huntback / live finds
Live finds
Exposed open directories, malware and C2 infrastructure our sensor network and scanners keep turning up. Click any host to pivot its cluster.
Search finds
Search by favicon hash, JARM, family (e.g. Cobalt Strike), or free text over org/title/labels. Only confirmed findings (open directories, known panel/C2 signatures, staged-loader kits, exposed secrets) are indexed here, not every host we've scanned.
Recently looted hosts
| IP | Files | Labels |
|---|---|---|
| 5.39.10.254 | 1 | elf-binary malware |
| 45.194.88.27 | 1 | elf-binary malware mozi |
| 41.223.30.7 | 712 | c2 exploit exposed-secret malware mirror mozi |
| 154.62.226.92 | 19 | exposed-secret |
| 104.21.15.64 | 1 | files |
| 172.67.161.195 | 1 | files |
| 217.198.6.226 | 262 | c2 elf-binary exploit exposed-secret gafgyt malware |
| 202.162.109.6 | 116 | exploit exposed-secret gafgyt macho-binary malware mozi |
| 153.43.234.210 | 1 | files |
| 142.99.31.154 | 1 | files |
| 66.203.158.218 | 1 | exposed-secret |
| 143.92.57.247 | 116 | exploit exposed-secret gafgyt macho-binary malware mozi |
| 5.129.198.149 | 123 | c2 elf-binary exploit exposed-secret malware webshell |
| 202.162.109.5 | 161 | exploit exposed-secret gafgyt malware mozi tunnel |
| 66.203.158.219 | 1 | exposed-secret |
| 66.203.158.216 | 1 | exposed-secret |
| 66.203.158.215 | 1 | exposed-secret |
| 66.203.158.217 | 1 | exposed-secret |
| 39.105.71.80 | 1 | exposed-secret |
| 202.95.17.200 | 104 | c2 exploit exposed-secret malware mozi tunnel |
| 137.220.162.131 | 1 | files |
| 209.99.184.25 | 96 | exploit exposed-secret malware pe-binary tunnel |
| 209.99.191.184 | 533 | c2 exploit exposed-secret malware mozi pe-binary |
| 95.40.158.13 | 6 | exposed-secret |
| 209.99.184.99 | 236 | exploit exposed-secret malware mozi tunnel |
| 16.106.22.78 | 8 | exposed-secret |
| 95.40.198.195 | 8 | exposed-secret |
| 23.149.28.46 | 1262 | c2 elf-binary exploit exposed-secret gafgyt malware |
| 143.92.56.149 | 1 | exposed-secret |
| 134.122.169.32 | 170 | c2 elf-binary exploit exposed-secret malware mozi |
| 134.122.169.41 | 12 | exposed-secret |
| 5.42.107.183 | 116 | c2 elf-binary exploit exposed-secret malware pe-binary |
| 103.12.149.48 | 21 | exploit exposed-secret tunnel |
| 143.92.56.163 | 1 | exposed-secret |
| 89.223.127.154 | 13 | exploit exposed-secret forced-loot malware mozi |
| 143.92.56.155 | 1 | exposed-secret |
| 192.252.183.164 | 1 | exposed-secret |
| 119.28.152.20 | 5 | exposed-secret |
| 80.94.92.130 | 1 | exposed-secret |
| 191.96.235.13 | 27 | exploit exposed-secret macho-binary malware tunnel |
Hunt these yourself
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting freeFresh JARM clusters
| 2ad2ad0002ad2ad22c42... | 39 hosts |
| 2ad2ad0002ad2ad22c2a... | 39 hosts |
| 27d27d27d29d27d00042... | 39 hosts |
| 21d19d00021d21d00042... | 39 hosts |
| 07d3fd1ad21d21d00042... | 39 hosts |
| 40d40d40d00040d00042... | 38 hosts |
| 2ad2ad16d2ad2ad0002a... | 38 hosts |
| 2ad2ad0002ad2ad00042... | 38 hosts |
| 29d29d00029d29d00042... | 38 hosts |
| 29d29d00000000000043... | 38 hosts |
| 2ad2ad0002ad2ad22c2a... | 37 hosts |
| 2ad2ad0002ad2ad22c2a... | 37 hosts |
| 29d29d15d29d29d00042... | 37 hosts |
| 07d19d12d21d21d07c42... | 37 hosts |
| 3fd3fd0003fd3fd0003f... | 36 hosts |
| 2ad2ad0002ad2ad0002a... | 36 hosts |
| 29d3fd00029d29d00042... | 36 hosts |
| 0bd0bd00000000000042... | 36 hosts |
| 2ad2ad16d2ad2ad00042... | 35 hosts |
| 2ad2ad0002ad2ad22c2a... | 35 hosts |