huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

6,198
hosts
117,767
files
133
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 3144malware 1279exploit 1205mozi 964c2 344webshell 308ioc-match 92coinminer 77gafgyt 64tsunami 47mirai 42sliver 33havoc 18meterpreter 18

Every host we harvested files from, newest first

HostLabelsFile typesFilesLast seen
103.150.93.176
Indonesia · PT Biznet Gio Nusantara
exposed-secretTXT12026-09-26
103.138.50.66
Pakistan · CITS PVT (LTD)
filesBIN12026-09-26
103.133.216.219
BT · Government Technology Agency
exposed-secret exploitTXT22026-09-26
103.117.57.106
Indonesia · PT Cloud Hosting Indonesia
exposed-secretJSON12026-09-26
103.117.12.12
India · Costel Networks P Ltd
filesBIN12026-09-26
103.117.12.77
India · Costel Networks P Ltd
filesBIN12026-09-26
103.107.187.9
Indonesia · UIN AR-RANIRY
filesBIN12026-09-26
103.106.194.74
India · Elyzium Technologies Pvt. Ltd.
filesBIN12026-09-26
103.106.20.169
India · Beyond Networking Solution
filesBIN12026-09-26
102.214.37.152
AO · Africell Angola S.A
filesBIN12026-09-26
102.209.224.40
Nigeria · Interconnect Clearinghouse Nigeria Ltd
exposed-secret exploitTXT22026-09-26
101.91.170.71
China · China Telecom (Group)
malware elf-binaryBIN, ELF92026-09-26
101.168.26.212
Australia · Telstra Limited
filesBIN12026-09-26
1.13.6.145
China · Shenzhen Tencent Computer Systems Company Limited
exposed-secretTXT12026-09-26
1.92.109.47
China · Huawei Cloud Service data center
exposed-secretTXT, ENV, JSON, PHP62026-09-26
1.234.5.148
South Korea · SK Broadband Co Ltd
exposed-secretTXT22026-09-26
1.234.83.89
South Korea · SK Broadband Co Ltd
exposed-secret exploitTXT, ENV52026-09-26
23.196.193.245
United States · Akamai Technologies, Inc.
exposed-secretTXT12026-09-26
20.102.117.176
United States · Microsoft Corporation
filesTXT12026-09-26
196.189.40.159
ET · EthioNet
malware mozi elf-binaryA12026-09-26
117.245.139.85
India · Bharat Sanchar Nigam Ltd
malware mozi elf-binary12026-09-26
175.160.126.38
China · CHINA UNICOM China169 Backbone
malware mozi elf-binaryA12026-09-26
120.28.194.204
Philippines · Globe Telecom Inc.
malware mozi elf-binaryA12026-09-26
81.230.148.181
Sweden · Telia Company AB
malware mozi elf-binaryA12026-09-26
217.60.103.56
United States · HostSNAP LLC
filesTXT12026-09-26
176.65.148.10
The Netherlands · Pfcloud UG (haftungsbeschrankt)
malware mirai elf-binaryARM, ARM64, ARM7HF, MIPS82026-09-26
45.13.239.249
Germany · Florian Kolb
exposed-secret malware c2 adaptixJSON, TXT, BIN, EXE1412026-09-26
217.60.7.95
Hong Kong · CGI GLOBAL LIMITED
exploit exposed-secretEML1352026-09-26
173.249.63.22
France · Contabo GmbH
filesZIP12026-09-26
101.42.136.73
China · Shenzhen Tencent Computer Systems Company Limited
exposed-secret exploit malware moziTXT, LOG, PY, XML52026-09-26
94.26.83.69
Germany · DEDIK SERVICES LIMITED
exposed-secretTXT12026-09-26
15.223.141.239
Canada · Amazon.com, Inc.
exploit exposed-secretTXT22026-09-25
167.71.22.65
United States · DigitalOcean, LLC
filesTXT22026-09-25
27.72.28.128
Vietnam · Viettel Group
filesBIN12026-09-24
130.61.131.237
Germany · Oracle Corporation
exposed-secretTXT, ENV, JSON52026-09-24
138.197.174.121
Canada · DigitalOcean, LLC
coinminer malware exposed-secret c2GZ, SH, JS92026-09-22
20.201.77.247
Brazil · Microsoft Corporation
exposed-secret exploitTXT22026-09-21
87.106.118.51
Germany · IONOS SE
exposed-secret exploitTXT22026-09-21
207.180.215.227
France · Contabo GmbH
exposed-secretTXT, ENV, PHP42026-09-21
51.195.91.161
Germany · OVH SAS
exposed-secretENV12026-09-21
36.255.97.185
Philippines · Ghosty Networks LLC
exposed-secret forced-lootTXT12026-09-16
46.183.27.249
United States · Datacamp Limited
filesBIN12026-09-16
192.3.1.130
United States · HostPapa
exploit exposed-secret tunnelSH, HTML, LOG, PY92026-09-16
66.179.31.191
United States · BL Networks
exposed-secret exploit malware moziPY, HTML, SH, TXT602026-09-15
103.69.124.253
Nepal · Department of Information Technology, Government of Nepal
exposed-secretTXT12026-09-15
213.209.159.175
Germany · Feo Prest SRL
exposed-secretENV12026-09-15
213.209.159.154
Germany · Feo Prest SRL
exposed-secretENV12026-09-14
223.26.62.95
Hong Kong · CTG Server Limited
malware elf-binaryBIN, B102026-09-14
← NewerPage 124 of 124
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free