Know the moment attackers start exploiting what you run.
Our decoys pose as the products in your stack. When an exploit lands, huntback maps it to the CVE and alerts you, then scans the attacker's own servers and collects the tools they left exposed.
Free plan, no card. Add your own decoys when you want them.
Exploitation on our decoys
CVE-mapped attempts, last 24 hours, by hour (UTC)
Each has a network signature, so an attempt on a decoy is tagged as it lands.
Every CVE gets a permalink with EPSS, KEV status and our own sightings.
Full requests from the decoy fleet, not log lines.
Networks traced from decoy hits back to the infrastructure behind them.
What attackers are hitting on our decoys right now.
Ranked by attempts our decoys captured in the last seven days, not by CVSS. Each CVE links to its record with the payload, the sources and the fix.
| CVE | Product | Attempts | Source IPs |
|---|---|---|---|
| Loading this week's exploitation… or browse the CVE index. | |||
Exploitation we flagged before CISA KEV.
Each row pairs our first signal with the day CISA added the CVE to its Known Exploited Vulnerabilities catalog. The source column says where the warning came from: our own decoys, or an exploitation report we picked up the same hour.
| CVE | First signal | Added to KEV | Lead |
|---|
Tell us what you run. We tell you when it is under attack.
Pick your products here and we carry them into sign-up. Alerts go to email on the free plan, and to Slack, Teams or a webhook on paid plans.
Free: stack watch with email alerts, the CVE index, loot search and the IP classifier. No card.
Watch your stack freeEvery alert opens a record you can check.
A CVSS number tells you what could happen. A huntback record shows what did happen on our decoys, who did it, and what they were carrying.
- The request itself. The payload as captured, with the exploit marker highlighted.
- Who sent it. Source IPs and networks, each with its own public page.
- What they left exposed. Open directories and panels on attacker servers, scanned back.
- What to do now. KEV status, public exploits and scanner templates, and the fixed version.
We visit the attacker's server and bring back what is on it.
When a decoy is hit, huntback follows the source home. Open directories, staging panels and payload hosts get scanned, and every file we can reach is archived, hashed and tagged.
- Files, not just IPs. Webshells, phishing kits, exploit scripts, C2 configs and miners, as the attacker left them.
- Tagged and hashed. Each file gets a type, a SHA-256 and the families or techniques it matches.
- One host, one zip. Download everything recovered from an IP in a single archive for your sandbox.
- New leads inside. IPs and domains found in the files feed the pivot graph.
From the first probe to the attacker's toolkit.
Decoys answer like real F5, Ivanti, PHP or ERP servers.
The whole request chain is kept, not a log line.
Signatures tie each request to a CVE and score what is new.
We scan the source and archive its files as loot.
Alerts, CVE pages, API, MCP, STIX/TAXII and SIEM export.
Deceive, hunt, and close the holes they probe.
Decoys that emulate your stack and capture the full attack chain.
Learn more → HuntDiscovery and counter-reconNovel-attack scoring, attacker infrastructure scans, CVE intel.
Learn more → CodeDev-first AppSecSAST, SCA, secrets, SBOM, PR review and one-click AutoFix.
Learn more → SurfaceExternal exposureDomain, brand and certificate intelligence, typosquats.
Learn more → FraudLogin riskFlag VPN, proxy, Tor and datacenter visitors at sign-in.
Learn more →Who uses it, and for what.
Rank your backlog by live exploitation on decoys, not by CVSS alone.
Learn more → Zero-daysSee it before the advisoryNew exploitation hits a decoy before most catalogues list it.
Learn more → Threat intelligenceFollow them homePivot from a hit to the attacker's panels, loot and related hosts.
Learn more → RansomwareCatch the access brokerLoaders and brokers trip decoys long before encryption.
Learn more → MSP and MSSPWarn clients firstPer-client stack watch with evidence you can forward.
Learn more → AppSecFix what is exploitedCode scanning tuned to the exploits we see in the wild.
Learn more →Built by threat hunters who run the decoy fleet themselves. Research published every week, with IOCs you can download.
Fresh from the decoy network
4EverAble2Shell is already mining Monero on live N-central servers
Axis RCE to root to XMRig: 21 real N-central servers were mining for this operator by 12:50 UTC.
Inside SOÛL SOCIETY: automated exploitation, AI agent orders and a Telegram drug platform
An exposed attack server held an exploitation panel, a Go scanner, credential tooling, standing orders for AI agents, evidence files on named targets and a licensed Telegram drug-shop platform. How the operation worked and who it went after.
Typed by hand: how a Danfoss refrigeration controller is taken over
A published change log shows user 1's password rewritten, then the store renamed HACKED BY JUDRUD. On our Danfoss decoys, the people who came typed the factory password into a browser.
Find out what attackers are doing to your stack this week.
Pick your products and get the first alert by email. Add decoys, Slack and the full loot when you are ready.