Known malicious kitmediumother
Miku / Singapore VPS operator — Python http.server open directory on BL Networks (low-confidence)
family: infrahunter-sg-vps-miku-2026-08
A Python http.server directory listing (title 'Directory listing for …') served from AS399629 BL Networks, the provider behind the operator's 69.48.228.86. The row exists to surface a redeployment of the same open-directory habit on a fresh BL Networks IP.
Anchors
SMQL queryrun
title:"Directory listing for" AND asn:399629Provenance
Added: 2026-09-14 09:13
Kept as its own entry on purpose; do not merge it into the IP entry. BL Networks is shared cheap hosting, and public threat data already ties unrelated operators to the actor's own /24 (Sliver, AdaptixC2, ClickFix). A sighting here therefore means 'a Python open directory on BL Networks': a lead to triage by reading the listing, not attribution. Check it against the IP and OCR entries in the same family. Python http.server directory listings are rare, so this entry is quiet rather than noisy.