huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,967
hosts
106,479
files
112
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled exploit
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 37.157.255.190 Germany · WIIT AG | exploit exposed-secret | COM, MY, NET | 3 | 2026-10-02 |
| 185.5.52.223 Lithuania · UAB "Interneto vizija" | exploit | COM | 1 | 2026-10-02 |
| 166.1.80.161 United States · 2E TELEKOMUNIKASYON LTD STI | exploit | MY | 1 | 2026-10-02 |
| 23.26.4.86 United States · Raff Technologies LLC | exploit | COM | 1 | 2026-10-02 |
| 103.190.93.251 India · BHARAT DATACENTER | exploit | COM | 1 | 2026-10-02 |
| 165.22.120.234 United Kingdom · DigitalOcean, LLC | c2 exploit exposed-secret | TXT | 1 | 2026-10-02 |
| 135.148.3.41 United States · OVH SAS | exploit | COM | 1 | 2026-10-02 |
| 208.187.244.6 United States · Lanset America Corporation | exploit | COM | 1 | 2026-10-02 |
| 129.121.75.86 United States · Oracle Corporation | exposed-secret exploit | TXT | 2 | 2026-10-02 |
| 23.27.13.88 United States · Evoxt Sdn. Bhd. | exploit exposed-secret | TXT, ENV, JSON, PHP | 8 | 2026-10-02 |
| 23.27.11.247 United States · Evoxt Sdn. Bhd. | exposed-secret exploit | TXT | 2 | 2026-10-02 |
| 2.27.203.59 United States · TeraSwitch Networks Inc. | malware c2 exploit elf-binary | ELF, SH | 25 | 2026-10-02 |
| 167.235.225.192 Germany · Hetzner Online GmbH | exploit | INFO | 1 | 2026-10-02 |
| 178.16.52.154 Germany · Omegatech LTD | exposed-secret exploit malware mozi | GZ, LOG, PY, DONE | 154 | 2026-10-02 |
| 204.188.254.231 United States · Sharktech | exploit exposed-secret | TXT | 1 | 2026-10-01 |
| 89.124.67.72 The Netherlands · SERVERS TECH FZCO | exposed-secret exploit malware mozi | PY, MD, LOG, JSON | 10,428 | 2026-10-01 |
| 178.16.53.67 The Netherlands · Omegatech LTD | malware exposed-secret exploit webshell | PE, PS1, JSON, VBS | 154 | 2026-10-01 |
| 47.236.83.240 United States · Alibaba (US) Technology Co., Ltd. | malware exploit c2 exposed-secret | MACHO, BIN, JS, GITIGN | 65 | 2026-10-01 |
| 45.58.168.253 United States · Sharktech | exploit exposed-secret | TXT | 1 | 2026-10-01 |
| 185.100.234.137 The Netherlands · WorldStream B.V. | exploit exposed-secret | INFO | 1 | 2026-10-01 |
| 45.82.67.241 The Netherlands · WorldStream B.V. | exploit exposed-secret | COM | 1 | 2026-10-01 |
| 3.24.186.0 Australia · Amazon.com, Inc. | malware exploit pe-binary | PE, PS1 | 43 | 2026-10-01 |
| 138.197.188.152 Germany · DigitalOcean, LLC | exposed-secret exploit | TXT | 2 | 2026-09-30 |
| 62.3.58.98 Russia · TIME-HOST LTD | exposed-secret exploit malware mozi | PY, LOG, TXT, SH | 148 | 2026-09-30 |
| 218.3.160.34 China · Chinanet | exposed-secret malware exploit mozi | PHP, BAT, B64, PS1 | 88 | 2026-09-30 |
| 101.36.127.225 Hong Kong · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED | exploit exposed-secret | TXT, ENV, JSON, PHP | 16 | 2026-09-30 |
