huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,967
hosts
106,479
files
102
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Every host we harvested files from, newest first
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 64.176.34.176 Japan · The Constant Company, LLC | malware c2 mozi webshell | PY, SH, TXT, ELF | 26 | 2026-11-08 |
| 118.107.29.231 Hong Kong · CTG Server Limited | exposed-secret | COM, HTML | 3 | 2026-11-08 |
| 118.107.29.228 Hong Kong · CTG Server Limited | exposed-secret | COM, HTML | 3 | 2026-11-08 |
| 118.107.29.225 Hong Kong · CTG Server Limited | exposed-secret | COM, HTML | 3 | 2026-11-08 |
| 172.67.153.189 United States · Cloudflare, Inc. | files | DZ | 1 | 2026-11-08 |
| 172.67.153.50 United States · Cloudflare, Inc. | exposed-secret | CYOU | 1 | 2026-11-08 |
| 172.67.153.118 United States · Cloudflare, Inc. | exposed-secret | CYOU | 1 | 2026-11-08 |
| 65.110.40.18 United States · Advin Services LLC | files | SITE, ONLINE, XYZ | 5 | 2026-11-08 |
| 207.241.172.222 United States · Advin Services LLC | exposed-secret | INK | 1 | 2026-11-08 |
| 172.65.251.78 United States · Cloudflare, Inc. | files | JSON | 1 | 2026-11-08 |
| 104.21.86.229 United States · Cloudflare, Inc. | exposed-secret | TOP | 1 | 2026-11-08 |
| 172.67.137.110 United States · Cloudflare, Inc. | exposed-secret | TOP | 1 | 2026-11-08 |
| 172.67.187.140 United States · Cloudflare, Inc. | ioc-match | JS | 1 | 2026-11-08 |
| 190.115.16.13 BZ · IQWeb FZ-LLC | files | NET | 2 | 2026-11-08 |
| 104.21.7.69 United States · Cloudflare, Inc. | ioc-match | JS | 1 | 2026-11-08 |
| 185.27.134.97 United Kingdom · Wildcard UK Limited | files | PHP | 1 | 2026-11-08 |
| 173.35.95.189 Canada · Rogers Communications Canada Inc. | exposed-secret | PY, KEY, VBS | 4 | 2026-11-08 |
| 124.198.131.63 United States · 1337 Services GmbH | exposed-secret malware exploit mozi | PY, SH, PE, RAR | 217 | 2026-11-08 |
| 124.198.131.2 United States · 1337 Services GmbH | exposed-secret | TXT | 1 | 2026-11-08 |
| 158.247.199.81 South Korea · The Constant Company, LLC | exposed-secret | TXT | 1 | 2026-11-08 |
| 216.238.107.138 Brazil · The Constant Company, LLC | exposed-secret | TXT | 1 | 2026-11-08 |
| 139.84.240.240 South Africa · The Constant Company, LLC | exposed-secret | TXT | 1 | 2026-11-08 |
| 216.238.82.209 Mexico · The Constant Company, LLC | exposed-secret | TXT | 1 | 2026-11-08 |
| 45.76.10.193 United States · The Constant Company, LLC | exposed-secret | TXT | 1 | 2026-11-08 |
| 46.17.40.253 Russia · LLC Baxet | exposed-secret | TXT | 1 | 2026-11-08 |
| 136.244.109.179 The Netherlands · The Constant Company, LLC | malware exposed-secret elf-binary | ELF, LOG | 12 | 2026-11-08 |
| 15.204.115.49 United States · OVH SAS | exposed-secret | TXT | 1 | 2026-11-08 |
| 15.235.240.61 Canada · OVH SAS | files | JSON | 1 | 2026-11-08 |
| 151.101.63.11 United States · Fastly, Inc. | exposed-secret | TXT | 1 | 2026-11-08 |
| 43.128.133.51 South Korea · Shenzhen Tencent Computer Systems Company Limited | exposed-secret | OVPN, SH | 5 | 2026-11-08 |
| 179.43.171.203 Panama · Private Layer INC | exposed-secret exploit malware mozi | LOG, PY, JSON, TXT | 76 | 2026-11-08 |
| 179.43.171.202 Panama · Private Layer INC | exposed-secret exploit malware mozi | LOG, PY, JSON, TXT | 76 | 2026-11-08 |
| 172.67.169.215 United States · Cloudflare, Inc. | files | CYOU | 1 | 2026-11-08 |
| 172.67.169.76 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-08 |
| 223.151.76.117 China · Chinanet | malware mozi elf-binary | A | 1 | 2026-11-08 |
| 172.67.169.99 United States · Cloudflare, Inc. | exposed-secret | CYOU | 1 | 2026-11-08 |
| 130.49.171.102 Uzbekistan · SERVERCORE CIS LLC | exposed-secret exploit | TXT | 2 | 2026-11-08 |
| 217.76.55.116 France · Contabo GmbH | files | TXT | 1 | 2026-11-08 |
| 109.199.105.207 France · Contabo GmbH | files | TXT | 1 | 2026-11-08 |
| 172.66.42.231 United States · Cloudflare, Inc. | tunnel | IO | 1 | 2026-11-07 |
| 172.66.41.25 United States · Cloudflare, Inc. | tunnel | IO | 1 | 2026-11-07 |
| 104.21.54.173 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-07 |
| 172.67.168.195 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-07 |
| 172.67.148.174 United States · Cloudflare, Inc. | files | SITE | 1 | 2026-11-07 |
| 104.21.46.213 United States · Cloudflare, Inc. | files | LAT | 1 | 2026-11-07 |
| 130.94.44.130 Singapore · NTT America, Inc. | exposed-secret exploit webshell malware | TXT, PS1, PY, TOML | 98 | 2026-11-07 |
| 2.54.88.67 Israel · Partner Communications Ltd. | files | BIN | 1 | 2026-11-07 |
| 34.54.88.138 United States · Google LLC | files | TXT | 1 | 2026-11-07 |
| 34.49.135.97 United States · Google LLC | exploit exposed-secret | TXT | 1 | 2026-11-07 |
| 20.151.96.73 Canada · Microsoft Corporation | exploit exposed-secret | TXT | 3 | 2026-11-07 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free