Live findsCVE IntelResearchConsoleStart free
huntback / IP intelligence

8.130.172.119

DATACENTERoperator-submittedexposed-secretloot-ipelf-binaryexploitmacho-binary

Intelligence

ASN / OrgAS37963 · Hangzhou Alibaba Advertising Co.,Ltd.
CountrySingapore
NetworkDATACENTER · risk 60/100
Threat score0/100
Open ports22, 80, 110, 143, 443, 993, 995, 3306, 6379, 7001, 8082, 8088, 8888, 8081, 2222, 1389
JARM07d3fd1ad21d21d00042d43d0000005aa9877b7a5d6a671d1e56af48dc9ce6
Loot harvested129 file(s), 68088 KB · elf-binary, exploit, exposed-secret, macho-binary, malware, tunnel

Open directory contents (129)

Files harvested from this host's exposed directory. File names only — victim-identifying names are redacted and file contents are never published.

FileTypeSize
http_f.logLOG8.2 MB
http_f.logLOG8.2 MB
http_f.logLOG5.8 MB
http_f.logLOG5.8 MB
sftpagentELF5.6 MB
fakemysql443.logLOG5.6 MB
fakemysql443.logLOG5.2 MB
fakemysql80.logLOG4.9 MB
fakemysql80.logLOG4.9 MB
‹redacted›.jarJAR4.5 MB
fakemysql3306.logLOG3.3 MB
fakemysql3306.logLOG3.0 MB
gradle_install.logLOG251 KB
‹redacted›.jarJAR228 KB
‹redacted›.jarJAR226 KB
‹redacted›.TGbrUPTGBRUP128 KB
‹redacted›.jarJAR120 KB
fakemysql.logLOG98 KB
fakemysql.logLOG89 KB
‹redacted›.jsonlJSONL52 KB
jndi_final.logLOG43 KB
jndi_final.logLOG43 KB
‹redacted›.jarJAR33 KB
‹redacted›.jarJAR33 KB
bochuan-backup-2a8f7e011207.tar.gzGZ27 KB
exfil2.logLOG22 KB
test-macos-agentMACHO19 KB
test-macos-v2MACHO19 KB
config-previewELF16 KB
mojin.si6PMlSI6PML14 KB
‹redacted›.javaJAVA8 KB
mars_50389b.logLOG6 KB
mars_50389b.logLOG6 KB
‹redacted›.classMACHO5 KB
firewall_manage.shSH5 KB
‹redacted›.javaJAVA5 KB
config-preview.cC5 KB
BehinderFilterPayload%24BehinderFilter.classMACHO3 KB
bcel_payload.jsonJSON3 KB
bcel_payload.txtTXT3 KB
‹redacted›.jarJAR3 KB
BehinderPayload%241.classMACHO2 KB
‹redacted›.classMACHO2 KB
‹redacted›.classMACHO2 KB
mini_ftp.pyPY2 KB
‹redacted›.classMACHO2 KB
‹redacted›.classMACHO2 KB
jndi_rs.logLOG2 KB
‹redacted›.classMACHO2 KB
‹redacted›.classMACHO2 KB
‹redacted›.javaJAVA2 KB
behinder_test.pyPY2 KB
‹redacted›.javaJAVA2 KB
‹redacted›.javaJAVA2 KB
‹redacted›.jarJAR1 KB
‹redacted›.jarJAR1 KB
bh_test2.pyPY1 KB
rivulet_jndi.logLOG1 KB
test-apk.jsJS1 KB
‹redacted›.classMACHO1 KB
interact.pyPY1 KB
test-apk2.jsJS1 KB
‹redacted›.classMACHO1 KB
‹redacted›.classMACHO1 KB
test-apk4.jsJS1 KB
mars_final.logLOG1 KB
test-apk5.jsJS1 KB
handler.pyPY986 B
‹redacted›.javaJAVA954 B
http_logger.pyPY943 B
http_logger2.pyPY943 B
test_behinder.pyPY932 B
bh_test_final.pyPY929 B
jndi_new.logLOG929 B
http9998.logLOG902 B
‹redacted›.classMACHO884 B
bh_test_v2.pyPY850 B
revshell_listener.pyPY843 B
bh_v3.pyPY808 B
h6.txtTXT800 B
‹redacted›.javaJAVA734 B
h5.txtTXT730 B
camera-test.logLOG669 B
rs.shSH652 B
jndi2.txtTXT621 B
send.pyPY614 B
jndiexploit.logLOG610 B
‹redacted›.classMACHO610 B
‹redacted›.classMACHO610 B
ftp_ee2aea7b.logLOG600 B
h4.txtTXT592 B
exfil_server.pyPY590 B
exfil2.pyPY562 B
test-macos.jsJS529 B
logger6667.pyPY527 B
hhw.txtTXT520 B
‹redacted›.classMACHO519 B
exfil.logLOG498 B
cmd_server.pyPY481 B
osxcross_build.logLOG474 B
h3.txtTXT448 B
send_payload.shSH430 B
h2.txtTXT374 B
llog.txtTXT235 B
py_rev.shSH234 B
hlog.txtTXT232 B
py_pty.shSH214 B
nc7777.logLOG204 B
nc443.logLOG203 B
nc9998.logLOG190 B
mars2.logLOG181 B
deploy.shSH173 B
http_pty.logLOG146 B
http38888.logLOG142 B
ldap_log.txtTXT142 B
frpc.tomlTOML142 B
rs_persist.shSH140 B
configTXT136 B
mars_beh.logLOG136 B
start_attacker.shSH103 B
http7778.logLOG77 B
http_cs.logLOG77 B
http7778b.logLOG73 B
http_rs.logLOG73 B
fastjson.logLOG56 B
ftp_9c6d32f5.logLOG50 B
mars_50389.logLOG48 B
attacker2.logLOG42 B
mars3.logLOG26 B
Hunt this IP

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free

Related infrastructure

Hosts sharing signals (JARM, cert, passive DNS, hosted files). A JARM-only link is a lead, not proof.

110.42.215.163confirmed
43.161.243.73confirmed
8.133.234.121confirmed
1.14.96.167lead
102.210.149.211lead
103.167.151.249lead
103.90.75.37lead
109.122.196.25lead
132.226.88.44lead
14.139.176.197lead
141.147.70.247lead
144.91.73.67lead
146.19.213.246lead
149.154.70.188lead
160.30.158.218lead