Live findsCVE IntelResearchConsoleStart free
huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

5,967
hosts
106,479
files
102
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 2997malware 1225exploit 1134mozi 922c2 314webshell 282ioc-match 88coinminer 66gafgyt 56tsunami 41mirai 38sliver 31meterpreter 16havoc 15

Hosts labelled exploit

HostLabelsFile typesFilesLast seen
101.89.149.227
China · China Telecom (Group)
exposed-secret exploitTXT22026-10-27
43.209.175.24
Thailand · Amazon.com, Inc.
exposed-secret exploitTXT, ENV42026-10-27
43.200.174.95
South Korea · Amazon.com, Inc.
exposed-secret exploitTXT22026-10-27
23.19.231.52
United States · Leaseweb USA, Inc.
malware mozi exposed-secret exploitPY, GZ, JS, SH5772026-10-27
217.154.186.124
Germany · IONOS SE
exposed-secret exploitTXT, ENV, JSON122026-10-27
106.52.174.151
China · Shenzhen Tencent Computer Systems Company Limited
exposed-secret exploitTXT, JSON32026-10-27
62.60.226.140
Germany · FEMO IT SOLUTIONS LIMITED
c2 exploitEXE52026-10-27
103.179.44.239
India · WebHorizon Internet Services
malware mozi c2 exploitPY, LOG72026-10-27
191.217.250.227
United States
malware c2 coinminer exploitPHP, GZ, BIN, SH332026-10-27
177.52.110.176
Brazil · XTURBO PROVEDOR DE INTERNET LTDA - EPP
exposed-secret exploitTXT22026-10-27
13.239.40.119
Australia · Amazon.com, Inc.
exploit malware mozi exposed-secretJS, MD, JSON, EDITOR342026-10-27
167.71.19.245
United States · DigitalOcean, LLC
exposed-secret exploit malware moziGO, TXT, BAT, LOG442026-10-27
130.12.180.212
United States · Omegatech LTD
exploitTXT12026-10-27
85.121.50.9
Romania · M247 Europe SRL
exposed-secret exploitTXT, ENV, JSON112026-10-27
151.158.0.240
Hong Kong · Evoxt Sdn. Bhd.
exposed-secret exploitTXT, ENV, JSON122026-10-27
108.165.121.127
United States · Snaju Development
exposed-secret exploitTXT, ENV, JSON122026-10-27
107.191.102.241
United States · InMotion Hosting, Inc.
exposed-secret exploitTXT, ENV, JSON122026-10-27
185.106.102.5
Cyprus · CLOUDLAYER8 LIMITED
exposed-secret exploitTXT, ENV, JSON122026-10-27
171.22.174.161
Germany · MASSIVEGRID LTD
exposed-secret exploitTXT, ENV, JSON112026-10-27
194.5.98.34
Norway · WebHorizon Internet Services
exposed-secret exploitTXT, ENV, JSON122026-10-27
103.254.63.94
Canada · HostBilby Inc.
exposed-secret exploitTXT, ENV, JSON122026-10-27
2.59.219.69
Moldova · ALEXHOST SRL
exposed-secret exploitTXT, ENV, JSON122026-10-27
89.45.45.56
Turkey · 2E TELEKOMUNIKASYON LTD STI
exposed-secret exploitTXT, ENV, JSON122026-10-27
62.105.222.164
The Netherlands · GTT Communications Inc.
exposed-secret exploitTXT, ENV, JSON122026-10-27
185.157.217.98
Turkey · ENIYISUNUCUM VERI MERKEZI BILISIM HIZMETLERI TICARET VE SANAYI LIMITED SIRKETI
exposed-secret exploitTXT, ENV, JSON122026-10-27
176.125.243.42
Moldova · ALEXHOST SRL
exposed-secret exploitTXT, ENV, JSON122026-10-27
5.83.150.29
Germany · Tech Tide Portugal Unipessoal LDA
exposed-secret exploitTXT, ENV, JSON122026-10-27
104.192.42.94
The Netherlands · EUROHOSTER Ltd.
exposed-secret exploitTXT, ENV, JSON122026-10-27
148.135.207.70
The Netherlands · Matteo Martelloni trading as DELUXHOST
exposed-secret exploitTXT, ENV, JSON122026-10-27
87.106.35.8
United Kingdom · IONOS SE
exposed-secret exploitTXT, ENV, JSON122026-10-27
64.177.66.88
Israel · The Constant Company, LLC
exposed-secret exploitTXT, ENV, JSON122026-10-27
64.176.166.236
Israel · The Constant Company, LLC
exposed-secret exploitTXT, ENV, JSON122026-10-27
94.72.140.191
Bulgaria · DA International Group Ltd.
exposed-secret exploitTXT, ENV, JSON122026-10-27
57.131.30.6
Italy · OVH SAS
exposed-secret exploitTXT, ENV, JSON122026-10-27
65.20.96.115
Spain · The Constant Company, LLC
exploit malware exposed-secret webshellLOG, PY, ELF, C1752026-10-27
91.92.43.211
Germany · DEDIK SERVICES LIMITED
exposed-secret exploit malware moziPY, HTML, SH, JS7032026-10-27
51.81.244.207
United States · OVH SAS
exploit malware coinminer exposed-secretLOG, PY, SH, ELF312026-10-27
45.77.131.98
Japan · The Constant Company, LLC
malware mozi webshell exposed-secretJSON, LOG, SH, PY3112026-10-27
209.99.190.118
Switzerland · SKN Subnet & Telecom Ltd
malware adaptix exposed-secret exploitELF, LOG, PY, TGZ982026-10-27
108.61.161.224
Japan · The Constant Company, LLC
exposed-secret exploit malware moziSH, HTML, LOG, PY1972026-10-26
152.70.78.83
India · Oracle Corporation
exploit exposed-secretTXT12026-10-26
89.108.76.200
Russia · "Domain names registrar REG.RU", Ltd
coinminer malware exploit tunnelJSON, PY, BIN, TXT92026-10-26
91.92.241.101
The Netherlands · Omegatech LTD
exposed-secret exploit malware moziMETA, BODY, PY, TXT3322026-10-26
23.225.71.207
United States · CNSERVERS LLC
exposed-secret exploit webshell malwareTXT, PY, DOCX, LOG852026-10-26
150.60.154.217
Japan · KDDI Web Communications Inc.
exposed-secret exploitTXT22026-10-26
188.190.9.52
United States · EDIS GmbH
exposed-secret exploit webshell tunnelJSP, LOG, SH, TGZ152026-10-26
52.128.241.77
Hong Kong · Netsec Limited
malware mozi c2 exposed-secretPY, PS1, PE, GO2572026-10-26
103.35.216.13
Indonesia · Politeknik Pelayaran Surabaya
exposed-secret exploitTXT, ENV, JSON, PHP162026-10-26
18.141.182.202
Singapore · Amazon.com, Inc.
exposed-secret exploitTXT42026-10-26
153.126.178.245
Japan · SAKURA Internet Inc.
exposed-secret exploitTXT22026-10-26
← NewerPage 13 of 23Older →
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free