huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,965
hosts
106,472
files
103
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled c2
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 179.43.171.202 Panama · Private Layer INC | exposed-secret exploit malware mozi | LOG, PY, JSON, TXT | 76 | 2026-11-08 |
| 129.212.132.33 United States · DigitalOcean, LLC | c2 | TXT | 1 | 2026-11-07 |
| 150.171.109.213 United States · Microsoft Corporation | exploit c2 malware sliver | HTML, TXT | 2 | 2026-11-07 |
| 193.187.110.10 Turkey · FAST ZONE IT | exposed-secret c2 | TXT, ENV, JSON, PHP | 7 | 2026-11-07 |
| 38.60.91.186 United States · FASTNET DATA INC | exposed-secret malware mozi exploit | SH, PY, LOG, TXT | 1,039 | 2026-11-07 |
| 192.236.152.232 United States · HostPapa | exploit exposed-secret malware mozi | PY, TXT, SH, LOG | 241 | 2026-11-07 |
| 3.84.186.180 United States · Amazon.com, Inc. | exposed-secret malware mozi exploit | PY, HTML, JS, TXT | 829 | 2026-11-07 |
| 3.128.117.168 United States · Amazon.com, Inc. | exposed-secret exploit malware mozi | PHP, JS, BIN, DB | 256 | 2026-11-07 |
| 64.23.240.211 United States · DigitalOcean, LLC | malware exploit coinminer exposed-secret | PY, LOG, TXT, SH | 386 | 2026-11-07 |
| 8.212.181.6 Philippines · Alibaba (US) Technology Co., Ltd. | exposed-secret malware cobalt-strike c2 | GO, BIN, TXT, PE | 77 | 2026-11-07 |
| 13.215.184.109 Singapore · Amazon.com, Inc. | exposed-secret malware exploit mozi | JSON, TXT, SH, PY | 136 | 2026-11-07 |
| 16.59.36.98 United States · Amazon.com, Inc. | c2 exposed-secret exploit malware | LOG, SH, PY, JSON | 72 | 2026-11-07 |
| 3.26.94.147 Australia · Amazon.com, Inc. | c2 exploit malware exposed-secret | PY, TOC, PE, MD | 67 | 2026-11-07 |
| 13.63.179.207 Sweden · Amazon.com, Inc. | exposed-secret malware mozi c2 | TXT, APK, GITIGN, KEYSTO | 39 | 2026-11-07 |
| 107.162.254.150 United States · F5 Networks SARL | c2 | TXT | 2 | 2026-11-07 |
| 89.36.231.178 France · ROCKHOSTER PRIVATE LIMITED | malware coinminer exploit c2 | XML, SH, BAT, JAR | 281 | 2026-11-07 |
| 117.55.226.237 Australia · MULTACOM CORPORATION | exposed-secret c2 tunnel | SH, HTML, LOG, TXT | 10 | 2026-11-07 |
| 104.16.231.132 United States · Cloudflare, Inc. | c2 malware mozi | COM, JS | 4 | 2026-11-06 |
| 104.16.230.132 United States · Cloudflare, Inc. | c2 malware mozi | COM, JS | 4 | 2026-11-06 |
| 110.42.215.163 China · Shenzhen Tencent Computer Systems Company Limited | exploit exposed-secret malware mozi | GO, LOG, PY, PS1 | 317 | 2026-11-06 |
| 172.67.170.36 United States · Cloudflare, Inc. | c2 | COM | 1 | 2026-11-06 |
| 104.21.28.11 United States · Cloudflare, Inc. | c2 | COM | 1 | 2026-11-06 |
| 185.28.119.18 United Kingdom · BlueVPS OU | exploit exposed-secret webshell malware | MD, PY, SH, LOG | 160 | 2026-11-05 |
| 43.135.35.8 Hong Kong · Shenzhen Tencent Computer Systems Company Limited | malware mozi exposed-secret exploit | SH, PY, LOG, JS | 582 | 2026-11-05 |
| 161.33.148.80 Japan · Oracle Corporation | exposed-secret malware mozi exploit | HDR, SH, TGZ, TXT | 294 | 2026-11-05 |
