Live findsCVE IntelResearchConsoleStart free
huntback / IP intelligence

78.111.90.130

RESIDENTIALoperator-submittedloot-ipc2elf-binaryexploitexposed-secret

Intelligence

ASN / OrgAS208951 · ITGLOBAL.COM NL B.V.
CountryCanada
NetworkRESIDENTIAL · risk 15/100
Threat score0/100
Open ports22, 8081, 18080
ServiceSimpleHTTP/0.6 Python/3.12.3 · Directory listing for /
Loot harvested243 file(s), 20981 KB · c2, elf-binary, exploit, exposed-secret, malware, meterpreter

Open directory contents (243)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
children.jsonJSON7.7 MB
.exploit_expl.jsonJSON1.4 MB
detached.logLOG1.2 MB
‹redacted›.stdout.logLOG1.2 MB
invision.jsJS1.2 MB
detached.logLOG741 KB
‹redacted›.stdout.logLOG735 KB
clusters_full.txtTXT635 KB
‹redacted›.exploit.logLOG517 KB
‹redacted›.recon.logLOG380 KB
‹redacted›.triage.logLOG352 KB
scripts.jsJS346 KB
mft_scripts.jsJS343 KB
j.jsJS338 KB
agent_events.jsonJSON285 KB
.5efff75fbdf7df6f-00000001.nodeELF272 KB
loot_candidates.jsonJSON257 KB
‹redacted›.jsonlJSONL257 KB
‹redacted›.xmlXML203 KB
‹redacted›.stderr.logLOG197 KB
‹redacted›.jsonlJSONL167 KB
l2.txtTXT146 KB
l1.txtTXT145 KB
‹redacted›.jsonlJSONL136 KB
exfil.logLOG100 KB
.5effdf9ebfb3dfef-00000001.nodeELF96 KB
‹redacted›.jgz.bakBAK88 KB
mft_scripts.js.gzGZ88 KB
scan_reports.jsonJSON87 KB
pe_search.txtTXT79 KB
zap.jsonJSON57 KB
regresshion.txtTXT52 KB
loot_candidates.jsonJSON51 KB
agent_events.jsonJSON50 KB
app_page.txtTXT44 KB
LICENSETXT34 KB
ASSET.mdMD28 KB
ASSET.mdMD27 KB
.exploit_loot.jsonJSON22 KB
regreSSHion.pyPY21 KB
CVE-2024-6387.pyPY17 KB
body_cross.txtTXT16 KB
body_resp.txtTXT16 KB
check_resp.txtTXT16 KB
7etsuo-regreSSHion.cC15 KB
7etsuo-regreSSHion.cC15 KB
findings.jsonJSON14 KB
m91_root.htmlHTML14 KB
root_c.txtTXT14 KB
apps2_c.txtTXT14 KB
owa.htmlHTML14 KB
qc2.htmlHTML14 KB
‹redacted›.outOUT12 KB
‹redacted›.outOUT12 KB
CVE-2024-6387_Check.pyPY11 KB
README.mdMD11 KB
‹redacted›.stderr.logLOG10 KB
admin_resp.txtTXT9 KB
apps.htmlHTML9 KB
apps_c.txtTXT9 KB
t.txtTXT9 KB
README.mdMD9 KB
CVE-2024-6387.pyPY9 KB
crypto.jsJS8 KB
findings.shSH8 KB
dedup_clusters.jsonJSON7 KB
README.mdMD6 KB
README.mdMD6 KB
‹redacted›.jsonlJSONL6 KB
‹redacted›.jspJSP6 KB
browser_driver.pyPY5 KB
mkfindings.shSH5 KB
exploration.jsonJSON4 KB
handoff.mdMD4 KB
frontier_nodes.shSH3 KB
‹redacted›.stderr.logLOG3 KB
recon_handoff.mdMD3 KB
dash.htmlHTML3 KB
g.htmlHTML3 KB
login.htmlHTML3 KB
login2.htmlHTML3 KB
probe4.pyPY3 KB
SUMMARY.mdMD3 KB
EXPLOIT_TARGET.mdMD3 KB
probe3.pyPY3 KB
remediation_events.jsonJSON3 KB
.gitignoreGITIGN3 KB
report.txtTXT2 KB
remediations.jsonJSON2 KB
dedup_clusters.jsonJSON2 KB
shellcodeTXT2 KB
remediations.shSH2 KB
probe.pyPY2 KB
probe2.pyPY2 KB
submit_finding3.shSH2 KB
f2.jsonJSON2 KB
triage_events.jsonJSON2 KB
report.txtTXT2 KB
.exploit_trace.jsonJSON2 KB
resolve2.pyPY2 KB
triage_decisions.jsonJSON1 KB
submit_finding.shSH1 KB
browser_build2.logLOG1 KB
mine.shSH1 KB
resolve.pyPY1 KB
ctr.pyPY1 KB
finalproxy.shSH1 KB
send_socket.pyPY1 KB
.exploit_finding.jsonJSON1 KB
probe_ajax.shSH1 KB
probe.shSH1 KB
ungraded_findings.jsonJSON1 KB
harness.jsJS1 KB
