huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,965
hosts
106,472
files
103
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Every host we harvested files from, newest first
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 45.56.120.49 United States · Akamai Technologies, Inc. | malware mozi exposed-secret | TXT, ENV, JSON, PHP | 9 | 2026-11-12 |
| 159.69.216.240 Germany · Hetzner Online GmbH | exposed-secret | TXT | 1 | 2026-11-12 |
| 91.134.102.116 France · OVH SAS | malware mozi exposed-secret | TXT, ENV, JSON, PHP | 9 | 2026-11-12 |
| 206.189.72.122 United States · DigitalOcean, LLC | exposed-secret | ENV | 1 | 2026-11-12 |
| 45.32.38.80 Japan · The Constant Company, LLC | exposed-secret | TXT | 1 | 2026-11-12 |
| 148.113.239.96 Canada · OVH SAS | exposed-secret | TXT | 2 | 2026-11-12 |
| 2.28.106.56 Germany · Hetzner Online GmbH | exposed-secret | TXT | 1 | 2026-11-12 |
| 65.108.218.167 Finland · Hetzner Online GmbH | exposed-secret | TXT | 1 | 2026-11-12 |
| 37.120.178.130 Germany · netcup GmbH | exposed-secret | TXT | 1 | 2026-11-12 |
| 85.120.53.131 Romania · Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti | exposed-secret | TXT | 1 | 2026-11-12 |
| 13.184.160.159 United States | exposed-secret exploit malware mozi | PY, SH, LOG, GO | 1,029 | 2026-11-12 |
| 168.144.111.89 Singapore · DigitalOcean, LLC | exposed-secret exploit webshell malware | TXT, HTML, PHP, SH | 328 | 2026-11-12 |
| 144.91.73.218 France · Contabo GmbH | exposed-secret | TXT, ENV, JSON, PHP | 9 | 2026-11-12 |
| 104.21.54.196 United States · Cloudflare, Inc. | files | IO, TXT | 2 | 2026-11-12 |
| 172.67.141.93 United States · Cloudflare, Inc. | files | IO, TXT | 2 | 2026-11-12 |
| 8.210.103.219 Hong Kong · Alibaba (US) Technology Co., Ltd. | exposed-secret exploit | TXT | 2 | 2026-11-12 |
| 112.225.228.141 China · CHINA UNICOM China169 Backbone | malware mozi elf-binary | A | 1 | 2026-11-12 |
| 20.26.156.215 United Kingdom · Microsoft Corporation | exposed-secret exploit malware pe-binary | TXT, BAT, PE, TOML | 33 | 2026-11-12 |
| 115.159.204.46 China · Shenzhen Tencent Computer Systems Company Limited | exposed-secret exploit malware gafgyt | PY, LOG, JSON, MD | 167 | 2026-11-12 |
| 141.0.143.61 Norway · Svorka AS | malware mozi elf-binary | A | 1 | 2026-11-12 |
| 104.21.6.116 United States · Cloudflare, Inc. | exploit | COM, TXT | 2 | 2026-11-12 |
| 172.67.134.197 United States · Cloudflare, Inc. | exploit | COM, TXT | 2 | 2026-11-12 |
| 104.21.73.144 United States · Cloudflare, Inc. | malware mozi | COM, PS1 | 2 | 2026-11-12 |
| 172.67.145.149 United States · Cloudflare, Inc. | malware mozi | COM, PS1 | 2 | 2026-11-12 |
| 78.40.143.156 Malaysia · Shinjiru Technology Sdn Bhd | files | ZIP | 1 | 2026-11-12 |
| 206.189.167.156 United States · DigitalOcean, LLC | malware mozi exposed-secret exploit | PY, SH, MD, TXT | 326 | 2026-11-12 |
| 217.160.132.82 Spain · IONOS SE | exposed-secret exploit malware mozi | PY, SH, PHP, TXT | 911 | 2026-11-12 |
| 51.210.38.62 France · OVH SAS | exploit exposed-secret | TXT, ENV, JSON, PHP | 9 | 2026-11-12 |
| 37.16.74.169 The Netherlands · RoyaleHosting BV | tunnel | SH | 4 | 2026-11-12 |
| 216.198.79.1 United States · Amazon.com, Inc. | exploit exposed-secret tunnel | JS, ONLINE, CHAT, COM | 13 | 2026-11-11 |
| 20.120.242.5 United States · Microsoft Corporation | ioc-match | BIN | 1 | 2026-11-11 |
| 76.223.67.189 United States · Amazon.com, Inc. | files | COM | 1 | 2026-11-11 |
| 13.248.213.45 United States · Amazon.com, Inc. | files | COM | 1 | 2026-11-11 |
| 196.251.121.142 Seychelles · AS219443 | malware elf-binary | ELF | 4 | 2026-11-11 |
| 57.129.50.100 Germany · OVH SAS | exploit | DB, GPG | 2 | 2026-11-11 |
| 185.98.186.254 Germany · uvensys GmbH | exposed-secret | TXT | 1 | 2026-11-11 |
| 168.107.49.6 South Korea · Oracle Corporation | exposed-secret | TXT | 1 | 2026-11-11 |
| 43.198.103.139 China · Amazon.com, Inc. | ioc-match | COM | 2 | 2026-11-11 |
| 212.24.111.98 Lithuania · UAB "Interneto vizija" | files | ZIP | 1 | 2026-11-11 |
| 178.62.250.64 The Netherlands · DigitalOcean, LLC | exposed-secret exploit | TXT | 2 | 2026-11-11 |
| 23.31.113.33 United States · Comcast Cable Communications, LLC | files | BIN | 1 | 2026-11-11 |
| 45.198.224.144 Seychelles · VPSVAULT.HOST LTD | exposed-secret | TXT | 1 | 2026-11-11 |
| 144.91.73.156 France · Contabo GmbH | exposed-secret | TXT | 1 | 2026-11-11 |
| 185.77.97.229 United States · Hostinger International Limited | exposed-secret | SHOP | 1 | 2026-11-11 |
| 91.108.103.243 United Kingdom · Hostinger International Limited | exposed-secret | PHP, TECH | 2 | 2026-11-11 |
| 89.116.109.216 United Kingdom · Hostinger International Limited | exposed-secret | PHP, TECH | 2 | 2026-11-11 |
| 193.180.209.78 Denmark · Webdock.io ApS | malware exploit c2 mozi | SH, PE, ZIP, GO | 32 | 2026-11-11 |
| 89.116.109.242 United Kingdom · Hostinger International Limited | exposed-secret | CYOU, TECH | 2 | 2026-11-11 |
| 89.116.109.137 United Kingdom · Hostinger International Limited | exposed-secret | COM, SHOP | 2 | 2026-11-11 |
| 91.108.103.85 United Kingdom · Hostinger International Limited | exposed-secret | SHOP | 1 | 2026-11-11 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free