huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,965
hosts
106,472
files
103
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled exploit
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 199.91.221.237 United States · BL Networks | c2 exposed-secret exploit malware | JS | 2 | 2026-11-11 |
| 57.128.226.85 Poland · OVH SAS | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-11-11 |
| 15.204.57.219 United States · OVH SAS | exposed-secret exploit | TXT | 2 | 2026-11-11 |
| 165.227.115.29 United States · DigitalOcean, LLC | exposed-secret exploit | TXT | 3 | 2026-11-11 |
| 151.101.63.10 United States · Fastly, Inc. | exploit c2 | TXT, HTML, PDF | 4 | 2026-11-11 |
| 104.18.31.6 United States · Cloudflare, Inc. | exploit | TXT | 2 | 2026-11-11 |
| 104.18.30.6 United States · Cloudflare, Inc. | exploit | TXT | 2 | 2026-11-11 |
| 172.65.90.26 United States · Cloudflare, Inc. | c2 exploit | TXT | 2 | 2026-11-11 |
| 172.65.90.25 United States · Cloudflare, Inc. | c2 exploit | TXT | 2 | 2026-11-11 |
| 172.65.90.24 United States · Cloudflare, Inc. | c2 exploit | TXT | 2 | 2026-11-11 |
| 172.65.90.27 United States · Cloudflare, Inc. | c2 exploit | TXT | 2 | 2026-11-11 |
| 198.202.211.1 United States · Cloudflare London, LLC | exploit | TXT | 3 | 2026-11-11 |
| 172.67.153.110 United States · Cloudflare, Inc. | exploit | TXT | 1 | 2026-11-11 |
| 104.21.74.24 United States · Cloudflare, Inc. | exploit | TXT | 1 | 2026-11-11 |
| 104.21.37.67 United States · Cloudflare, Inc. | c2 exploit | COM | 1 | 2026-11-10 |
| 185.199.108.133 United States · Fastly, Inc. | exploit ioc-match malware mozi | BAT, DBF, HTA, PS1 | 5 | 2026-11-10 |
| 185.199.109.133 United States · Fastly, Inc. | exploit ioc-match malware mozi | BAT, DBF, HTA, PS1 | 5 | 2026-11-10 |
| 52.172.140.8 India · Microsoft Corporation | exposed-secret exploit c2 webshell | SH, PY, LOG, SQL | 297 | 2026-11-10 |
| 77.239.124.167 The Netherlands · Alfahost LLC | c2 exploit ioc-match tunnel | TXT | 2 | 2026-11-10 |
| 165.22.220.74 India · DigitalOcean, LLC | exposed-secret exploit | TXT | 2 | 2026-11-10 |
| 169.58.109.98 United States · TerraTransit AG | exposed-secret exploit | TXT, ENV | 3 | 2026-11-10 |
| 8.211.180.57 Singapore · Alibaba (US) Technology Co., Ltd. | exploit malware mozi exposed-secret | HTML, LOG, PY | 14 | 2026-11-10 |
| 152.42.162.237 Singapore · DigitalOcean, LLC | exposed-secret exploit malware mozi | PY, TXT, LOG, ELF | 135 | 2026-11-09 |
| 163.52.135.151 unknown network | exposed-secret exploit webshell malware | PY, HTML, TXT, PHP | 611 | 2026-11-09 |
| 168.144.157.73 India · DigitalOcean, LLC | exposed-secret malware mozi exploit | PY, SH, JS, TXT | 633 | 2026-11-09 |
| 185.199.110.133 United States · Fastly, Inc. | exploit ioc-match malware mozi | BAT, DBF, HTA, PS1 | 5 | 2026-11-09 |
| 185.199.111.133 United States · Fastly, Inc. | exploit malware mozi | HTA, TXT | 2 | 2026-11-09 |
| 147.182.133.56 United States · DigitalOcean, LLC | exposed-secret malware exploit c2 | BIN, TXT, PE, HTML | 237 | 2026-11-09 |
| 104.248.53.161 United States · DigitalOcean, LLC | exploit exposed-secret webshell tunnel | PY, LOG, SH, HTML | 374 | 2026-11-09 |
| 178.62.235.52 The Netherlands · DigitalOcean, LLC | exposed-secret exploit malware mozi | PY, LOG, HTML, TXT | 209 | 2026-11-09 |
| 8.138.12.59 Singapore · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret exploit malware mozi | PY, JS, LOG, SH | 99 | 2026-11-09 |
| 64.23.130.129 United States · DigitalOcean, LLC | exposed-secret exploit | TXT | 2 | 2026-11-09 |
| 32.190.234.21 United States · Amazon.com, Inc. | exploit tunnel | HTML | 5 | 2026-11-09 |
| 47.84.30.150 United States · Alibaba (US) Technology Co., Ltd. | malware c2 exploit exposed-secret | ELF, C, GZ, PY | 84 | 2026-11-09 |
| 8.130.172.119 Singapore · Hangzhou Alibaba Advertising Co.,Ltd. | exploit malware exposed-secret macho-binary | LOG, MACHO, PY, TXT | 129 | 2026-11-09 |
| 130.94.95.155 Indonesia · NTT America, Inc. | exposed-secret malware mozi c2 | PY, HTML, LOG, JSON | 316 | 2026-11-09 |
| 5.129.209.49 The Netherlands · Timeweb, LLP | exposed-secret exploit | TXT, ENV, JSON | 4 | 2026-11-09 |
| 146.19.213.192 Russia · ALEXHOST SRL | malware exposed-secret mozi exploit | PY, SH, LOG, TXT | 1,270 | 2026-11-09 |
| 43.212.174.40 Taiwan · Amazon.com, Inc. | exposed-secret exploit | TXT, ENV | 6 | 2026-11-09 |
| 2.31.144.19 Finland | exposed-secret exploit | TXT, ENV, JSON | 8 | 2026-11-09 |
| 64.29.17.195 United States · Amazon.com, Inc. | exposed-secret exploit | APP | 21 | 2026-11-09 |
| 64.227.158.204 India · DigitalOcean, LLC | exploit exposed-secret | ENV, LOG, TXT | 3 | 2026-11-09 |
| 173.231.222.210 United States · InMotion Hosting, Inc. | exposed-secret malware mozi exploit | GZ, SQL, PHP | 28 | 2026-11-08 |
| 138.197.52.52 United States · DigitalOcean, LLC | exposed-secret exploit | TXT | 2 | 2026-11-08 |
| 172.67.216.42 United States · Cloudflare, Inc. | exploit | TOP | 1 | 2026-11-08 |
| 104.21.53.186 United States · Cloudflare, Inc. | exploit | TOP | 1 | 2026-11-08 |
| 104.21.56.29 United States · Cloudflare, Inc. | c2 exploit tunnel | CSV | 1 | 2026-11-08 |
| 172.67.176.26 United States · Cloudflare, Inc. | c2 exploit tunnel | CSV | 1 | 2026-11-08 |
| 39.104.70.157 China · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret malware mozi exploit | PY, SH, LOG, JAR | 272 | 2026-11-08 |
| 130.94.36.92 Taiwan · NTT America, Inc. | exposed-secret exploit tunnel | PY, LOG, TXT | 10 | 2026-11-08 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free