huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
6,185
hosts
117,458
files
125
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Every host we harvested files from, newest first
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 93.170.72.99 Kazakhstan · EQU Technologies LLP | files | JSON | 1 | 2026-09-30 |
| 138.197.188.152 Germany · DigitalOcean, LLC | exposed-secret exploit | TXT | 2 | 2026-09-30 |
| 91.186.215.184 The Netherlands · FIRST SERVER LIMITED | files | PY | 1 | 2026-09-30 |
| 62.3.58.98 Russia · TIME-HOST LTD | exposed-secret exploit malware mozi | PY, LOG, TXT, SH | 148 | 2026-09-30 |
| 218.3.160.34 China · Chinanet | exposed-secret malware exploit mozi | PHP, BAT, B64, PS1 | 88 | 2026-09-30 |
| 221.239.59.59 China · ASN for TIANJIN Provincial Net of CT | exposed-secret | TXT, ENV, JSON, PHP | 6 | 2026-09-30 |
| 101.36.127.225 Hong Kong · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED | exploit exposed-secret | TXT, ENV, JSON, PHP | 16 | 2026-09-30 |
| 124.220.164.14 China · Shenzhen Tencent Computer Systems Company Limited | malware exploit exposed-secret c2 | MACHO, TXT, JAVA, SH | 89 | 2026-09-30 |
| 205.189.160.239 Hong Kong · LEASEWEB HONG KONG LIMITED | malware exploit macho-binary | JAR, MACHO, JAVA | 5 | 2026-09-30 |
| 5.61.31.52 Iran · Negah Roshan Pars Company (PJS) | exposed-secret tunnel | PHP, GITIGN | 71 | 2026-09-30 |
| 190.84.232.232 Colombia · Telmex Colombia S.A. | coinminer malware exposed-secret webshell | K4MIL4, CMD, PHP, D34D | 28 | 2026-09-30 |
| 185.148.144.99 Bulgaria · Belcloud LTD | exposed-secret exploit malware mozi | PHP, JS, TXT, PY | 306 | 2026-09-30 |
| 95.81.98.36 The Netherlands · CLODO CLOUD SERVICE CO. L.L.C | exploit exposed-secret | HTML, TXT | 5 | 2026-09-30 |
| 89.219.34.98 Kazakhstan · PS Internet Company LLP | files | CGI, PY | 3 | 2026-09-30 |
| 94.26.3.238 United States · MillenialHost Limited | exposed-secret malware mozi exploit | LOG, SH, PY, ZIP | 70 | 2026-09-30 |
| 85.198.90.230 Kazakhstan · ITGLOBAL.COM KZ LLP | exposed-secret | DAT | 1 | 2026-09-30 |
| 77.243.80.38 Kazakhstan · PS Internet Company LLP | malware mozi | JSON | 1 | 2026-09-30 |
| 81.82.11.65 Belgium · Telenet BV | exposed-secret exploit tunnel | TXT, PY, BAS | 16 | 2026-09-30 |
| 147.45.172.95 Kazakhstan · JSC "TIMEWEB" | exploit | PY, CSV | 6 | 2026-09-30 |
| 188.0.138.232 Kazakhstan · Jusan Mobile JSC | exploit | SH | 1 | 2026-09-30 |
| 46.233.50.11 Bulgaria · Point To Point Ltd. | exposed-secret exploit webshell malware | LOG, TXT, GZ, BIN | 49 | 2026-09-30 |
| 83.222.22.208 Russia · NLS ASTANA LLP | exploit | MOBILE | 1 | 2026-09-30 |
| 34.22.116.191 Belgium · Google LLC | exposed-secret malware mozi tunnel | JS, JSON, HTML, PL | 22 | 2026-09-30 |
