huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,967
hosts
106,479
files
102
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled exposed-secret
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 31.44.6.243 United States · ITGLOBAL.COM NL B.V. | exposed-secret | TXT | 1 | 2026-11-02 |
| 27.131.106.133 Australia · Micron21 Datacentre Pty Ltd | exposed-secret exploit coinminer malware | SAMPLE, TXT, GZ, PY | 29 | 2026-11-02 |
| 216.203.20.196 United States · BL Networks | exposed-secret | TXT | 1 | 2026-11-02 |
| 74.91.24.29 United States · Nocix, LLC | exploit exposed-secret tunnel | PY, SH, ZIP, CSV | 25 | 2026-11-02 |
| 64.118.151.226 Hong Kong · Eons Data Communications Limited | exploit exposed-secret malware mozi | SH, LOG, MD, JSON | 147 | 2026-11-02 |
| 38.60.157.55 United States · Kaopu Cloud HK Limited | exposed-secret exploit malware webshell | SH, C, ELF, TXT | 42 | 2026-11-02 |
| 111.68.4.13 Hong Kong · Netsec Limited | exploit exposed-secret malware webshell | SH, PY, ELF, BIN | 58 | 2026-11-02 |
| 161.202.178.206 United States · IBM Cloud | exposed-secret | TXT | 1 | 2026-11-02 |
| 103.107.181.47 Vietnam · VNPT Corp | exposed-secret forced-loot | TXT | 1 | 2026-11-02 |
| 36.255.97.201 Philippines · Ghosty Networks LLC | exposed-secret | TXT | 1 | 2026-11-02 |
| 119.29.35.143 Hong Kong · Shenzhen Tencent Computer Systems Company Limited | exposed-secret forced-loot | TXT | 1 | 2026-11-02 |
| 204.194.51.187 United States · Turing Group Limited | exposed-secret | TXT | 1 | 2026-11-02 |
| 183.136.206.215 China · NINGBO, ZHEJIANG Province, P.R.China. | exposed-secret exploit | SH, MD, PY, ENVRC | 42 | 2026-11-02 |
| 74.91.24.28 United States · Nocix, LLC | exploit exposed-secret tunnel | PY, SH, ZIP, CSV | 25 | 2026-11-02 |
| 217.194.133.89 United States · SonderCloud Limited | exposed-secret | TXT | 1 | 2026-11-02 |
| 216.185.57.224 United States · Ultahost, Inc. | exposed-secret | TXT | 1 | 2026-11-02 |
| 43.142.4.46 China · Shenzhen Tencent Computer Systems Company Limited | exposed-secret | TXT | 1 | 2026-11-02 |
| 161.202.178.198 United States · IBM Cloud | exposed-secret | TXT | 1 | 2026-11-02 |
| 216.185.57.186 United States · Ultahost, Inc. | exposed-secret | TXT | 1 | 2026-11-02 |
| 216.185.57.138 United States · Ultahost, Inc. | exposed-secret | TXT | 1 | 2026-11-02 |
| 155.103.157.43 United States · VH-GLOBAL | exposed-secret | ENV | 1 | 2026-11-02 |
| 39.109.109.111 Hong Kong · XHKL-AS-AP - XUN HONG KONG LIMITED | exposed-secret forced-loot | TXT | 1 | 2026-11-02 |
| 23.140.244.52 United States · VoltNet inc | exposed-secret | TXT | 1 | 2026-11-02 |
| 181.41.194.136 The Netherlands · OVH SAS | malware mozi c2 exposed-secret | HTA, CMD, BAT, JS | 23 | 2026-11-02 |
| 142.91.108.198 Japan · Leaseweb Japan K.K. | exposed-secret exploit | TXT | 2 | 2026-11-02 |
| 113.45.249.54 CN · Huawei Public Cloud Service (Huawei Software Technologies Ltd.Co) | exposed-secret | TXT, ENV, JSON, PHP | 6 | 2026-11-02 |
| 115.159.204.224 China · Shenzhen Tencent Computer Systems Company Limited | exposed-secret | TXT | 1 | 2026-11-02 |
| 45.194.37.204 Seychelles · Antbox Networks Limited | exposed-secret | TXT | 1 | 2026-11-02 |
| 154.201.69.178 Seychelles · cognetcloud INC | exposed-secret | TXT | 1 | 2026-11-02 |
| 18.136.195.202 Singapore · Amazon.com, Inc. | exploit exposed-secret malware mozi | PY, LOG, TXT, SH | 213 | 2026-11-02 |
| 115.159.204.155 China · Shenzhen Tencent Computer Systems Company Limited | exposed-secret | TXT | 1 | 2026-11-02 |
| 31.56.228.136 France · CGI GLOBAL LIMITED | exploit exposed-secret webshell c2 | PY, GDB, MD, PHP | 386 | 2026-11-02 |
| 104.37.86.15 United States · CloudAccess.net, LLC | exposed-secret | PHP | 1 | 2026-11-02 |
| 107.175.85.215 United States · HostPapa | exploit exposed-secret malware mozi | TXT, BIN, BODY, PY | 28 | 2026-11-02 |
| 115.159.204.119 China · Shenzhen Tencent Computer Systems Company Limited | exposed-secret | TXT | 1 | 2026-11-02 |
| 101.36.112.205 Hong Kong · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED | exposed-secret exploit malware webshell | PY, PHP, JS, SH | 161 | 2026-11-02 |
| 43.133.242.81 South Korea · Shenzhen Tencent Computer Systems Company Limited | exposed-secret exploit malware mozi | SH, PY, LOG, TXT | 441 | 2026-11-02 |
| 101.47.156.26 Singapore · Byteplus Pte. Ltd. | exposed-secret | TXT | 1 | 2026-11-02 |
| 212.103.62.205 United States · CNSERVERS LLC | exposed-secret malware exploit mozi | SH, PY, ELF, JSON | 387 | 2026-11-02 |
| 173.255.203.189 United States · Akamai Technologies, Inc. | exposed-secret | TXT | 1 | 2026-11-02 |
| 156.0.255.70 Nigeria · Nigeria Inter-Bank Settlement System Plc | exposed-secret | TXT | 1 | 2026-11-02 |
| 38.76.208.29 United States · cognetcloud INC | exploit malware exposed-secret c2 | LOG, PY, JAVA, MACHO | 78 | 2026-11-02 |
| 39.106.13.235 China · Hangzhou Alibaba Advertising Co.,Ltd. | exploit malware mozi exposed-secret | PY, LOG, OUT, JAR | 21 | 2026-11-02 |
| 15.204.59.195 United States · OVH SAS | exposed-secret | TXT | 1 | 2026-11-02 |
| 66.42.33.224 Japan · The Constant Company, LLC | malware exposed-secret mozi sliver | JSON, PS1, PY, LOG | 21 | 2026-11-02 |
| 74.161.43.26 Switzerland · Microsoft Corporation | exposed-secret malware exploit mozi | C, PS1, ELF, PY | 18 | 2026-11-02 |
| 216.167.81.141 United States · NTT America, Inc. | exposed-secret webshell | TXT | 3 | 2026-11-02 |
| 38.60.212.186 JP · Cogent Communications, LLC | exposed-secret malware mozi tunnel | PS1, SH, PY, PYC | 47 | 2026-11-02 |
| 2.27.61.186 The Netherlands · ETERNITY INTERNATIONAL LIMITED | exposed-secret | TXT | 1 | 2026-11-02 |
| 103.75.199.75 Germany · BitCommand LLC | exploit exposed-secret c2 | TXT, PY, ENV, JS | 11 | 2026-11-02 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free