huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,967
hosts
106,479
files
112
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Every host we harvested files from, newest first
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 104.21.41.226 United States · Cloudflare, Inc. | files | SHOP | 1 | 2026-11-05 |
| 89.116.109.214 United Kingdom · Hostinger International Limited | exposed-secret | COM, PHP, TECH | 3 | 2026-11-05 |
| 104.21.39.173 United States · Cloudflare, Inc. | files | LIVE | 1 | 2026-11-05 |
| 172.67.147.100 United States · Cloudflare, Inc. | files | LIVE | 1 | 2026-11-05 |
| 104.21.57.168 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-05 |
| 104.21.38.162 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-05 |
| 172.67.136.20 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-05 |
| 172.67.147.217 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-05 |
| 172.67.135.80 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-05 |
| 104.21.6.218 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-05 |
| 120.28.222.207 Philippines · Globe Telecom Inc. | malware mozi elf-binary | A | 1 | 2026-11-05 |
| 31.207.4.26 United States · Trunk Networks LTD | files | JSON | 1 | 2026-11-05 |
| 20.106.126.48 United States · Microsoft Corporation | exposed-secret | TXT | 1 | 2026-11-05 |
| 50.17.210.182 United States · Amazon.com, Inc. | files | COM | 1 | 2026-11-05 |
| 20.60.234.1 Sweden · Microsoft Corporation | files | NET | 1 | 2026-11-05 |
| 20.150.121.132 Norway · Microsoft Corporation | ioc-match | ZIP | 1 | 2026-11-05 |
| 172.67.133.227 United States · Cloudflare, Inc. | files | TOP | 1 | 2026-11-05 |
| 104.21.61.56 United States · Cloudflare, Inc. | files | PHP | 2 | 2026-11-05 |
| 104.21.25.85 United States · Cloudflare, Inc. | files | TOP | 1 | 2026-11-05 |
| 172.67.206.129 United States · Cloudflare, Inc. | files | PHP | 2 | 2026-11-05 |
| 100.49.241.171 United States · Amazon.com, Inc. | exposed-secret | TXT, ENV, JSON, PHP | 114 | 2026-11-05 |
| 185.28.119.18 United Kingdom · BlueVPS OU | exploit exposed-secret webshell malware | MD, PY, SH, LOG | 160 | 2026-11-05 |
| 178.83.45.33 Germany · OVH SAS | coinminer exposed-secret malware tunnel | LOG, SH | 2 | 2026-11-05 |
| 45.32.43.240 Japan · The Constant Company, LLC | files | PY | 1 | 2026-11-05 |
| 54.37.128.190 Poland · OVH SAS | files | JP | 2 | 2026-11-05 |
| 13.223.25.84 United States · Amazon.com, Inc. | files | COM | 2 | 2026-11-05 |
| 54.243.117.197 United States · Amazon.com, Inc. | files | COM | 2 | 2026-11-05 |
| 35.190.27.135 United States · Google LLC | malware mozi | ONLINE | 2 | 2026-11-05 |
| 154.83.211.131 United States · Zillion Network Inc. | webshell | TOP | 1 | 2026-11-05 |
| 34.97.152.185 Japan · Google LLC | exposed-secret | COM | 26 | 2026-11-05 |
| 212.11.60.204 Taiwan · OCTOPUS WEB SOLUTION INC | exposed-secret malware mozi | COM | 2 | 2026-11-05 |
| 47.243.139.160 United States · Alibaba (US) Technology Co., Ltd. | files | TOP | 1 | 2026-11-05 |
| 140.188.124.242 United States · PEG TECH INC | files | COM | 1 | 2026-11-05 |
| 153.52.255.47 United States · Railway | exposed-secret | UA | 1 | 2026-11-05 |
| 185.77.97.201 United States · Hostinger International Limited | files | COM, SHOP | 2 | 2026-11-05 |
| 172.67.208.179 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-05 |
| 104.21.69.128 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-05 |
| 195.200.9.86 United Kingdom · Hostinger International Limited | files | COM, SHOP | 2 | 2026-11-05 |
| 89.108.69.199 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
| 89.108.69.158 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
| 89.108.69.108 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
| 37.140.192.28 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
| 89.108.69.148 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
| 185.217.198.154 Russia · FIRST SERVER LIMITED | malware mozi | M3U | 1 | 2026-11-05 |
| 95.182.90.214 United Arab Emirates · Cloud Software - FZCO | exploit exposed-secret | KEY | 1 | 2026-11-05 |
| 38.190.196.184 United States · SonderCloud Limited | files | JSON | 1 | 2026-11-05 |
| 43.135.35.8 Hong Kong · Shenzhen Tencent Computer Systems Company Limited | malware mozi exposed-secret exploit | SH, PY, LOG, JS | 582 | 2026-11-05 |
| 43.159.51.87 Singapore · Shenzhen Tencent Computer Systems Company Limited | webshell exposed-secret exploit tunnel | PHP, PHTML, PHP5, TXT | 94 | 2026-11-05 |
| 109.238.87.159 United Kingdom · B2 Net Solutions Inc. | exposed-secret malware mozi exploit | TXT, SH, BIN, JSON | 11 | 2026-11-05 |
| 89.108.69.89 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free