| 193.191.169.41 Belgium · BELNET | files | TGZ | 1 | 2026-09-30 |
| 94.156.232.62 Germany · H2NEXUS LTD | files | YML, TGZ, ZIP | 4 | 2026-09-30 |
| 95.81.127.78 Finland · IHOR HOSTING LTD | exposed-secret exploit tunnel mirror | PY, TXT, BAK, SH | 39 | 2026-09-30 |
| 5.202.105.149 Iran · Pishgaman Toseeh Ertebatat Company (Private Joint Stock) | exposed-secret | OVPN | 2 | 2026-09-30 |
| 185.235.196.104 Iran · Taymaz Gostaran Naghshe Almas Co. ( Ltd ) | files | SH | 1 | 2026-09-30 |
| 217.60.242.13 Turkey | malware pe-binary | BAT, PE | 4 | 2026-09-30 |
| 185.13.230.208 Iran · Parsan Lin Co. PJS | tunnel | LOG, PY, SH | 5 | 2026-09-30 |
| 151.246.242.140 Thailand · DEXSERVER | malware mozi | LOG, ZIP | 3 | 2026-09-30 |
| 45.80.70.124 Russia · Beget LLC | exposed-secret exploit tunnel | SH, GZ, PHP, TXT | 186 | 2026-09-30 |
| 94.183.234.134 Finland · CGI GLOBAL LIMITED | files | PY | 1 | 2026-09-30 |
| 37.32.27.4 Iran · Noyan Abr Arvan Co. ( Private Joint Stock) | files | PEM, YAML | 4 | 2026-09-30 |
| 5.35.89.17 Russia · Beget LLC | tunnel | PY, LOG, PYC | 25 | 2026-09-30 |
| 31.129.96.88 Russia · Beget LLC | files | PY | 2 | 2026-09-30 |
| 45.146.165.38 Russia · Beget LLC | malware mozi exploit webshell | PY, LOG, JSON, CSV | 46 | 2026-09-30 |
| 185.23.34.58 Russia · Beget LLC | exposed-secret malware elf-binary | SH, BAK, ELF, SERVER | 6 | 2026-09-30 |
| 91.197.98.188 Russia · "Domain names registrar REG.RU", Ltd | malware exposed-secret mozi pe-binary | PE, BAT, PS1 | 12 | 2026-09-30 |
| 84.54.28.153 Russia · Beget LLC | files | PY | 1 | 2026-09-30 |
| 185.134.201.155 Russia · MapmakersGroup "MapMakers Group" Ltd | exposed-secret malware pe-binary | LOG, DAT, PE | 4 | 2026-09-30 |
| 2.59.218.32 Bulgaria · BlueVPS OU | exposed-secret exploit malware tunnel | TGZ, PY, ELF, SH | 33 | 2026-09-30 |
| 78.153.155.55 United States · GLOBAL CONNECTIVITY SOLUTIONS LLP | exposed-secret exploit tunnel | TXT, BAT, HTML, PY | 5 | 2026-09-30 |
| 37.60.248.174 France · Contabo GmbH | exploit exposed-secret webshell malware | TXT, JSON, JS, MD | 365 | 2026-09-30 |
| 194.226.192.40 Russia · SCIENTIFIC RESEARCH INSTITUTE FOR SYSTEM ANALYSIS OF THE NATIONAL RESEARCH CENT | exposed-secret exploit tunnel | SAMPLE, TXT, LOG, GITIGN | 25 | 2026-09-30 |
| 45.153.190.16 Russia · Beget LLC | exposed-secret exploit | PY, DB, ENV, EXAMPL | 23 | 2026-09-30 |
| 130.193.57.105 RU · Yandex.Cloud LLC | files | SH, TXT | 3 | 2026-09-30 |
| 43.129.51.137 Indonesia · Shenzhen Tencent Computer Systems Company Limited | exposed-secret malware gafgyt exploit | PY, MD, LOG, JSON | 115 | 2026-09-30 |
| 194.87.187.20 Russia · JSC "TIMEWEB" | exploit | ZIP, PS1 | 3 | 2026-09-30 |
| 91.218.229.239 Russia · EuroByte LLC | files | PS1 | 1 | 2026-09-30 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free