Live findsCVE IntelResearchConsoleStart free
huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

5,965
hosts
106,472
files
103
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 2996malware 1224exploit 1134mozi 921c2 314webshell 282ioc-match 88coinminer 66gafgyt 56tsunami 41mirai 38sliver 31meterpreter 16havoc 15

Hosts labelled malware

HostLabelsFile typesFilesLast seen
89.58.25.93
Germany · netcup GmbH
malware exposed-secret pe-binaryPE, MANIFE, DEPLOY1142026-11-11
149.28.139.214
Singapore · The Constant Company, LLC
malware mozi exposed-secretTXT, ENV, JSON, PHP182026-11-11
51.83.108.104
France · OVH SAS
malware mozi exposed-secretTXT, ENV, JSON, PHP182026-11-11
176.9.125.11
Germany · Hetzner Online GmbH
malware mozi exposed-secretTXT, ENV, JSON, PHP182026-11-11
185.34.144.137
United States · CNServer LLC
malware mozi exposed-secret elf-binaryELF, MACHO, BAT, JAR2692026-11-11
47.22.166.163
United States · Cablevision Systems Corp.
malware mozi elf-binaryA12026-11-11
23.88.104.213
Germany · Hetzner Online GmbH
exposed-secret malware moziTXT22026-11-11
45.63.71.130
United States · The Constant Company, LLC
malware mozi exposed-secretTXT, ENV, JSON, PHP362026-11-11
45.77.179.49
Japan · The Constant Company, LLC
malware mozi exposed-secretTXT, ENV, JSON, PHP92026-11-11
46.224.139.234
Germany · Hetzner Online GmbH
malware mozi exposed-secretTXT42026-11-10
46.225.33.61
Germany · Hetzner Online GmbH
malware mozi exposed-secretTXT, ENV, JSON, PHP182026-11-10
185.199.108.133
United States · Fastly, Inc.
exploit ioc-match malware moziBAT, DBF, HTA, PS152026-11-10
185.199.109.133
United States · Fastly, Inc.
exploit ioc-match malware moziBAT, DBF, HTA, PS152026-11-10
185.7.214.119
Russia · changway-as Chang Way Technologies Co. Limited
malware moziTXT12026-11-10
52.172.140.8
India · Microsoft Corporation
exposed-secret exploit c2 webshellSH, PY, LOG, SQL2972026-11-10
165.227.87.198
United States · DigitalOcean, LLC
malware mozi exposed-secret tunnelTXT, LOG, PHP112026-11-10
51.89.98.132
Germany · OVH SAS
malware miraiSH12026-11-10
8.211.180.57
Singapore · Alibaba (US) Technology Co., Ltd.
exploit malware mozi exposed-secretHTML, LOG, PY142026-11-10
152.42.162.237
Singapore · DigitalOcean, LLC
exposed-secret exploit malware moziPY, TXT, LOG, ELF1352026-11-09
163.52.135.151
unknown network
exposed-secret exploit webshell malwarePY, HTML, TXT, PHP6112026-11-09
121.36.206.152
China · Huawei Cloud Service data center
malware coinminer exposed-secret c2ELF, TXT, LOG, PY242026-11-09
168.144.157.73
India · DigitalOcean, LLC
exposed-secret malware mozi exploitPY, SH, JS, TXT6332026-11-09
185.199.110.133
United States · Fastly, Inc.
exploit ioc-match malware moziBAT, DBF, HTA, PS152026-11-09
185.199.111.133
United States · Fastly, Inc.
exploit malware moziHTA, TXT22026-11-09
147.182.133.56
United States · DigitalOcean, LLC
exposed-secret malware exploit c2BIN, TXT, PE, HTML2372026-11-09
178.62.235.52
The Netherlands · DigitalOcean, LLC
exposed-secret exploit malware moziPY, LOG, HTML, TXT2092026-11-09
107.148.227.57
United States · PEG TECH INC
malware tunnel pe-binary elf-binaryLOG, PS1, PE, PY252026-11-09
132.226.169.119
South Korea · Oracle Corporation
exposed-secret malware mozi tunnelYAML, SH, BAK, ELF362026-11-09
8.138.12.59
Singapore · Hangzhou Alibaba Advertising Co.,Ltd.
exposed-secret exploit malware moziPY, JS, LOG, SH992026-11-09
46.101.155.48
Germany · DigitalOcean, LLC
exposed-secret malware mozi tunnelJS, LOG, TXT, ELF182026-11-09
154.217.248.243
United States · AROSSCLOUD INC.
malware mozi exposed-secretTXT, ENV, JSON, PHP92026-11-09
63.176.8.218
Germany · Amazon.com, Inc.
exposed-secret ioc-match malware pe-binaryAPP, JAR, CLICK, COM102026-11-09
35.157.26.135
Germany · Amazon.com, Inc.
exposed-secret ioc-match malware pe-binaryAPP, JAR, CLICK, COM102026-11-09
125.44.215.58
China · CHINA UNICOM China169 Backbone
malware mozi elf-binary12026-11-09
47.84.30.150
United States · Alibaba (US) Technology Co., Ltd.
malware c2 exploit exposed-secretELF, C, GZ, PY842026-11-09
8.130.172.119
Singapore · Hangzhou Alibaba Advertising Co.,Ltd.
exploit malware exposed-secret macho-binaryLOG, MACHO, PY, TXT1292026-11-09
130.94.95.155
Indonesia · NTT America, Inc.
exposed-secret malware mozi c2PY, HTML, LOG, JSON3162026-11-09
130.94.102.111
Mexico · NTT America, Inc.
exposed-secret malware macho-binaryMACHO, TXT22026-11-09
130.94.31.29
South Korea · NTT America, Inc.
exposed-secret malware mozi elf-binaryBAK, ELF, PE, SH142026-11-09
43.110.151.15
Singapore · Alibaba (US) Technology Co., Ltd.
malware pe-binaryZIP, PE132026-11-09
31.76.252.97
United States · VPSPay Networks LTD
malware elf-binaryELF, SH222026-11-09
123.173.4.27
China · Chinanet
malware mozi elf-binaryA12026-11-09
146.19.213.192
Russia · ALEXHOST SRL
malware exposed-secret mozi exploitPY, SH, LOG, TXT1,2702026-11-09
173.231.222.210
United States · InMotion Hosting, Inc.
exposed-secret malware mozi exploitGZ, SQL, PHP282026-11-08
104.21.10.19
United States · Cloudflare, Inc.
c2 malware sliver tunnelTXT12026-11-08
172.67.162.31
United States · Cloudflare, Inc.
c2 malware sliver tunnelTXT12026-11-08
39.104.70.157
China · Hangzhou Alibaba Advertising Co.,Ltd.
exposed-secret malware mozi exploitPY, SH, LOG, JAR2722026-11-08
154.12.86.207
Hong Kong · cognetcloud INC
exposed-secret exploit malware moziPY, LOG, JSON, SH1402026-11-08
192.99.19.65
Canada · OVH SAS
exploit malware pe-binaryHTA, PE, PS132026-11-08
64.176.34.176
Japan · The Constant Company, LLC
malware c2 mozi webshellPY, SH, TXT, ELF262026-11-08
← NewerPage 2 of 25Older →
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free