huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,967
hosts
106,479
files
102
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled malware
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 62.210.255.5 France · Scaleway SAS | malware mozi exploit | GZ, LOG, JS, TXT | 54 | 2026-10-21 |
| 176.105.214.112 Ukraine · RPC HomeNet Ltd. | malware pe-binary | PE, ZIP | 5 | 2026-10-21 |
| 51.159.53.7 France · Scaleway SAS | exposed-secret c2 malware pe-binary | LOG, CUE, PE, PY | 33 | 2026-10-21 |
| 178.215.250.94 Ukraine · TeleRadioCompany GOK LTD | malware mozi | PHP | 2 | 2026-10-21 |
| 15.188.163.78 France · Amazon.com, Inc. | exposed-secret exploit malware mozi | LOG, SH, TXT, PY | 378 | 2026-10-21 |
| 157.245.140.34 United States · DigitalOcean, LLC | exposed-secret malware mozi exploit | PY, LOG, SH, JSON | 1,680 | 2026-10-21 |
| 116.63.131.238 China · China Unicom IP network | exposed-secret malware mozi | TXT | 2 | 2026-10-21 |
| 151.243.11.241 Germany · LLC VASH KREDIT BANK | exploit c2 exposed-secret malware | PY, MD, LOG, TXT | 439 | 2026-10-21 |
| 142.93.57.244 United States · DigitalOcean, LLC | exposed-secret exploit malware c2 | TXT, JSON, JS, BODY | 217 | 2026-10-21 |
| 2.24.204.250 United States · Hostinger International Limited | exposed-secret exploit malware mozi | GZ, DB, MD, JSON | 136 | 2026-10-21 |
| 13.229.73.36 Singapore · Amazon.com, Inc. | exploit exposed-secret malware mozi | APK, LOG, HTML, TXT | 48 | 2026-10-21 |
| 62.238.122.155 The Netherlands · Hetzner Online GmbH | exploit exposed-secret malware mozi | ZIP, TXT, YAML, JSON | 16 | 2026-10-21 |
| 43.167.171.106 Singapore · Shenzhen Tencent Computer Systems Company Limited | exploit malware macho-binary tunnel | JAVA, MACHO | 2 | 2026-10-21 |
| 64.111.92.149 United States · BL Networks | exposed-secret exploit malware mozi | PY, YAML, TXT, MD | 108 | 2026-10-21 |
| 23.81.35.61 United Kingdom · LEASEWEB UK LIMITED | exposed-secret exploit c2 malware | PY, BAK, GZ, SH | 748 | 2026-10-21 |
| 8.215.31.102 Singapore · Alibaba (US) Technology Co., Ltd. | gafgyt malware | ZIP | 55 | 2026-10-21 |
| 8.217.24.92 Hong Kong · Alibaba (US) Technology Co., Ltd. | exposed-secret malware mozi webshell | PY, HTM, SH, JS | 649 | 2026-10-21 |
| 176.104.108.18 Serbia · NINET Company Nis d.o.o. | malware mozi exploit exposed-secret | PE, PS1, HTML, BIN | 17 | 2026-10-21 |
| 198.23.209.17 United States · HostPapa | malware webshell exploit exposed-secret | ELF, TXT, SH, MACHO | 135 | 2026-10-21 |
| 157.230.117.70 Germany · DigitalOcean, LLC | exploit exposed-secret malware mozi | PY, MD, JSON, CFG | 79 | 2026-10-21 |
| 18.220.4.102 United States · Amazon.com, Inc. | malware pe-binary | PE, ZIP | 3 | 2026-10-21 |
| 147.139.136.66 United States · Alibaba (US) Technology Co., Ltd. | gafgyt malware | ZIP | 55 | 2026-10-21 |
| 148.116.90.65 Canada · Oracle Corporation | exposed-secret malware mozi exploit | LOG, PY, PYC, BAK | 29 | 2026-10-21 |
| 208.85.17.99 Spain · The Constant Company, LLC | malware elf-binary | ELF | 1 | 2026-10-21 |
| 167.233.243.9 Germany · Hetzner Online GmbH | exposed-secret exploit c2 malware | SH, PY, JSON, RS | 105 | 2026-10-21 |
