huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,967
hosts
106,479
files
102
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Every host we harvested files from, newest first
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 165.227.220.147 United States · DigitalOcean, LLC | exposed-secret | TXT | 2 | 2026-11-08 |
| 104.21.10.19 United States · Cloudflare, Inc. | c2 malware sliver tunnel | TXT | 1 | 2026-11-08 |
| 172.67.162.31 United States · Cloudflare, Inc. | c2 malware sliver tunnel | TXT | 1 | 2026-11-08 |
| 172.67.199.97 United States · Cloudflare, Inc. | exposed-secret | CYOU | 1 | 2026-11-08 |
| 104.21.92.228 United States · Cloudflare, Inc. | exposed-secret | CYOU | 1 | 2026-11-08 |
| 104.21.17.96 United States · Cloudflare, Inc. | files | CYOU | 1 | 2026-11-08 |
| 172.67.175.110 United States · Cloudflare, Inc. | files | CYOU | 1 | 2026-11-08 |
| 104.21.3.47 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-08 |
| 172.67.130.61 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-08 |
| 183.136.138.175 China · NINGBO, ZHEJIANG Province, P.R.China. | exposed-secret | TXT | 1 | 2026-11-08 |
| 103.122.245.181 Thailand · Liberally Network LLC | files | JSON | 1 | 2026-11-08 |
| 162.218.31.167 United States · FASTNET DATA INC | exposed-secret | TXT | 1 | 2026-11-08 |
| 185.151.30.150 United Kingdom · 20i Limited | exposed-secret | JSON | 1 | 2026-11-08 |
| 185.73.228.142 Poland · eTOP sp. z o.o. | exposed-secret | DEV | 1 | 2026-11-08 |
| 185.30.124.158 Poland · eTOP sp. z o.o. | exposed-secret | DEV | 1 | 2026-11-08 |
| 172.67.167.91 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-08 |
| 104.21.73.224 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-08 |
| 172.67.145.72 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-08 |
| 104.21.55.58 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-08 |
| 91.108.103.7 United Kingdom · Hostinger International Limited | files | CYOU | 1 | 2026-11-08 |
| 104.21.3.65 United States · Cloudflare, Inc. | exposed-secret | CYOU | 1 | 2026-11-08 |
| 172.67.202.144 United States · Cloudflare, Inc. | files | DEV | 1 | 2026-11-08 |
| 104.21.69.10 United States · Cloudflare, Inc. | files | DEV | 1 | 2026-11-08 |
| 104.21.55.173 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-08 |
| 172.67.171.199 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-08 |
| 172.67.165.59 United States · Cloudflare, Inc. | files | CYOU | 1 | 2026-11-08 |
| 104.21.81.219 United States · Cloudflare, Inc. | files | CYOU | 1 | 2026-11-08 |
| 172.67.160.138 United States · Cloudflare, Inc. | files | CYOU | 1 | 2026-11-08 |
| 104.21.14.203 United States · Cloudflare, Inc. | files | CYOU | 1 | 2026-11-08 |
| 172.67.208.70 United States · Cloudflare, Inc. | files | CYOU | 1 | 2026-11-08 |
| 104.21.23.12 United States · Cloudflare, Inc. | files | CYOU | 1 | 2026-11-08 |
| 104.21.62.185 United States · Cloudflare, Inc. | files | CFD | 1 | 2026-11-08 |
| 104.21.56.29 United States · Cloudflare, Inc. | c2 exploit tunnel | CSV | 1 | 2026-11-08 |
| 172.67.176.26 United States · Cloudflare, Inc. | c2 exploit tunnel | CSV | 1 | 2026-11-08 |
| 177.12.59.62 Brazil · Predlink Rede de Telecomuniccoes Ltda | files | JSON | 1 | 2026-11-08 |
| 138.2.83.177 Singapore · Oracle Corporation | exposed-secret | TXT | 1 | 2026-11-08 |
| 103.38.28.107 Hong Kong · Hong Kong Five Towns Development Co. Ltd. | exposed-secret | TXT | 1 | 2026-11-08 |
| 202.159.30.243 Indonesia · INDO Internet, PT | exposed-secret | TXT | 2 | 2026-11-08 |
| 39.104.70.157 China · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret malware mozi exploit | PY, SH, LOG, JAR | 272 | 2026-11-08 |
| 130.94.36.92 Taiwan · NTT America, Inc. | exposed-secret exploit tunnel | PY, LOG, TXT | 10 | 2026-11-08 |
| 18.141.4.71 Singapore · Amazon.com, Inc. | exploit exposed-secret tunnel | LOG, PY | 3 | 2026-11-08 |
| 154.12.86.207 Hong Kong · cognetcloud INC | exposed-secret exploit malware mozi | PY, LOG, JSON, SH | 140 | 2026-11-08 |
| 162.214.71.120 United States · Unified Layer | exposed-secret | TXT | 1 | 2026-11-08 |
| 38.127.8.185 Singapore · Ultahost, Inc. | exposed-secret tunnel | TXT, ENV, JSON, PHP | 7 | 2026-11-08 |
| 192.99.19.65 Canada · OVH SAS | exploit malware pe-binary | HTA, PE, PS1 | 3 | 2026-11-08 |
| 16.15.212.184 United States · Amazon.com, Inc. | files | HTML | 1 | 2026-11-08 |
| 16.15.171.47 United States · Amazon.com, Inc. | files | HTML | 1 | 2026-11-08 |
| 16.15.169.161 United States · Amazon.com, Inc. | files | HTML | 1 | 2026-11-08 |
| 23.95.217.154 United States · DataWagon LLC | files | BIN, ENV, JSON, PHP | 5 | 2026-11-08 |
| 169.197.114.134 United Kingdom · Zenlayer Inc | exploit exposed-secret | COM | 1 | 2026-11-08 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free