huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

6,185
hosts
117,458
files
125
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 3132malware 1272exploit 1199mozi 960c2 342webshell 306ioc-match 92coinminer 77gafgyt 63tsunami 46mirai 41sliver 33meterpreter 18havoc 17

Every host we harvested files from, newest first

HostLabelsFile typesFilesLast seen
190.183.251.210
Argentina · Gigared S.A.
exploit exposed-secret malware gafgytMD, PY, JSON, SQLITE302026-09-30
176.65.148.59
The Netherlands · Pfcloud UG (haftungsbeschrankt)
exposed-secret exploit malware moziSH, MD, LOG, PY882026-09-30
91.92.40.65
The Netherlands · TechTies Inc.
malware elf-binaryELF72026-09-30
185.77.97.76
United States · Hostinger International Limited
filesTXT12026-09-30
91.108.103.41
United Kingdom · Hostinger International Limited
filesCOM12026-09-30
195.200.9.173
United Kingdom · Hostinger International Limited
filesCOM12026-09-30
96.127.174.30
United States · Internap Holding LLC
filesCOM22026-09-30
91.219.148.114
Russia · LLC Smart Ape
exposed-secretTXT22026-09-30
50.6.200.159
United States · Network Solutions, LLC
exposed-secret exploitTXT22026-09-30
14.225.211.79
Vietnam · VIETNAM POSTS AND TELECOMMUNICATIONS GROUP
exposed-secretTXT, ENV62026-09-30
118.25.186.131
China · Shenzhen Tencent Computer Systems Company Limited
filesBIN12026-09-30
1.24.80.2
China · UNICOM InnerMongolia province network
exposed-secretTXT, ENV42026-09-30
14.225.16.25
Vietnam · VIETNAM POSTS AND TELECOMMUNICATIONS GROUP
exposed-secretENV12026-09-30
173.249.37.197
France · Contabo GmbH
exposed-secretTXT12026-09-30
87.106.189.143
Germany · IONOS SE
exposed-secretTXT12026-09-30
118.184.173.159
China · Chinanet Jiangsu
exposed-secretTXT, ENV, JSON, PHP62026-09-30
106.37.194.181
China · China Networks Inter-Exchange
exposed-secretTXT12026-09-30
142.44.212.80
Canada · OVH SAS
exposed-secret exploitTXT22026-09-30
49.13.154.56
Germany · Hetzner Online GmbH
exposed-secretTXT12026-09-30
45.131.66.223
Germany · Dominic Scholz trading as ITP-Solutions GmbH & Co. KG
filesJSON12026-09-30
46.245.99.220
Iran · Asiatech Data Transmission company
filesJSON12026-09-30
141.105.68.5
Russia · HOSTKEY B.V.
exposed-secretTXT, ENV, JSON52026-09-30
118.31.64.90
China · Hangzhou Alibaba Advertising Co.,Ltd.
filesJSON12026-09-30
40.81.243.204
India · Microsoft Corporation
exposed-secretTXT22026-09-30
145.239.93.2
Poland · OVH SAS
exposed-secretTXT22026-09-30
62.171.162.150
France · Contabo GmbH
filesJSON12026-09-30
54.39.53.163
Canada · OVH SAS
exposed-secret exploitTXT22026-09-30
222.255.238.158
Vietnam · VNPT Corp
exposed-secret exploitTXT, ENV32026-09-30
162.19.79.99
France · OVH SAS
malware pe-binaryPE1492026-09-30
68.178.175.21
United States · GoDaddy.com, LLC
exposed-secretJS, JSON, TS72026-09-30
164.52.218.194
India · E2E Networks Limited
exposed-secret exploitTXT22026-09-30
92.205.177.116
Germany · Host Europe GmbH
exposed-secretTXT12026-09-30
15.168.185.132
Japan · Amazon.com, Inc.
exposed-secretTXT12026-09-30
122.186.156.66
India · Bharti Airtel Limited
exposed-secret exploitTXT22026-09-30
184.168.31.120
United States · GoDaddy.com, LLC
exposed-secret exploit malware moziPHP, LOCK, TXT, HTML452026-09-30
208.109.235.104
United States · GoDaddy.com, LLC
exposed-secret exploitTXT, ENV32026-09-30
8.217.210.61
Hong Kong · Alibaba (US) Technology Co., Ltd.
exposed-secretTXT, ENV, JSON, PHP62026-09-30
61.216.55.233
Taiwan · Chunghwa Telecom Co., Ltd.
filesBIN12026-09-30
61.91.159.242
Thailand · TRUE INTERNET CORPORATION CO. LTD.
exposed-secretTXT12026-09-30
49.233.44.37
China · Shenzhen Tencent Computer Systems Company Limited
exposed-secretTXT, ENV, JSON, PHP62026-09-30
49.0.124.103
Thailand · Internet Datacenter Network
exposed-secret exploitTXT32026-09-30
5.78.83.238
United States · Hetzner Online GmbH
exposed-secretTXT22026-09-30
51.38.127.151
Germany · OVH SAS
exposed-secretTXT12026-09-30
46.224.179.31
Germany · Hetzner Online GmbH
exposed-secret exploitTXT42026-09-30
45.136.236.77
United Kingdom · Siamdata Communication Co.,ltd.
exposed-secretTXT12026-09-30
43.230.131.75
Indonesia · PT. Media Antar Nusa
exposed-secret exploitTXT, ENV32026-09-30
43.138.227.233
China · Shenzhen Tencent Computer Systems Company Limited
exposed-secretTXT12026-09-30
41.224.59.219
TN · Orange Tunisie
exposed-secretJSON, PHP22026-09-30
35.222.131.86
United States · Google LLC
exposed-secretTXT, ENV, JSON, PHP62026-09-30
32.236.62.30
Australia · Amazon.com, Inc.
malware mozi webshell exposed-secretJSP, JS112026-09-30
← NewerPage 109 of 124Older →
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free