huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,967
hosts
106,479
files
102
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled exploit
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 43.254.165.70 Hong Kong · VH-GLOBAL | exploit exposed-secret malware webshell | ASPX, PE, PS1, TXT | 9 | 2026-10-24 |
| 54.69.111.24 United States · Amazon.com, Inc. | exploit exposed-secret webshell c2 | BIN, JSON, ZIP, PY | 114 | 2026-10-24 |
| 199.19.77.37 United States · VegasNAP, LLC | malware exploit pe-binary | RSP, PE, ZIP, BIN | 48 | 2026-10-24 |
| 204.168.225.59 Finland · Hetzner Online GmbH | exposed-secret malware mozi exploit | PEM, TXT, PY, SH | 487 | 2026-10-24 |
| 104.160.169.204 United States · Sharktech | exposed-secret exploit malware tsunami | SH, LOG, TXT, PY | 170 | 2026-10-24 |
| 194.11.226.41 United Kingdom · ROCKHOSTER PRIVATE LIMITED | exposed-secret malware mozi exploit | PY, TXT, LOG, JS | 106 | 2026-10-24 |
| 50.210.239.219 United States · Comcast Cable Communications, LLC | exposed-secret exploit c2 webshell | PHP, PY, HTML, LOG | 45 | 2026-10-24 |
| 84.38.180.187 Russia · JSC Selectel | exploit malware pe-binary | PE, APPLIC, BAT, HTA | 9 | 2026-10-24 |
| 167.99.227.197 US · DigitalOcean, LLC | exploit | AES, KEY, PY | 4 | 2026-10-24 |
| 187.110.176.65 Brazil · MHNET TELECOM | malware exposed-secret mozi exploit | LOG, PE, ZIP, TXT | 480 | 2026-10-24 |
| 151.242.30.142 South Africa · Internet Magnate (Pty) Ltd | exploit malware mozi exposed-secret | JS, ZIP, C, PY | 454 | 2026-10-23 |
| 82.180.145.166 India · Contabo Asia Private Limited | webshell exposed-secret exploit malware | PHP, TXT, PY, JSP | 50 | 2026-10-23 |
| 202.61.139.15 Singapore · CTG Server Limited | exposed-secret exploit malware mozi | LOG, PY, JSON, PHP | 262 | 2026-10-23 |
| 52.188.156.253 United States · Microsoft Corporation | malware exploit mozi pe-binary | PE, PS1, COM | 7 | 2026-10-23 |
| 154.219.98.61 Hong Kong · cognetcloud INC | exploit exposed-secret webshell tunnel | PY, MD, JAR, SH | 14 | 2026-10-23 |
| 70.39.95.20 United States · Sharktech | exploit exposed-secret | TXT | 1 | 2026-10-23 |
| 104.21.63.101 United States · Cloudflare, Inc. | exploit | APP | 1 | 2026-10-22 |
| 172.67.170.139 United States · Cloudflare, Inc. | exploit | APP | 1 | 2026-10-22 |
| 165.232.41.141 United Kingdom · DigitalOcean, LLC | exposed-secret exploit malware mozi | SH, TXT, GZ, JSON | 30 | 2026-10-22 |
| 54.169.109.7 Singapore · Amazon.com, Inc. | exposed-secret exploit malware mozi | LOG, PY, OVPN, TXT | 55 | 2026-10-22 |
| 157.90.175.209 Germany · Hetzner Online GmbH | exploit exposed-secret mirror | CBBBDD, JSP | 3 | 2026-10-22 |
| 184.154.107.45 United States · Internap Holding LLC | exploit exposed-secret mirror | CBBBDD, JSP | 3 | 2026-10-22 |
| 172.67.211.156 United States · Cloudflare, Inc. | exploit | COM | 1 | 2026-10-22 |
| 104.21.53.99 United States · Cloudflare, Inc. | exploit | COM | 1 | 2026-10-22 |
| 14.29.208.101 China · Chinanet | malware exploit elf-binary macho-binary | RS, DB, ELF, GZ | 8 | 2026-10-22 |
| 83.143.222.4 Finland · GleSYS AB | exposed-secret exploit | PHP, FI, XML | 5 | 2026-10-22 |
| 208.98.38.173 United States · Sharktech | exploit exposed-secret | TXT | 1 | 2026-10-21 |
| 212.232.23.75 Singapore · ROCKHOSTER PRIVATE LIMITED | exposed-secret exploit malware mozi | PY, LOG, TXT, BIN | 341 | 2026-10-21 |
| 89.32.46.87 Romania · Cyber_Folks SRL | exposed-secret exploit malware elf-binary | PY, TXT, HTML, DB | 65 | 2026-10-21 |
| 91.214.17.136 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 91.214.17.151 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 195.201.83.167 Germany · Hetzner Online GmbH | exposed-secret exploit malware mozi | SH, PY, SCIENC, JSON | 400 | 2026-10-21 |
| 212.244.203.102 Poland · Orange Polska Spolka Akcyjna | webshell exposed-secret malware c2 | C, SQL, IN, PL | 300 | 2026-10-21 |
| 91.214.17.138 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 81.181.166.24 Romania · DataNode DC SRL | exposed-secret exploit malware mozi | BIN, LOG, TXT, JSON | 28 | 2026-10-21 |
| 91.214.17.190 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 87.121.52.82 Bulgaria · Neterra Ltd. | exposed-secret malware mozi exploit | GO, DB, JSON, KEY | 60 | 2026-10-21 |
| 176.103.62.56 Ukraine · Ivanov Vitaliy Sergeevich | malware exploit pe-binary elf-binary | BIN, ZIP, PE, ELF | 12 | 2026-10-21 |
| 82.118.235.179 Bulgaria · DA International Group Ltd. | exposed-secret exploit malware mozi | TXT, HTML | 28 | 2026-10-21 |
| 159.69.66.161 Germany · Hetzner Online GmbH | exposed-secret malware mozi exploit | PY, LOG, TXT, JSON | 705 | 2026-10-21 |
| 93.123.85.46 Germany · dataforest GmbH | exploit exposed-secret malware gafgyt | JAR, ZIP, GZ, TXT | 206 | 2026-10-21 |
| 78.9.235.120 Poland · Netia SA | exposed-secret exploit malware elf-binary | TXT, ZIP, ELF | 8 | 2026-10-21 |
| 89.161.135.49 Poland · home.pl S.A. | exploit | HTML, PHP, PY | 5 | 2026-10-21 |
| 87.251.64.224 Poland · ISAEV Igor | c2 exposed-secret malware exploit | C, LOG, CSV, EXE | 8 | 2026-10-21 |
| 87.199.203.242 The Netherlands · SERVERS TECH FZCO | exposed-secret exploit tunnel | SH, COMPLE, ENV, KEY | 302 | 2026-10-21 |
| 91.214.17.130 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 188.245.31.251 Germany · Hetzner Online GmbH | exploit exposed-secret malware webshell | SH, PY, C, ELF | 58 | 2026-10-21 |
| 91.236.251.38 Ukraine · IP-Connect LLC | exploit exposed-secret tunnel | GZ, TXT, BIN, PUB | 7 | 2026-10-21 |
| 91.214.17.135 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 178.63.68.220 Germany · Hetzner Online GmbH | exploit exposed-secret c2 | TXT, JSON, LOG, PY | 7 | 2026-10-21 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free