huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,965
hosts
106,472
files
103
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Every host we harvested files from, newest first
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 172.67.168.201 United States · Cloudflare, Inc. | exposed-secret | XYZ | 1 | 2026-11-12 |
| 104.21.54.179 United States · Cloudflare, Inc. | exposed-secret | XYZ | 1 | 2026-11-12 |
| 192.64.119.176 United States · Namecheap, Inc. | files | PICS | 1 | 2026-11-12 |
| 34.97.138.65 Japan · Google LLC | exposed-secret | COM | 7 | 2026-11-12 |
| 163.181.214.25 United States · Zhejiang Taobao Network Co.,Ltd | exposed-secret | TOP | 1 | 2026-11-12 |
| 163.181.214.6 United States · Zhejiang Taobao Network Co.,Ltd | exposed-secret | WANG | 1 | 2026-11-12 |
| 163.181.214.22 United States · Zhejiang Taobao Network Co.,Ltd | exposed-secret | TOP, TXT | 2 | 2026-11-12 |
| 172.67.177.2 United States · Cloudflare, Inc. | exposed-secret ioc-match | JS, SBS | 2 | 2026-11-12 |
| 104.21.35.154 United States · Cloudflare, Inc. | exposed-secret ioc-match | JS, SBS | 2 | 2026-11-12 |
| 104.21.64.56 United States · Cloudflare, Inc. | exposed-secret | ASIA | 1 | 2026-11-12 |
| 172.67.214.70 United States · Cloudflare, Inc. | ioc-match | BIN | 1 | 2026-11-12 |
| 104.21.61.200 United States · Cloudflare, Inc. | ioc-match | BIN | 1 | 2026-11-12 |
| 166.88.78.103 United States · Ace Data Centers II, L.L.C. | files | COM | 1 | 2026-11-12 |
| 198.37.105.52 United States · H4Y Technologies LLC | files | NET | 1 | 2026-11-12 |
| 80.76.49.203 United States · 12651980 CANADA INC. | exposed-secret | 1 | 2026-11-12 | |
| 172.67.218.75 United States · Cloudflare, Inc. | files | SBS, TXT | 2 | 2026-11-12 |
| 104.21.38.31 United States · Cloudflare, Inc. | files | SBS, TXT | 2 | 2026-11-12 |
| 104.21.19.18 United States · Cloudflare, Inc. | files | SPACE | 1 | 2026-11-12 |
| 172.67.184.117 United States · Cloudflare, Inc. | files | SPACE | 1 | 2026-11-12 |
| 219.94.129.174 Japan · SAKURA Internet Inc. | tunnel | WIN | 1 | 2026-11-12 |
| 162.4.84.247 Australia · ParkLogic Pty Ltd | files | US | 1 | 2026-11-12 |
| 45.63.107.63 United States · The Constant Company, LLC | exposed-secret | TXT, ENV, JSON, PHP | 10 | 2026-11-12 |
| 157.20.241.16 India · JOY SERVICES | coinminer malware tunnel | BIN, SH | 2 | 2026-11-12 |
| 31.76.94.111 United States · VPSPay Networks LTD | exploit malware exposed-secret mozi | PY, ELF, LOG, SH | 63 | 2026-11-12 |
| 8.210.29.71 Hong Kong · Alibaba (US) Technology Co., Ltd. | exposed-secret | ENV | 1 | 2026-11-12 |
| 144.91.73.196 France · Contabo GmbH | exposed-secret exploit | TXT, PHP, ENV, JSON | 52 | 2026-11-12 |
| 144.91.73.26 France · Contabo GmbH | exposed-secret | TXT | 2 | 2026-11-12 |
| 144.91.73.201 France · Contabo GmbH | exposed-secret | TXT | 1 | 2026-11-12 |
| 67.219.98.34 Australia · The Constant Company, LLC | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-11-12 |
| 216.238.101.165 Brazil · The Constant Company, LLC | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-11-12 |
| 142.93.14.200 United States · DigitalOcean, LLC | exposed-secret exploit | TXT, ENV, JSON | 6 | 2026-11-12 |
| 128.199.193.92 Singapore · DigitalOcean, LLC | exposed-secret exploit | TXT, ENV, JSON | 6 | 2026-11-12 |
| 51.81.220.78 United States · OVH SAS | exposed-secret exploit | TXT, ENV, JSON | 6 | 2026-11-12 |
| 143.110.148.161 United States · DigitalOcean, LLC | exposed-secret exploit | TXT, ENV, JSON | 6 | 2026-11-12 |
| 43.245.227.44 The Netherlands · HOSTKEY B.V. | malware mozi | PY, PYC, ZIP | 14 | 2026-11-12 |
| 144.91.73.103 France · Contabo GmbH | exposed-secret malware mozi exploit | PY, SH, TXT, PS1 | 563 | 2026-11-12 |
| 57.129.69.177 Germany · OVH SAS | exposed-secret | TXT | 1 | 2026-11-12 |
| 194.163.169.196 France · Contabo GmbH | exposed-secret | TXT | 1 | 2026-11-12 |
| 3.65.213.192 Germany · Amazon.com, Inc. | exposed-secret | TXT | 1 | 2026-11-12 |
| 65.109.15.18 Finland · Hetzner Online GmbH | exposed-secret | TXT, ENV | 3 | 2026-11-12 |
| 45.32.114.54 Singapore · The Constant Company, LLC | exposed-secret exploit | ENV, TXT, JSON, PHP | 10 | 2026-11-12 |
| 143.244.189.149 United States · DigitalOcean, LLC | exposed-secret | TXT | 1 | 2026-11-12 |
| 51.83.237.43 Poland · OVH SAS | malware mozi exposed-secret | TXT, ENV, JSON, PHP | 18 | 2026-11-12 |
| 159.69.101.222 Germany · Hetzner Online GmbH | malware mozi exposed-secret | TXT, ENV, JSON, PHP | 9 | 2026-11-12 |
| 51.75.146.212 Germany · OVH SAS | malware mozi exposed-secret | TXT, ENV, JSON, PHP | 18 | 2026-11-12 |
| 116.202.28.215 Germany · Hetzner Online GmbH | malware mozi exposed-secret | TXT, ENV, JSON, PHP | 18 | 2026-11-12 |
| 172.104.185.244 Singapore · Akamai Technologies, Inc. | exposed-secret malware mozi | TXT | 1 | 2026-11-12 |
| 174.138.48.6 United States · DigitalOcean, LLC | malware mozi exposed-secret | TXT, ENV, JSON, PHP | 9 | 2026-11-12 |
| 159.69.76.99 Germany · Hetzner Online GmbH | malware mozi exposed-secret | TXT, ENV, JSON, PHP | 9 | 2026-11-12 |
| 209.38.121.192 India · DigitalOcean, LLC | exposed-secret | TXT | 1 | 2026-11-12 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free