Live findsCVE IntelResearchConsoleStart free
huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

5,967
hosts
106,479
files
102
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 2997malware 1225exploit 1134mozi 922c2 314webshell 282ioc-match 88coinminer 66gafgyt 56tsunami 41mirai 38sliver 31meterpreter 16havoc 15

Hosts labelled malware

HostLabelsFile typesFilesLast seen
47.236.83.240
United States · Alibaba (US) Technology Co., Ltd.
malware exploit c2 exposed-secretMACHO, BIN, JS, GITIGN652026-10-01
49.77.137.146
China · Chinanet
malware pe-binary tunnelZIP, PE, RAR, BAT312026-10-01
47.108.208.69
China · Hangzhou Alibaba Advertising Co.,Ltd.
exposed-secret malware mozi pe-binaryPHP, JS, GITIGN, MAP372026-10-01
3.24.186.0
Australia · Amazon.com, Inc.
malware exploit pe-binaryPE, PS1432026-10-01
96.62.71.22
India · SECURED SERVERS LLC
malware pe-binaryPE, HTA, PS142026-10-01
117.55.235.249
Australia · MULTACOM CORPORATION
malware moziZIP, C52026-10-01
94.154.43.100
Turkey · Net Gate Telecom S.R.L.
malware elf-binaryELF, SH132026-09-30
1.196.90.7
China · Chinanet
malware mozi elf-binaryELF12026-09-30
62.3.58.98
Russia · TIME-HOST LTD
exposed-secret exploit malware moziPY, LOG, TXT, SH1482026-09-30
218.3.160.34
China · Chinanet
exposed-secret malware exploit moziPHP, BAT, B64, PS1882026-09-30
124.220.164.14
China · Shenzhen Tencent Computer Systems Company Limited
malware exploit exposed-secret c2MACHO, TXT, JAVA, SH892026-09-30
205.189.160.239
Hong Kong · LEASEWEB HONG KONG LIMITED
malware exploit macho-binaryJAR, MACHO, JAVA52026-09-30
190.84.232.232
Colombia · Telmex Colombia S.A.
coinminer malware exposed-secret webshellK4MIL4, CMD, PHP, D34D282026-09-30
185.148.144.99
Bulgaria · Belcloud LTD
exposed-secret exploit malware moziPHP, JS, TXT, PY3062026-09-30
94.26.3.238
United States · MillenialHost Limited
exposed-secret malware mozi exploitLOG, SH, PY, ZIP702026-09-30
77.243.80.38
Kazakhstan · PS Internet Company LLP
malware moziJSON12026-09-30
46.233.50.11
Bulgaria · Point To Point Ltd.
exposed-secret exploit webshell malwareLOG, TXT, GZ, BIN492026-09-30
34.22.116.191
Belgium · Google LLC
exposed-secret malware mozi tunnelJS, JSON, HTML, PL222026-09-30
217.60.242.13
Turkey
malware pe-binaryBAT, PE42026-09-30
151.246.242.140
Thailand · DEXSERVER
malware moziLOG, ZIP32026-09-30
45.146.165.38
Russia · Beget LLC
malware mozi exploit webshellPY, LOG, JSON, CSV462026-09-30
185.23.34.58
Russia · Beget LLC
exposed-secret malware elf-binarySH, BAK, ELF, SERVER62026-09-30
91.197.98.188
Russia · "Domain names registrar REG.RU", Ltd
malware exposed-secret mozi pe-binaryPE, BAT, PS1122026-09-30
185.134.201.155
Russia · MapmakersGroup "MapMakers Group" Ltd
exposed-secret malware pe-binaryLOG, DAT, PE42026-09-30
2.59.218.32
Bulgaria · BlueVPS OU
exposed-secret exploit malware tunnelTGZ, PY, ELF, SH332026-09-30
37.60.248.174
France · Contabo GmbH
exploit exposed-secret webshell malwareTXT, JSON, JS, MD3652026-09-30
43.129.51.137
Indonesia · Shenzhen Tencent Computer Systems Company Limited
exposed-secret malware gafgyt exploitPY, MD, LOG, JSON1152026-09-30
122.166.178.204
India · Bharti Airtel Limited
exposed-secret exploit malware sliverPY, TXT, ENV, GITIGN772026-09-30
193.168.48.134
Russia · Beget LLC
malware pe-binaryPE12026-09-30
51.79.251.75
Canada · OVH SAS
exposed-secret exploit malware tunnelLOG, PY, TXT, BAK342026-09-30
84.46.247.54
France · Contabo GmbH
exposed-secret malware sliverLOG12026-09-30
46.225.118.210
Germany · Hetzner Online GmbH
exposed-secret exploit malware moziPY, JSON, LOG, BAK452026-09-30
129.204.7.230
China · Shenzhen Tencent Computer Systems Company Limited
malware macho-binaryMACHO12026-09-30
124.221.101.41
China · Shenzhen Tencent Computer Systems Company Limited
malware moziJS, PY252026-09-30
101.35.210.248
China · Shenzhen Tencent Computer Systems Company Limited
exposed-secret malware mozi tunnelJS, JSON, HTML, PL222026-09-30
49.234.49.58
China · Shenzhen Tencent Computer Systems Company Limited
exposed-secret malware gafgyt exploitJSON, PY, SH, DB632026-09-30
47.96.255.147
China · Hangzhou Alibaba Advertising Co.,Ltd.
malware sliverSH, SQLITE, BAT, LOG112026-09-30
81.70.21.248
China · Shenzhen Tencent Computer Systems Company Limited
exploit malware exposed-secret webshellTXT, PY, GITIGN, IN282026-09-30
207.180.219.101
France · Contabo GmbH
exploit exposed-secret malware moziHTML, MD, PY, LOG342026-09-30
5.78.118.60
United States · Hetzner Online GmbH
exposed-secret exploit malware moziPY, TXT, MD, GITIGN332026-09-30
118.25.25.81
China · Shenzhen Tencent Computer Systems Company Limited
exposed-secret exploit malware gafgytPY, MD, LOG, SH1072026-09-30
72.56.114.234
Seychelles · Timeweb, LLP
exposed-secret malware mozi exploitPY, LOG, JSON, SH1712026-09-30
183.101.139.124
South Korea · Korea Telecom
exposed-secret malware mozi exploitPY, TXT, JS, MD952026-09-30
84.32.34.6
The Netherlands · UAB Cherry Servers
malware exposed-secret mozi exploitPY, GZ, TXT, BAK552026-09-30
128.30.224.82
United States · Massachusetts Institute of Technology
exposed-secret exploit malware sliverTXT, PY, GITIGN, MD242026-09-30
65.21.188.160
Finland · Hetzner Online GmbH
exposed-secret exploit malware moziPHP, MD, SH, TXT572026-09-30
103.131.51.199
Indonesia · PT. Jupiter Jala Arta
exposed-secret exploit malware moziPHP, MD, TXT, GITIGN462026-09-30
204.168.164.231
Finland · Hetzner Online GmbH
exposed-secret exploit malware sliverPY, TXT, GITIGN, JSON122026-09-30
162.35.183.192
United States · Interserver, Inc
exposed-secret exploit malware moziTXT, PY, GITIGN, SH82026-09-30
46.250.255.73
Japan · Contabo Asia Private Limited
exposed-secret exploit malware moziPY, TXT, MD, B72E8E142026-09-30
← NewerPage 16 of 25Older →
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free