Live findsCVE IntelResearchConsoleStart free
huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

5,967
hosts
106,479
files
102
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 2997malware 1225exploit 1134mozi 922c2 314webshell 282ioc-match 88coinminer 66gafgyt 56tsunami 41mirai 38sliver 31meterpreter 16havoc 15

Every host we harvested files from, newest first

HostLabelsFile typesFilesLast seen
64.239.123.65
United States · Amazon.com, Inc.
exploit exposed-secretAPP, TXT22026-11-07
64.239.109.65
United States · Amazon.com, Inc.
exploit exposed-secretAPP, TXT22026-11-07
172.66.0.227
United States · Cloudflare, Inc.
exposed-secret exploitTXT72026-11-07
35.163.34.11
United States · Amazon.com, Inc.
exploit tunnelHTML52026-11-07
13.224.95.123
United States · Amazon.com, Inc.
exploitTXT22026-11-07
13.224.95.17
United States · Amazon.com, Inc.
exploitTXT22026-11-07
66.33.60.129
United States · Amazon.com, Inc.
exploitTXT12026-11-07
13.224.95.111
United States · Amazon.com, Inc.
exploitTXT22026-11-07
104.16.49.5
United States · Cloudflare, Inc.
exploitTXT12026-11-07
104.16.48.5
United States · Cloudflare, Inc.
exploitTXT12026-11-07
13.224.95.48
United States · Amazon.com, Inc.
exploitTXT22026-11-07
76.76.21.22
United States · Amazon.com, Inc.
exploitTXT12026-11-07
104.18.14.35
United States · Cloudflare, Inc.
exploitTXT12026-11-07
172.66.151.237
United States · Cloudflare, Inc.
filesTXT12026-11-07
143.244.38.134
United Kingdom · Datacamp Limited
exploit webshellPHP, PS1, XYZ32026-11-07
199.60.103.2
United States · Cloudflare London, LLC
exploit tunnelTXT12026-11-07
104.18.15.35
United States · Cloudflare, Inc.
exploitTXT12026-11-07
193.99.144.85
Germany · Plus.line AG
exploit webshell exposed-secretHTML, TXT32026-11-07
104.20.8.174
United States · Cloudflare, Inc.
exploitTXT12026-11-07
104.20.36.99
United States · Cloudflare, Inc.
filesTXT12026-11-07
104.20.7.174
United States · Cloudflare, Inc.
exploitTXT12026-11-07
199.60.103.254
United States · Cloudflare London, LLC
exploit tunnelTXT12026-11-07
172.66.132.19
United States · Cloudflare, Inc.
exploit exposed-secretTXT22026-11-07
129.212.132.33
United States · DigitalOcean, LLC
c2TXT12026-11-07
172.66.132.20
United States · Cloudflare, Inc.
exploit exposed-secretTXT22026-11-07
206.189.156.69
Singapore · DigitalOcean, LLC
filesJSON12026-11-07
18.164.68.15
United States · Amazon.com, Inc.
filesTXT12026-11-07
18.164.68.9
United States · Amazon.com, Inc.
filesTXT12026-11-07
104.18.28.89
United States · Cloudflare, Inc.
exploitTXT12026-11-07
87.239.122.17
Finland · Finnish Transport and Communications Agency
exploitTXT22026-11-07
104.18.29.89
United States · Cloudflare, Inc.
exploitTXT12026-11-07
18.164.68.110
United States · Amazon.com, Inc.
filesTXT12026-11-07
172.64.145.226
United States · Cloudflare, Inc.
exploitTXT12026-11-07
2.22.247.209
United Kingdom · Akamai Technologies, Inc.
exploitTXT32026-11-07
80.245.144.218
Germany · ITZBund
exploitPDF12026-11-07
130.226.173.10
Denmark · Forskningsnettet - Danish network for Research and Education
exploitTXT12026-11-07
104.18.42.30
United States · Cloudflare, Inc.
exploitTXT12026-11-07
95.216.137.24
Finland · Hetzner Online GmbH
exploitTXT152026-11-07
34.102.188.132
United States · Google LLC
filesTXT12026-11-07
2.29.113.216
Finland · Hetzner Online GmbH
exploitTXT12026-11-07
162.159.140.9
United States · Cloudflare, Inc.
exploitTXT12026-11-07
185.199.108.153
United States · Fastly, Inc.
exploit exposed-secret ioc-match tunnelIO, DMG, TXT42026-11-07
199.60.103.106
United States · Cloudflare London, LLC
exploitTXT12026-11-07
150.171.109.213
United States · Microsoft Corporation
exploit c2 malware sliverHTML, TXT22026-11-07
172.66.0.9
United States · Cloudflare, Inc.
exploitTXT12026-11-07
199.60.103.6
United States · Cloudflare London, LLC
exploitTXT12026-11-07
18.164.68.32
United States · Amazon.com, Inc.
filesTXT12026-11-07
13.226.144.64
United States · Amazon.com, Inc.
filesTXT12026-11-07
151.101.66.217
United States · Fastly, Inc.
exploitTXT12026-11-07
151.101.194.217
United States · Fastly, Inc.
exploitTXT12026-11-07
← NewerPage 16 of 120Older →
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free