.py | PY | 1 KB |
| db_pg.ps1 | PS1 | 1 KB |
| ws_csc_find2.py | PY | 1 KB |
| ws_diag.py | PY | 1 KB |
| ws_netstat.py | PY | 1 KB |
| ws_tempconn.py | PY | 1 KB |
| ws_debug_df3.py | PY | 1 KB |
| ws_exec_hosting2.py | PY | 1 KB |
| ws_check_ldu.py | PY | 1 KB |
| ws_whoami.py | PY | 1 KB |
| ws_exec3.py | PY | 1 KB |
| ws_fix_rpc.py | PY | 1 KB |
| ws_download_beacon.py | PY | 1 KB |
| ws_dl_sysdiag.py | PY | 1 KB |
| ws_porttest3.py | PY | 1 KB |
| ws_curl_post_dl.py | PY | 1 KB |
| ws_exclusion.py | PY | 1 KB |
| ws_debug_df5.py | PY | 1 KB |
| ws_fix_l239.py | PY | 1 KB |
| ws_md5check.py | PY | 1 KB |
| ws_csc3.py | PY | 1 KB |
| db_query.ps1 | PS1 | 1 KB |
| ws_exec_hosting.py | PY | 1 KB |
| ws_hashcheck.py | PY | 1 KB |
| ws_defstate.py | PY | 1 KB |
| ws_upload_tempsh.py | PY | 1 KB |
| ws_fix_dbl2.py | PY | 1 KB |
| ws_portcheck.py | PY | 1 KB |
| db_flow3.ps1 | PS1 | 1 KB |
| ws_compile.py | PY | 1 KB |
| upload_probe_master.py | PY | 1 KB |
| ws_fix_df.py | PY | 1 KB |
| db_flow4.ps1 | PS1 | 1 KB |
| db_enum.ps1 | PS1 | 1 KB |
| ws_test_replace.py | PY | 1 KB |
| db_flow1.ps1 | PS1 | 1 KB |
| ws_rename.py | PY | 1 KB |
| ws_upload_ps.py | PY | 1 KB |
| upload_master.py | PY | 1 KB |
| ws_run_gp.py | PY | 1 KB |
| ws_debug_df4.py | PY | 1 KB |
| ws_dump_dbl.py | PY | 1 KB |
| ws_debug_df2.py | PY | 1 KB |
| ws_download5.py | PY | 1 KB |
| ws_run_loader.py | PY | 1 KB |
| ws_enum_svc.py | PY | 1 KB |
| ws_porttest2.py | PY | 1 KB |
| page_12.json | JSON | 1 KB |
| ws_dump_um.py | PY | 1 KB |
| ws_dl_curl3.py | PY | 1 KB |
| ws_verify_state.py | PY | 1 KB |
| ws_dump_df.py | PY | 1 KB |
| ws_download_ps.py | PY | 1 KB |
| ws_check.py | PY | 1 KB |
| ws_verify_prog.py | PY | 1 KB |
| ws_dump_loc.py | PY | 1 KB |
| ws_certtest.py | PY | 1 KB |
| ws_download3.py | PY | 1 KB |
| ws_exec.py | PY | 1 KB |
| ws_run_gp2.py | PY | 1 KB |
| ws_dl_curl.py | PY | 1 KB |
| probe_pages.py | PY | 1 KB |
| ws_exec2.py | PY | 1 KB |
| ws_dl_curl2.py | PY | 1 KB |
| ws_check_spooler.py | PY | 1 KB |
| ws_lentest.py | PY | 1 KB |
| db_pk.ps1 | PS1 | 1 KB |
| ws_download4.py | PY | 1 KB |
| ws_porttest.py | PY | 1 KB |
| ws_svccheck.py | PY | 1 KB |
| ws_download.py | PY | 1 KB |
| list_funcs.py | PY | 1 KB |
| site_1819_full.json | JSON | 1 KB |
| site_cfg.json | JSON | 1 KB |
| ws_test.py | PY | 1 KB |
| ws_diag_now.py | PY | 1 KB |
| ws_build.py | PY | 1 KB |
| ‹redacted›.aspx.html | HTML | 995 B |
| decrypt_a3.py | PY | 889 B |
| modify_ws.py | PY | 859 B |
| find_ptrs.py | PY | 772 B |
| scan_cs6.py | PY | 711 B |
| find_rpc.py | PY | 672 B |
| dump_rest.py | PY | 489 B |
| proc_hide_windows.go | GO | 437 B |
| ‹redacted›.config | CONFIG | 131 B |
| proc_hide_unix.go | GO | 103 B |
| httpd_8000.log | LOG | 82 B |
| .gitignore | GITIGN | 50 B |
| ‹redacted›.mod | MOD | 23 B |
| webshell_slug.txt | TXT | 16 B |
Hunt this IP
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free