huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,965
hosts
106,472
files
103
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled webshell
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 154.83.211.131 United States · Zillion Network Inc. | webshell | TOP | 1 | 2026-11-05 |
| 43.135.35.8 Hong Kong · Shenzhen Tencent Computer Systems Company Limited | malware mozi exposed-secret exploit | SH, PY, LOG, JS | 582 | 2026-11-05 |
| 43.159.51.87 Singapore · Shenzhen Tencent Computer Systems Company Limited | webshell exposed-secret exploit tunnel | PHP, PHTML, PHP5, TXT | 94 | 2026-11-05 |
| 161.33.148.80 Japan · Oracle Corporation | exposed-secret malware mozi exploit | HDR, SH, TGZ, TXT | 294 | 2026-11-05 |
| 43.161.243.73 Hong Kong · Shenzhen Tencent Computer Systems Company Limited | exploit malware exposed-secret mozi | LOG, PY, MACHO, SH | 417 | 2026-11-05 |
| 143.246.202.252 United States | exposed-secret exploit c2 malware | PS1, PY, HTML, PE | 8 | 2026-11-05 |
| 104.233.150.138 United States · PEG TECH INC | exposed-secret exploit webshell tunnel | SH, TXT, PY, CMD | 46 | 2026-11-05 |
| 168.144.251.199 United States | exploit exposed-secret webshell malware | PHP, HTML, LOG, PY | 146 | 2026-11-05 |
| 94.130.22.61 Germany · Hetzner Online GmbH | exposed-secret exploit malware mozi | PY, EML, JSON, TXT | 1,209 | 2026-11-05 |
| 23.27.25.75 United States · Evoxt Sdn. Bhd. | exposed-secret malware mozi exploit | PY, SQL, JSON, LOG | 129 | 2026-11-05 |
| 104.21.19.4 United States · Cloudflare, Inc. | webshell | COM | 1 | 2026-11-04 |
| 172.67.184.92 United States · Cloudflare, Inc. | webshell | COM | 1 | 2026-11-04 |
| 202.95.14.76 Hong Kong · CTG Server Limited | exploit malware mozi exposed-secret | PHP, PY, TXT, ZIP | 417 | 2026-11-04 |
| 202.95.14.69 Hong Kong · CTG Server Limited | exploit malware mozi exposed-secret | PHP, PY, TXT, ZIP | 417 | 2026-11-04 |
| 23.248.226.189 United States · YANCY LIMITED | exposed-secret exploit malware mozi | GZ, GITIGN, MD, PHP | 115 | 2026-11-04 |
| 23.248.226.187 United States · YANCY LIMITED | exposed-secret exploit malware mozi | GZ, GITIGN, MD, PHP | 115 | 2026-11-04 |
| 23.248.226.188 United States · YANCY LIMITED | exposed-secret exploit malware mozi | GZ, GITIGN, MD, PHP | 115 | 2026-11-04 |
| 23.248.226.186 United States · YANCY LIMITED | exposed-secret exploit malware mozi | GZ, GITIGN, MD, PHP | 115 | 2026-11-04 |
| 23.248.226.190 United States · YANCY LIMITED | exposed-secret exploit malware mozi | GZ, GITIGN, MD, PHP | 115 | 2026-11-04 |
| 202.95.14.60 Hong Kong · CTG Server Limited | exploit malware mozi exposed-secret | PHP, PY, TXT, ZIP | 417 | 2026-11-04 |
| 207.56.221.47 United States · NTT America, Inc. | exposed-secret malware mozi exploit | PY, LOG, SH, TXT | 625 | 2026-11-04 |
| 38.60.227.210 United States · Kaopu Cloud HK Limited | exposed-secret malware mozi c2 | PY, TXT, SH, PS1 | 1,000 | 2026-11-04 |
| 158.247.218.226 South Korea · The Constant Company, LLC | exposed-secret malware mozi exploit | PY, JS, LOG, TXT | 388 | 2026-11-04 |
| 172.104.173.165 Singapore · Akamai Technologies, Inc. | exposed-secret exploit webshell malware | PY, SH, ELF, LOG | 85 | 2026-11-04 |
| 62.212.70.235 The Netherlands · LeaseWeb Netherlands B.V. | exposed-secret webshell | TXT | 2 | 2026-11-04 |
