Live findsCVE IntelResearchConsoleStart free
huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

5,967
hosts
106,479
files
102
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 2997malware 1225exploit 1134mozi 922c2 314webshell 282ioc-match 88coinminer 66gafgyt 56tsunami 41mirai 38sliver 31meterpreter 16havoc 15

Hosts labelled malware

HostLabelsFile typesFilesLast seen
94.237.73.153
Singapore · UpCloud Ltd
exploit exposed-secret malware gafgytJAR, ZIP, GZ, TXT1912026-10-19
77.236.89.203
Russia · Ltd. "SPA"Impulse"
exposed-secret malware mozi pe-binaryBZ2, ZIP, PE, KEY1012026-10-19
8.138.166.206
Singapore · Hangzhou Alibaba Advertising Co.,Ltd.
exposed-secret exploit malware c2PY, TXT, XML, LOG932026-10-19
47.76.239.114
United States · Alibaba (US) Technology Co., Ltd.
malware coinminer exposed-secret exploitPE, BIN, PEM, CMD252026-10-19
47.52.70.58
United States · Alibaba (US) Technology Co., Ltd.
exploit exposed-secret malware moziPY, JS, MD, BAT132026-10-19
146.103.123.60
The Netherlands · SERVERS TECH FZCO
exposed-secret exploit malware moziLOG, PY, KEY, TXT1092026-10-19
218.244.142.4
China · Hangzhou Alibaba Advertising Co.,Ltd.
malware elf-binary pe-binaryELF, PE22026-10-19
45.115.26.23
Vietnam · Contrust Solutions S.R.L.
malware exploit exposed-secret c2ELF, TXT, PE, XML332026-10-19
95.133.253.15
Finland · DataCrunch Oy
malware coinminer elf-binary tunnelELF, GZ, BAK, BAK3122026-10-19
65.20.109.231
Spain · The Constant Company, LLC
malware exploit webshell pe-binaryPE, ZIP, LOG, PS1372026-10-18
144.91.94.21
France · Contabo GmbH
exploit malware c2 webshellPS1, VBS, PE, HTA102026-10-18
185.130.45.163
Sweden · Privex Inc.
malware pe-binaryPE82026-10-18
179.43.175.2
Panama · Private Layer INC
exploit malware webshell exposed-secretCMD, PE, PS1402026-10-18
38.9.96.215
United States · Cogent Communications
malware c2 havoc moziELF, SH, LOG152026-10-18
151.243.11.240
Germany · LLC VASH KREDIT BANK
exploit malware elf-binaryLOG, ELF32026-10-17
166.88.95.90
United States · Evoxt Sdn. Bhd.
malware exposed-secret mozi pe-binaryPE, TXT72026-10-17
45.139.104.36
United States · 49.3 Networking LLC
malware mozi exploit exposed-secretMD, JSON, JS, MJS312026-10-16
38.137.248.35
Ukraine · Lekol LLC
malware mozi elf-binary12026-10-16
194.233.72.68
Singapore · Contabo Asia Private Limited
exploit exposed-secret malware webshellPY, TXT, PHP, MD2852026-10-16
182.253.221.146
Indonesia · BIZNET
exposed-secret malware miraiCSV222026-10-16
168.220.248.106
India · WEBYNE DATA CENTRE PRIVATE LIMITED
exploit malware moziSH12026-10-16
182.127.111.173
China · CHINA UNICOM China169 Backbone
malware mozi elf-binary12026-10-16
219.155.202.252
China · CHINA UNICOM China169 Backbone
malware elf-binaryELF12026-10-16
182.117.119.237
China · CHINA UNICOM China169 Backbone
malware mozi elf-binary12026-10-16
218.61.29.103
China · CHINA UNICOM China169 Backbone
malware mozi elf-binaryELF12026-10-16
139.224.113.180
China · Hangzhou Alibaba Advertising Co.,Ltd.
exposed-secret exploit malware tunnelSQL, MD, ELF, PY342026-10-16
154.36.183.100
MU · NetLab Global
exposed-secret c2 malware tunnelPY, SH, TXT, ELF182026-10-16
103.200.219.143
Singapore · NewMedia Express Pte Ltd
exploit exposed-secret malware moziTXT, YAML, OVPN272026-10-16
45.153.34.235
The Netherlands · TechTies Inc.
malware mirai exploit exposed-secretELF, C, SH, H682026-10-15
186.241.117.95
United States · Uscloud Inc
c2 exposed-secret exploit malwarePS1, SQL, PE, BAT242026-10-15
47.102.192.23
China · Hangzhou Alibaba Advertising Co.,Ltd.
exposed-secret malware exploit moziPY, TXT, LOG, SH4842026-10-15
47.104.248.7
China · Hangzhou Alibaba Advertising Co.,Ltd.
exploit malware tunnel macho-binaryJAVA, MACHO, XML32026-10-15
188.225.24.13
Russia · JSC "TIMEWEB"
malware moziPHP12026-10-15
95.237.154.159
Italy · Telecom Italia S.p.A.
malware mozi elf-binaryA12026-10-15
96.62.71.5
India · SECURED SERVERS LLC
malware elf-binaryELF12026-10-15
83.233.56.26
Sweden · Bredband2 AB
malware mozi elf-binaryA12026-10-15
82.22.23.132
Albania · FREAKHOSTING LTD
malware elf-binaryELF152026-10-15
61.54.43.105
China · CHINA UNICOM China169 Backbone
malware elf-binaryELF12026-10-15
207.244.234.243
United States · Contabo Inc.
exposed-secret exploit malware c2TXT, ELF1242026-10-15
61.243.141.19
China · CHINA UNICOM China169 Backbone
malware mozi elf-binaryELF12026-10-15
61.53.86.56
China · CHINA UNICOM China169 Backbone
malware mozi elf-binary12026-10-15
47.92.205.158
China · Hangzhou Alibaba Advertising Co.,Ltd.
exposed-secret malware elf-binaryELF, TXT22026-10-15
47.215.224.64
United States · Suddenlink Communications
malware mozi elf-binary12026-10-15
60.23.232.97
China · CHINA UNICOM China169 Backbone
malware mozi elf-binaryELF12026-10-15
5.165.233.43
Russia · JSC "ER-Telecom Holding"
malware mozi elf-binaryELF12026-10-15
46.236.65.27
Sweden · Bredband2 AB
malware mozi elf-binary12026-10-15
42.4.97.14
China · CHINA UNICOM China169 Backbone
malware mozi elf-binaryELF12026-10-15
46.252.33.253
Albania · Vodafone Albania Sh.A.
malware mozi elf-binaryA12026-10-15
42.235.72.7
China · CHINA UNICOM China169 Backbone
malware mozi elf-binaryA12026-10-15
46.236.65.9
Sweden · Bredband2 AB
malware mozi elf-binary12026-10-15
← NewerPage 11 of 25Older →
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free