| 202.65.11.59 Bangladesh · MGH INFOTECH LTD. | exposed-secret exploit malware mozi | MD, JS, JSON, PY | 27 | 2026-10-21 |
| 198.44.38.209 United States · HostPapa | malware exploit exposed-secret macho-binary | MACHO, JAVA, PY, TOML | 134 | 2026-10-21 |
| 139.162.230.213 United Kingdom · Akamai Technologies, Inc. | exposed-secret malware mozi exploit | PHP, HTML, JS, TXT | 22 | 2026-10-21 |
| 5.39.254.211 United Kingdom · Baxet Group Inc. | malware exposed-secret coinminer elf-binary | SH, ELF, LOG, TGZ | 9 | 2026-10-21 |
| 104.131.123.117 United States · DigitalOcean, LLC | exposed-secret malware mozi | JS, KEY, LOG, ZIP | 4 | 2026-10-21 |
| 52.90.1.165 United States · Amazon.com, Inc. | exposed-secret webshell malware exploit | SH, TXT, ELF, KEY | 29 | 2026-10-21 |
| 2.27.23.151 Sweden · PLAY2GO INTERNATIONAL LIMITED | exploit malware mozi | LOG, BIN | 5 | 2026-10-21 |
| 88.99.208.237 Germany · Hetzner Online GmbH | exploit exposed-secret malware gafgyt | JAR, ZIP, GZ, TXT | 206 | 2026-10-21 |
| 16.171.12.83 Sweden · Amazon.com, Inc. | malware exploit c2 meterpreter | PS1, PE, B64, VBS | 19 | 2026-10-21 |
| 175.100.42.26 Cambodia · VIETTEL (CAMBODIA) PTE., LTD | c2 malware mozi tunnel | SH | 1 | 2026-10-21 |
| 111.223.247.165 South Korea · BGP Network Limited | exposed-secret malware mozi exploit | PY, TXT, PEM, LOG | 31 | 2026-10-20 |
| 202.61.139.137 Singapore · CTG Server Limited | exposed-secret exploit malware mozi | PY, LOG, SH, TXT | 130 | 2026-10-20 |
| 82.158.193.146 Ukraine | exploit webshell c2 exposed-secret | JS, LOG, PY, SH | 11 | 2026-10-20 |
| 52.74.54.75 Singapore · Amazon.com, Inc. | ioc-match malware pe-binary | PE | 1 | 2026-10-20 |
| 167.88.172.3 United States · RouterHosting LLC | malware exploit webshell elf-binary | ELF, MP, XP | 9 | 2026-10-20 |
| 45.198.224.91 Seychelles · VPSVAULT.HOST LTD | malware c2 elf-binary | ELF, SH | 14 | 2026-10-20 |
| 65.20.107.61 Spain · The Constant Company, LLC | malware pe-binary | PE | 1 | 2026-10-19 |
| 177.4.12.11 Hong Kong · Hong Kong Communications International Co., Limited | exploit malware coinminer exposed-secret | PY, YAML, TXT, ZIP | 25 | 2026-10-19 |
| 120.28.194.92 Philippines · Globe Telecom Inc. | malware mozi elf-binary | A | 1 | 2026-10-19 |
| 209.141.43.95 United States · FranTech Solutions | exploit c2 exposed-secret webshell | PHP, ELF, SH, ZIP | 69 | 2026-10-19 |
| 185.157.161.93 Sweden · Obehosting AB | exploit c2 exposed-secret webshell | PY, SH, JS, JSON | 503 | 2026-10-19 |
| 45.142.143.235 Finland · Materialism s.r.l. | exposed-secret malware mozi exploit | PY, SQL, GZ, SH | 643 | 2026-10-19 |
| 188.120.247.225 Russia · JSC IOT | exploit exposed-secret c2 malware | PHP, TXT | 2,965 | 2026-10-19 |
| 168.138.13.221 Australia · Oracle Corporation | exposed-secret malware mozi exploit | SH, BAT, LOG, TXT | 20 | 2026-10-19 |
| 193.123.81.25 United Arab Emirates · Oracle Corporation | exposed-secret malware elf-binary tunnel | LOG, PY, JSON, ELF | 16 | 2026-10-19 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free