| 177.3.43.43 United States · Hong Kong Communications International Co., Limited | malware c2 exposed-secret webshell | PE, PY, PHP, SH | 24 | 2026-11-04 |
| 39.99.242.80 China · Hangzhou Alibaba Advertising Co.,Ltd. | exploit exposed-secret malware mozi | PY, TXT, SH, MD | 128 | 2026-11-03 |
| 39.96.205.8 China · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret exploit webshell malware | GO, LOG, PY, TXT | 576 | 2026-11-03 |
| 198.44.116.69 United States · HostPapa | exposed-secret malware mozi exploit | PY, SH, JSON, LOG | 733 | 2026-11-03 |
| 47.112.221.124 China · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret malware exploit webshell | PY, JSON, LOG, BAT | 141 | 2026-11-03 |
| 198.23.145.14 United States · HostPapa | exposed-secret exploit c2 webshell | SH, PY, SQL, MD | 792 | 2026-11-03 |
| 69.12.64.195 United States · HostPapa | exposed-secret malware mozi webshell | PHP, JS, ASP, LOG | 112 | 2026-11-03 |
| 192.227.241.226 United States · HostPapa | exposed-secret exploit malware mozi | PY, SH, LOG, GZ | 538 | 2026-11-03 |
| 20.209.1.107 United States · Microsoft Corporation | ioc-match webshell | BAT | 1 | 2026-11-03 |
| 152.42.193.28 Singapore · DigitalOcean, LLC | exposed-secret malware mozi exploit | SH, PY, TGZ, LOG | 747 | 2026-11-03 |
| 188.166.206.102 Singapore · DigitalOcean, LLC | exposed-secret malware mozi exploit | SH, PY, TGZ, LOG | 747 | 2026-11-03 |
| 101.126.4.50 China · Beijing Volcano Engine Technology Co., Ltd. | exploit webshell exposed-secret malware | LOG, SH, PY, JSON | 175 | 2026-11-03 |
| 172.105.156.153 United States · Akamai Technologies, Inc. | exposed-secret exploit malware mozi | TXT, JSON, SH, MD | 163 | 2026-11-03 |
| 194.233.67.247 Singapore · Contabo Asia Private Limited | exploit exposed-secret malware mozi | TXT, PHP, HTML, PY | 354 | 2026-11-02 |
| 173.212.244.40 France · Contabo GmbH | exposed-secret exploit webshell c2 | PY, HTML, MD, PHP | 523 | 2026-11-02 |
| 203.194.115.12 Indonesia · Rumahweb | exposed-secret exploit malware webshell | PY, LOG, PHP, JAR | 360 | 2026-11-02 |
| 83.172.138.182 Germany · M247 Europe SRL | exposed-secret malware mozi exploit | PY, TXT, APK, HTML | 301 | 2026-11-02 |
| 147.93.159.0 Singapore · Contabo Asia Private Limited | exposed-secret exploit webshell malware | PY, PHP, SH, C | 86 | 2026-11-02 |
| 45.148.10.183 AD · TECHOFF SRV LIMITED | malware exploit mozi webshell | PE, CMD, PS1, VBS | 18 | 2026-11-02 |
| 92.246.129.98 Brazil · ITGLOBAL.COM NL B.V. | exposed-secret exploit malware mozi | JS, JSON, PY, SH | 347 | 2026-11-02 |
| 78.111.90.130 Canada · ITGLOBAL.COM NL B.V. | exposed-secret exploit malware mozi | TXT, SH, JSON, LOG | 243 | 2026-11-02 |
| 27.131.106.133 Australia · Micron21 Datacentre Pty Ltd | exposed-secret exploit coinminer malware | SAMPLE, TXT, GZ, PY | 29 | 2026-11-02 |
| 64.118.151.226 Hong Kong · Eons Data Communications Limited | exploit exposed-secret malware mozi | SH, LOG, MD, JSON | 147 | 2026-11-02 |
| 38.60.157.55 United States · Kaopu Cloud HK Limited | exposed-secret exploit malware webshell | SH, C, ELF, TXT | 42 | 2026-11-02 |
| 111.68.4.13 Hong Kong · Netsec Limited | exploit exposed-secret malware webshell | SH, PY, ELF, BIN | 58 | 2026-11-02 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free