huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,967
hosts
106,479
files
102
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled malware
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 178.132.198.200 Spain · FONSECA ALVES TECNOLOGIA LTDA | malware exploit elf-binary | ELF, HTML, SH, SQL | 14 | 2026-10-06 |
| 222.186.57.10 China · Chinanet | exposed-secret coinminer exploit malware | TXT, ZIP | 2 | 2026-10-06 |
| 202.188.47.41 Malaysia · TM TECHNOLOGY SERVICES SDN BHD | malware pe-binary | PE, BK, YAML | 4 | 2026-10-06 |
| 5.83.144.60 India · GorillaServers, Inc. | malware exposed-secret c2 exploit | PE, ASPX, ELF, BAT | 31 | 2026-10-06 |
| 164.68.118.218 France · Contabo GmbH | exposed-secret exploit malware webshell | TXT, MD, GITIGN, JS | 137 | 2026-10-06 |
| 84.17.55.211 Poland · Datacamp Limited | malware elf-binary tunnel | ELF, GZ, SH | 3 | 2026-10-06 |
| 195.178.110.48 AD · TECHOFF SRV LIMITED | coinminer malware exploit exposed-secret | TXT, ELF, GZ, JSON | 8 | 2026-10-06 |
| 158.220.105.179 France · Contabo GmbH | coinminer malware exposed-secret c2 | SH, GZ, JS, TGZ | 13 | 2026-10-06 |
| 150.136.122.123 United States · Oracle Corporation | exposed-secret malware mozi tunnel | SH, HTML, LOG, PY | 5 | 2026-10-06 |
| 187.141.71.166 Mexico · Uninet S.A. de C.V. | malware mozi exposed-secret | TXT, ENV, JSON | 7 | 2026-10-06 |
| 77.83.39.109 The Netherlands · KPROHOST LLC | exploit exposed-secret malware mozi | TXT | 1 | 2026-10-06 |
| 74.88.7.20 United States · Cablevision Systems Corp. | malware mozi | PHP, ZIP | 3 | 2026-10-06 |
| 103.121.94.25 Hong Kong · cognetcloud INC | exploit malware elf-binary | ELF, LOG, PS1, PY | 4 | 2026-10-06 |
| 217.60.195.187 The Netherlands · SWISSNET LLC | malware mozi elf-binary | ELF | 9 | 2026-10-06 |
| 189.217.130.86 Mexico · Cablevision, S.A. de C.V. | malware mozi | PHP | 1 | 2026-10-06 |
| 92.42.134.120 Russia · Limited Company Digital channel | malware mozi elf-binary | 1 | 2026-10-06 | |
| 42.230.205.25 China · CHINA UNICOM China169 Backbone | malware mozi elf-binary | 1 | 2026-10-06 | |
| 60.23.235.214 China · CHINA UNICOM China169 Backbone | malware mozi elf-binary | ELF | 1 | 2026-10-06 |
| 27.21.24.136 China · Chinanet | malware mozi elf-binary | A | 1 | 2026-10-06 |
| 115.49.77.201 China · CHINA UNICOM China169 Backbone | malware mozi elf-binary | 1 | 2026-10-06 | |
| 182.117.30.4 China · CHINA UNICOM China169 Backbone | malware elf-binary | ELF | 1 | 2026-10-06 |
| 125.47.92.67 China · CHINA UNICOM China169 Backbone | malware mozi elf-binary | 1 | 2026-10-06 | |
| 182.53.98.93 Thailand · TOT Public Company Limited | malware mozi elf-binary | A | 1 | 2026-10-06 |
| 105.225.183.47 South Africa · Telkom SA Ltd. | malware mozi elf-binary | A | 1 | 2026-10-06 |
| 60.23.238.24 China · CHINA UNICOM China169 Backbone | malware mozi elf-binary | ELF | 1 | 2026-10-06 |