| 124.220.164.14 China · Shenzhen Tencent Computer Systems Company Limited | malware exploit exposed-secret c2 | MACHO, TXT, JAVA, SH | 89 | 2026-09-30 |
| 205.189.160.239 Hong Kong · LEASEWEB HONG KONG LIMITED | malware exploit macho-binary | JAR, MACHO, JAVA | 5 | 2026-09-30 |
| 185.148.144.99 Bulgaria · Belcloud LTD | exposed-secret exploit malware mozi | PHP, JS, TXT, PY | 306 | 2026-09-30 |
| 95.81.98.36 The Netherlands · CLODO CLOUD SERVICE CO. L.L.C | exploit exposed-secret | HTML, TXT | 5 | 2026-09-30 |
| 94.26.3.238 United States · MillenialHost Limited | exposed-secret malware mozi exploit | LOG, SH, PY, ZIP | 70 | 2026-09-30 |
| 81.82.11.65 Belgium · Telenet BV | exposed-secret exploit tunnel | TXT, PY, BAS | 16 | 2026-09-30 |
| 147.45.172.95 Kazakhstan · JSC "TIMEWEB" | exploit | PY, CSV | 6 | 2026-09-30 |
| 188.0.138.232 Kazakhstan · Jusan Mobile JSC | exploit | SH | 1 | 2026-09-30 |
| 46.233.50.11 Bulgaria · Point To Point Ltd. | exposed-secret exploit webshell malware | LOG, TXT, GZ, BIN | 49 | 2026-09-30 |
| 83.222.22.208 Russia · NLS ASTANA LLP | exploit | MOBILE | 1 | 2026-09-30 |
| 95.81.127.78 Finland · IHOR HOSTING LTD | exposed-secret exploit tunnel mirror | PY, TXT, BAK, SH | 39 | 2026-09-30 |
| 45.80.70.124 Russia · Beget LLC | exposed-secret exploit tunnel | SH, GZ, PHP, TXT | 186 | 2026-09-30 |
| 45.146.165.38 Russia · Beget LLC | malware mozi exploit webshell | PY, LOG, JSON, CSV | 46 | 2026-09-30 |
| 2.59.218.32 Bulgaria · BlueVPS OU | exposed-secret exploit malware tunnel | TGZ, PY, ELF, SH | 33 | 2026-09-30 |
| 78.153.155.55 United States · GLOBAL CONNECTIVITY SOLUTIONS LLP | exposed-secret exploit tunnel | TXT, BAT, HTML, PY | 5 | 2026-09-30 |
| 37.60.248.174 France · Contabo GmbH | exploit exposed-secret webshell malware | TXT, JSON, JS, MD | 365 | 2026-09-30 |
| 194.226.192.40 Russia · SCIENTIFIC RESEARCH INSTITUTE FOR SYSTEM ANALYSIS OF THE NATIONAL RESEARCH CENT | exposed-secret exploit tunnel | SAMPLE, TXT, LOG, GITIGN | 25 | 2026-09-30 |
| 45.153.190.16 Russia · Beget LLC | exposed-secret exploit | PY, DB, ENV, EXAMPL | 23 | 2026-09-30 |
| 43.129.51.137 Indonesia · Shenzhen Tencent Computer Systems Company Limited | exposed-secret malware gafgyt exploit | PY, MD, LOG, JSON | 115 | 2026-09-30 |
| 194.87.187.20 Russia · JSC "TIMEWEB" | exploit | ZIP, PS1 | 3 | 2026-09-30 |
| 45.12.18.80 Russia · Beget LLC | exposed-secret exploit tunnel | PY, TXT, ENV, GITIGN | 19 | 2026-09-30 |
| 122.166.178.204 India · Bharti Airtel Limited | exposed-secret exploit malware sliver | PY, TXT, ENV, GITIGN | 77 | 2026-09-30 |
| 51.79.251.75 Canada · OVH SAS | exposed-secret exploit malware tunnel | LOG, PY, TXT, BAK | 34 | 2026-09-30 |
| 170.106.98.130 United States · Shenzhen Tencent Computer Systems Company Limited | exposed-secret exploit webshell tunnel | MD, SAMPLE, PY, TXT | 54 | 2026-09-30 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free