| 43.161.243.73 Hong Kong · Shenzhen Tencent Computer Systems Company Limited | exploit malware exposed-secret mozi | LOG, PY, MACHO, SH | 417 | 2026-11-05 |
| 143.246.202.252 United States | exposed-secret exploit c2 malware | PS1, PY, HTML, PE | 8 | 2026-11-05 |
| 64.93.12.85 United States · GTT Communications Inc. | c2 coinminer exposed-secret malware | LOG, TXT | 2 | 2026-11-05 |
| 176.65.132.7 The Netherlands · Pfcloud UG (haftungsbeschrankt) | malware tsunami c2 exposed-secret | ELF, DZ, SH, TXT | 8 | 2026-11-05 |
| 51.15.107.106 France · Scaleway SAS | c2 cobalt-strike exploit malware | TXT | 1 | 2026-11-05 |
| 168.144.251.199 United States | exploit exposed-secret webshell malware | PHP, HTML, LOG, PY | 146 | 2026-11-05 |
| 94.130.22.61 Germany · Hetzner Online GmbH | exposed-secret exploit malware mozi | PY, EML, JSON, TXT | 1,209 | 2026-11-05 |
| 23.27.25.75 United States · Evoxt Sdn. Bhd. | exposed-secret malware mozi exploit | PY, SQL, JSON, LOG | 129 | 2026-11-05 |
| 202.95.14.76 Hong Kong · CTG Server Limited | exploit malware mozi exposed-secret | PHP, PY, TXT, ZIP | 417 | 2026-11-04 |
| 202.95.14.69 Hong Kong · CTG Server Limited | exploit malware mozi exposed-secret | PHP, PY, TXT, ZIP | 417 | 2026-11-04 |
| 202.95.14.60 Hong Kong · CTG Server Limited | exploit malware mozi exposed-secret | PHP, PY, TXT, ZIP | 417 | 2026-11-04 |
| 104.21.67.152 United States · Cloudflare, Inc. | c2 exploit | COM | 1 | 2026-11-04 |
| 207.56.221.47 United States · NTT America, Inc. | exposed-secret malware mozi exploit | PY, LOG, SH, TXT | 625 | 2026-11-04 |
| 38.54.88.171 United States · Kaopu Cloud HK Limited | exploit exposed-secret malware mozi | PY, SH, LOG, TXT | 200 | 2026-11-04 |
| 38.60.227.210 United States · Kaopu Cloud HK Limited | exposed-secret malware mozi c2 | PY, TXT, SH, PS1 | 1,000 | 2026-11-04 |
| 158.247.218.226 South Korea · The Constant Company, LLC | exposed-secret malware mozi exploit | PY, JS, LOG, TXT | 388 | 2026-11-04 |
| 64.177.47.135 United States | malware exposed-secret exploit c2 | PE, PY, MD, TXT | 97 | 2026-11-04 |
| 177.3.43.43 United States · Hong Kong Communications International Co., Limited | malware c2 exposed-secret webshell | PE, PY, PHP, SH | 24 | 2026-11-04 |
| 27.102.137.57 South Korea · DAOU TECHNOLOGY | c2 exploit exposed-secret | TXT | 2 | 2026-11-03 |
| 39.96.205.8 China · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret exploit webshell malware | GO, LOG, PY, TXT | 576 | 2026-11-03 |
| 198.44.116.69 United States · HostPapa | exposed-secret malware mozi exploit | PY, SH, JSON, LOG | 733 | 2026-11-03 |
| 198.23.145.14 United States · HostPapa | exposed-secret exploit c2 webshell | SH, PY, SQL, MD | 792 | 2026-11-03 |
| 8.138.0.225 Singapore · Hangzhou Alibaba Advertising Co.,Ltd. | c2 exposed-secret | HTML | 7 | 2026-11-03 |
| 69.12.64.195 United States · HostPapa | exposed-secret malware mozi webshell | PHP, JS, ASP, LOG | 112 | 2026-11-03 |
| 192.227.241.226 United States · HostPapa | exposed-secret exploit malware mozi | PY, SH, LOG, GZ | 538 | 2026-11-03 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free