submit_finding2.shSH1 KB
otp_burst.shSH1 KB
bbuild.logLOG1 KB
findproxy2.shSH1 KB
LICENSETXT1 KB
probe_uuids.shSH1 KB
r2.txtTXT1 KB
sweep.shSH1014 B
control.shSH1008 B
jiralogin.shSH991 B
probe_more.shSH990 B
testssl.jsonJSON972 B
probe3.shSH952 B
child_run_candidates.jsonJSON912 B
api2.shSH908 B
s3b.shSH889 B
repro6.shSH882 B
findsocks.shSH878 B
probe2.shSH872 B
findproxy.shSH849 B
post.shSH836 B
fptest.shSH798 B
s3.shSH795 B
timed_burst.shSH776 B
new_findings.jsonJSON733 B
burst.shSH697 B
fetchproxies.shSH677 B
s5test.shSH657 B
r1.txtTXT650 B
burst_hdr.shSH647 B
burst6.shSH643 B
fp_sqli_resp.txtTXT591 B
loot_judged.jsonJSON563 B
repro3.shSH552 B
fixexpl.pyPY550 B
‹redacted›.recon.jsonJSON539 B
repro5.shSH535 B
‹redacted›.outOUT525 B
repro.shSH519 B
repro2.shSH514 B
‹redacted›.outOUT474 B
‹redacted›.stderr.logLOG463 B
probe6.shSH452 B
repro4.shSH442 B
probe4.shSH396 B
alt.shSH393 B
run.jsJS366 B
scope.shSH338 B
loot_judged.jsonJSON332 B
dump_docs.shSH331 B
browser_build.logLOG328 B
sweep2.shSH328 B
‹redacted›.cmdCMD287 B
‹redacted›.cmdCMD287 B
‹redacted›.cmdCMD284 B
‹redacted›.cmdCMD283 B
‹redacted›.cmdCMD282 B
LISCENCETXT272 B
configTXT271 B
configTXT269 B
hdr_01.txtTXT268 B
hdr_03.txtTXT268 B
hdr_04.txtTXT268 B
hdr_05.txtTXT268 B
hdr_07.txtTXT268 B
hdr_09.txtTXT268 B
hdr_10.txtTXT268 B
hdr_11.txtTXT268 B
hdr_13.txtTXT268 B
hdr_15.txtTXT268 B
hdr_17.txtTXT268 B
hdr_19.txtTXT268 B
hdr_20.txtTXT268 B
hdr_21.txtTXT268 B
hdr_23.txtTXT268 B
hdr_25.txtTXT268 B
hdr_27.txtTXT268 B
hdr_29.txtTXT268 B
hdr_30.txtTXT268 B
hdr_31.txtTXT268 B
hdr_33.txtTXT268 B
hdr_35.txtTXT268 B
hdr_36.txtTXT268 B
hdr_37.txtTXT268 B
hdr_39.txtTXT268 B
hdr_40.txtTXT268 B
‹redacted›.opencode.logLOG255 B
‹redacted›.opencode.logLOG255 B
‹redacted›.opencode.logLOG245 B
‹redacted›.opencode.logLOG245 B
probe5.shSH233 B
gql.shSH230 B
login.txtTXT220 B
sess.shSH218 B
‹redacted›.jsonlJSONL204 B
‹redacted›.cmdCMD203 B
‹redacted›.cmdCMD193 B
‹redacted›.cmdCMD192 B
‹redacted›.cmdCMD189 B
‹redacted›.cmdCMD185 B
‹redacted›.cmdCMD185 B
‹redacted›.cmdCMD184 B
‹redacted›.cmdCMD182 B
‹redacted›.cmdCMD181 B
‹redacted›.cmdCMD179 B
‹redacted›.cmdCMD177 B
register.shSH175 B
‹redacted›.cmdCMD175 B
‹redacted›.cmdCMD174 B
‹redacted›.cmdCMD173 B
‹redacted›.cmdCMD172 B
‹redacted›.serve.logLOG118 B
‹redacted›.serve.logLOG118 B
packed-refsTXT112 B
packed-refsTXT112 B
README.mdMD79 B
‹redacted›.stderr.logLOG77 B
descriptionTXT73 B
.gitattributesGITATT66 B
FUNDING.ymlYML60 B
kyc_candidateTXT58 B
exploration_result.jsonJSON45 B
grace3.shSH41 B
shallowTXT41 B
shallowTXT41 B
HEADTXT21 B
requirements.txtTXT17 B
.loot_judge_processed_countLOOT_J4 B
.loot_judge_processed_countLOOT_J3 B
secrets.json3 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

1.234.83.89confirmed
101.36.112.205confirmed
102.209.224.40confirmed
103.117.136.137confirmed
103.131.51.199confirmed
103.133.216.219confirmed
103.195.188.128confirmed
103.254.63.94confirmed
103.35.216.13confirmed
104.192.42.94confirmed
104.200.73.97confirmed
104.223.62.197confirmed
106.52.174.151confirmed
107.150.20.139confirmed
107.191.102.241confirmed