| 1.57.109.163 China · CHINA UNICOM China169 Backbone | malware mozi elf-binary | A | 1 | 2026-10-06 |
| 27.210.89.227 China · CHINA UNICOM China169 Backbone | malware mozi elf-binary | A | 1 | 2026-10-06 |
| 34.254.202.253 Ireland · Amazon.com, Inc. | malware coinminer exposed-secret exploit | LOG, TXT, PY, ELF | 26 | 2026-10-05 |
| 107.172.209.126 United States · HostPapa | exploit malware pe-binary | TXT, JPG, PE, ZIP | 5 | 2026-10-04 |
| 5.129.204.34 Russia · JSC "TIMEWEB" | exposed-secret malware elf-binary | ELF, PS1, SH, TXT | 4 | 2026-10-04 |
| 185.244.43.186 Germany · Kontel LLC | malware mozi exposed-secret | PY, LOG, BIN | 9 | 2026-10-04 |
| 185.11.72.171 Russia · JSC Selectel | exploit malware mozi tunnel | LOG, PY, SH, JSON | 11 | 2026-10-04 |
| 172.86.118.111 United States · RouterHosting LLC | exposed-secret exploit c2 malware | PY, LOG, TXT, PHP | 38 | 2026-10-04 |
| 61.168.141.86 China · CHINA UNICOM China169 Backbone | malware mozi elf-binary | 1 | 2026-10-04 | |
| 89.185.82.24 North Macedonia · GLOBAL CONNECTIVITY SOLUTIONS LLP | malware elf-binary | ELF, TXT, SH | 9 | 2026-10-04 |
| 51.144.45.141 The Netherlands · Microsoft Corporation | malware exploit exposed-secret webshell | PS1, JAR, PE, ZIP | 22 | 2026-10-03 |
| 61.107.2.121 South Korea · DREAMLINE CO. | coinminer malware tunnel | TXT | 1 | 2026-10-03 |
| 43.163.124.78 Singapore · Shenzhen Tencent Computer Systems Company Limited | exploit exposed-secret malware meterpreter | TXT, ELF, MD, PY | 81 | 2026-10-03 |
| 209.99.188.155 Switzerland · SKN Subnet & Telecom Ltd | exposed-secret malware mozi exploit | TXT, SH, PY, JSON | 347 | 2026-10-02 |
| 94.154.43.138 Turkey · Net Gate Telecom S.R.L. | malware elf-binary | ELF | 11 | 2026-10-02 |
| 176.65.139.220 The Netherlands · Offshore LC | malware elf-binary pe-binary | ELF, PE, SH | 9 | 2026-10-02 |
| 176.65.139.218 The Netherlands · Offshore LC | malware mirai elf-binary | ELF, SH | 12 | 2026-10-02 |
| 176.65.139.153 The Netherlands · Offshore LC | malware elf-binary | ELF | 13 | 2026-10-02 |
| 176.65.139.78 The Netherlands · Offshore LC | malware elf-binary | ELF, SH | 15 | 2026-10-02 |
| 176.65.139.35 The Netherlands · Offshore LC | malware elf-binary | ELF | 14 | 2026-10-02 |
| 150.241.87.134 Poland · NODE HOST LIMITED | malware elf-binary | ELF | 1 | 2026-10-02 |
| 2.27.203.59 United States · TeraSwitch Networks Inc. | malware c2 exploit elf-binary | ELF, SH | 25 | 2026-10-02 |
| 178.16.52.154 Germany · Omegatech LTD | exposed-secret exploit malware mozi | GZ, LOG, PY, DONE | 154 | 2026-10-02 |
| 89.124.67.72 The Netherlands · SERVERS TECH FZCO | exposed-secret exploit malware mozi | PY, MD, LOG, JSON | 10,428 | 2026-10-01 |
| 178.16.53.67 The Netherlands · Omegatech LTD | malware exposed-secret exploit webshell | PE, PS1, JSON, VBS | 154 | 2026-10-01 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free