Live findsCVE IntelResearchConsoleStart free
huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

5,967
hosts
106,479
files
112
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 2997malware 1225exploit 1134mozi 922c2 314webshell 282ioc-match 88coinminer 66gafgyt 56tsunami 41mirai 38sliver 31meterpreter 16havoc 15

Every host we harvested files from, newest first

HostLabelsFile typesFilesLast seen
3.84.186.180
United States · Amazon.com, Inc.
exposed-secret malware mozi exploitPY, HTML, JS, TXT8292026-11-07
101.96.212.69
China · Beijing Volcano Engine Technology Co., Ltd.
exposed-secretTXT12026-11-07
103.141.140.243
Vietnam · Megacore Technology Company Limited
exposed-secretENV12026-11-07
3.128.117.168
United States · Amazon.com, Inc.
exposed-secret exploit malware moziPHP, JS, BIN, DB2562026-11-07
64.23.240.211
United States · DigitalOcean, LLC
malware exploit coinminer exposed-secretPY, LOG, TXT, SH3862026-11-07
146.19.213.199
Russia · ALEXHOST SRL
filesJSON12026-11-07
183.62.6.61
China · Chinanet
exposed-secretTXT12026-11-07
8.212.181.6
Philippines · Alibaba (US) Technology Co., Ltd.
exposed-secret malware cobalt-strike c2GO, BIN, TXT, PE772026-11-07
206.238.42.110
Singapore · Tcloudnet
exposed-secretTXT12026-11-07
13.213.18.30
Singapore · Amazon.com, Inc.
exposed-secretTXT12026-11-07
23.148.145.226
United States · VolumeDrive
exposed-secret exploitTXT, ENV32026-11-07
13.215.184.109
Singapore · Amazon.com, Inc.
exposed-secret malware exploit moziJSON, TXT, SH, PY1362026-11-07
16.59.36.98
United States · Amazon.com, Inc.
c2 exposed-secret exploit malwareLOG, SH, PY, JSON722026-11-07
18.139.222.103
Singapore · Amazon.com, Inc.
malware exploit macho-binary tunnelLOG, MACHO, JAVA, PY142026-11-07
3.26.94.147
Australia · Amazon.com, Inc.
c2 exploit malware exposed-secretPY, TOC, PE, MD672026-11-07
3.144.74.60
United States · Amazon.com, Inc.
exposed-secret malware tunnel elf-binaryLOG, JSON, SH, HTML652026-11-07
13.63.179.207
Sweden · Amazon.com, Inc.
exposed-secret malware mozi c2TXT, APK, GITIGN, KEYSTO392026-11-07
13.202.179.30
India · Amazon.com, Inc.
exposed-secret exploit tunnelMD, PHP, YML, JE82026-11-07
107.162.254.150
United States · F5 Networks SARL
c2TXT22026-11-07
27.206.88.201
China · CHINA UNICOM China169 Backbone
malware mozi elf-binary12026-11-07
104.21.64.67
United States · Cloudflare, Inc.
filesCYOU12026-11-07
172.67.177.83
United States · Cloudflare, Inc.
filesCYOU12026-11-07
216.24.57.18
United States · Render
malware pe-binaryPE, TXT22026-11-07
216.24.57.16
United States · Render
malware pe-binaryPE, TXT22026-11-07
185.27.134.24
United Kingdom · Wildcard UK Limited
filesCOM12026-11-07
172.67.211.99
United States · Cloudflare, Inc.
filesCC12026-11-07
104.21.91.74
United States · Cloudflare, Inc.
filesCC12026-11-07
89.116.109.138
United Kingdom · Hostinger International Limited
filesCYOU12026-11-07
172.67.134.20
United States · Cloudflare, Inc.
exposed-secretCYOU12026-11-07
104.21.5.249
United States · Cloudflare, Inc.
exposed-secretCYOU12026-11-07
185.39.18.252
The Netherlands · BlueVPS OU
exposed-secret tunnelTXT, SH32026-11-07
154.29.75.185
United States · Tier.Net Technologies LLC
malware coinminer pe-binary tunnelPE, PS1, SH, ELF132026-11-07
45.38.60.192
United States · Cloud Software - FZCO
filesJE12026-11-07
13.244.76.8
South Africa · Amazon.com, Inc.
exposed-secretSORRY, TPL, NEW, SAMPLE1952026-11-07
45.131.214.101
Germany · MHost LLC
filesDZ12026-11-07
2.55.107.129
Israel · Partner Communications Ltd.
filesBIN12026-11-07
104.21.52.200
United States · Cloudflare, Inc.
filesTXT12026-11-07
172.67.203.95
United States · Cloudflare, Inc.
filesTXT12026-11-07
89.36.231.178
France · ROCKHOSTER PRIVATE LIMITED
malware coinminer exploit c2XML, SH, BAT, JAR2812026-11-07
152.175.230.66
Hong Kong · SKR-DE SAKURA INTERNATIONAL INVESTMENT LIMITED
exposed-secret malware mozi exploitJSON, JS, HTML, TXT352026-11-07
104.21.95.84
United States · Cloudflare, Inc.
filesTXT12026-11-07
172.67.143.216
United States · Cloudflare, Inc.
filesTXT12026-11-07
192.178.223.100
United States · Google LLC
filesCOM12026-11-07
188.68.38.98
Germany · netcup GmbH
exposed-secretTXT, ENV, JS, JSON72026-11-07
192.178.223.101
United States · Google LLC
filesCOM12026-11-07
192.178.223.102
United States · Google LLC
filesCOM12026-11-07
178.128.212.209
Singapore · DigitalOcean, LLC
filesJSON12026-11-07
117.55.226.237
Australia · MULTACOM CORPORATION
exposed-secret c2 tunnelSH, HTML, LOG, TXT102026-11-07
189.105.68.190
Hong Kong
exploit exposed-secret malware moziPY, LOG, JSONL, TXT132026-11-07
209.38.98.70
The Netherlands · DigitalOcean, LLC
exposed-secret exploitTXT22026-11-07
← NewerPage 19 of 120Older →
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free