huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,965
hosts
106,472
files
103
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled c2
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 152.42.193.28 Singapore · DigitalOcean, LLC | exposed-secret malware mozi exploit | SH, PY, TGZ, LOG | 747 | 2026-11-03 |
| 188.166.206.102 Singapore · DigitalOcean, LLC | exposed-secret malware mozi exploit | SH, PY, TGZ, LOG | 747 | 2026-11-03 |
| 101.126.4.50 China · Beijing Volcano Engine Technology Co., Ltd. | exploit webshell exposed-secret malware | LOG, SH, PY, JSON | 175 | 2026-11-03 |
| 168.144.85.125 India · DigitalOcean, LLC | exposed-secret exploit malware mozi | SH, TXT, PY, DEB | 500 | 2026-11-03 |
| 178.128.89.39 Singapore · DigitalOcean, LLC | exploit exposed-secret c2 tunnel | HTML, LOG, ZIP, JS | 34 | 2026-11-03 |
| 185.28.119.106 United Kingdom · BlueVPS OU | exposed-secret exploit c2 malware | LOG, JSON, MD, GITIGN | 398 | 2026-11-03 |
| 172.105.156.153 United States · Akamai Technologies, Inc. | exposed-secret exploit malware mozi | TXT, JSON, SH, MD | 163 | 2026-11-03 |
| 194.233.67.247 Singapore · Contabo Asia Private Limited | exploit exposed-secret malware mozi | TXT, PHP, HTML, PY | 354 | 2026-11-02 |
| 173.212.244.40 France · Contabo GmbH | exposed-secret exploit webshell c2 | PY, HTML, MD, PHP | 523 | 2026-11-02 |
| 203.194.115.12 Indonesia · Rumahweb | exposed-secret exploit malware webshell | PY, LOG, PHP, JAR | 360 | 2026-11-02 |
| 83.172.138.182 Germany · M247 Europe SRL | exposed-secret malware mozi exploit | PY, TXT, APK, HTML | 301 | 2026-11-02 |
| 92.246.129.98 Brazil · ITGLOBAL.COM NL B.V. | exposed-secret exploit malware mozi | JS, JSON, PY, SH | 347 | 2026-11-02 |
| 78.111.90.130 Canada · ITGLOBAL.COM NL B.V. | exposed-secret exploit malware mozi | TXT, SH, JSON, LOG | 243 | 2026-11-02 |
| 64.118.151.226 Hong Kong · Eons Data Communications Limited | exploit exposed-secret malware mozi | SH, LOG, MD, JSON | 147 | 2026-11-02 |
| 181.41.194.136 The Netherlands · OVH SAS | malware mozi c2 exposed-secret | HTA, CMD, BAT, JS | 23 | 2026-11-02 |
| 18.136.195.202 Singapore · Amazon.com, Inc. | exploit exposed-secret malware mozi | PY, LOG, TXT, SH | 213 | 2026-11-02 |
| 31.56.228.136 France · CGI GLOBAL LIMITED | exploit exposed-secret webshell c2 | PY, GDB, MD, PHP | 386 | 2026-11-02 |
| 43.133.242.81 South Korea · Shenzhen Tencent Computer Systems Company Limited | exposed-secret exploit malware mozi | SH, PY, LOG, TXT | 441 | 2026-11-02 |
| 38.76.208.29 United States · cognetcloud INC | exploit malware exposed-secret c2 | LOG, PY, JAVA, MACHO | 78 | 2026-11-02 |
| 66.42.33.224 Japan · The Constant Company, LLC | malware exposed-secret mozi sliver | JSON, PS1, PY, LOG | 21 | 2026-11-02 |
| 156.239.47.147 United States · AROSSCLOUD INC. | exploit malware mozi c2 | LOG, JSON, PY, JS | 33 | 2026-11-02 |
| 103.75.199.75 Germany · BitCommand LLC | exploit exposed-secret c2 | TXT, PY, ENV, JS | 11 | 2026-11-02 |
| 104.233.217.108 United States · PEG TECH INC | exposed-secret exploit malware mozi | PY, TXT, JS, JSON | 699 | 2026-11-02 |
| 103.117.136.137 Hong Kong · cognetcloud INC | exposed-secret exploit malware mozi | PY, TGZ, SH, JS | 637 | 2026-11-01 |
| 176.123.7.7 Moldova · ALEXHOST SRL | malware c2 exposed-secret elf-binary | ELF, TXT | 19 | 2026-11-01 |
| 49.51.187.59 United States · Shenzhen Tencent Computer Systems Company Limited | malware exploit exposed-secret mozi | ELF, LOG, B64, DTD | 160 | 2026-11-01 |
| 178.95.25.224 Ukraine · The Constant Company, LLC | exposed-secret malware mozi webshell | SH, JS, TXT, LOG | 697 | 2026-11-01 |
| 15.204.59.70 United States · OVH SAS | c2 exposed-secret webshell | LOG, PHP, SH, TXT | 4 | 2026-11-01 |
| 66.78.40.197 United States · Aokigahara SRL | c2 exposed-secret | 1 | 2026-11-01 | |
| 104.200.73.97 United States · GWY IT PTY LTD | exposed-secret exploit malware webshell | PY, ELF, C, TXT | 134 | 2026-11-01 |
| 94.26.41.70 Bulgaria · "Euro Crypt" EOOD | c2 | TXT | 1 | 2026-10-31 |
| 96.126.130.81 United States · Evoxt Sdn. Bhd. | malware mozi exploit webshell | EML, SH, PY, LOG | 1,568 | 2026-10-31 |
| 45.205.24.183 Seychelles · FASTNET DATA INC | exploit c2 exposed-secret | HTML, ZIP, TXT, ENV | 26 | 2026-10-31 |
| 45.155.19.244 Turkey · Samet Girginer | malware mozi exploit exposed-secret | JS, TS, MJS, JSON | 56 | 2026-10-31 |
| 154.89.148.84 HK · Cloudie Limited | malware exposed-secret c2 exploit | ELF, HTML, PY, SH | 78 | 2026-10-31 |
| 38.49.210.117 Canada · Rica Web Services | exposed-secret exploit webshell c2 | JSON, GO, SH, JS | 1,165 | 2026-10-31 |
| 31.128.39.24 Russia · Beget LLC | malware mozi exploit exposed-secret | JS, PY, SH, TXT | 455 | 2026-10-30 |
| 104.238.140.55 United States · The Constant Company, LLC | malware exposed-secret c2 exploit | PE, PS1 | 9 | 2026-10-30 |
| 39.107.106.210 China · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret exploit malware mozi | PHP, LOG, SH, TXT | 421 | 2026-10-30 |
| 46.166.162.142 Lithuania · UAB Cherry Servers | exploit malware exposed-secret webshell | LOG, SEEDS, JS, TXT | 1,393 | 2026-10-29 |
| 153.75.81.83 United Arab Emirates · RouterHosting LLC | exploit exposed-secret malware c2 | PY, TXT, LOG, ELF | 91 | 2026-10-29 |
| 38.134.189.93 Singapore · Ultahost, Inc. | malware c2 exposed-secret meterpreter | ELF, MD, TXT | 3 | 2026-10-29 |
| 209.99.184.246 Switzerland · SKN Subnet & Telecom Ltd | exploit exposed-secret c2 webshell | TXT, MD, PY, JSON | 866 | 2026-10-29 |
| 8.138.137.232 Singapore · Hangzhou Alibaba Advertising Co.,Ltd. | c2 | BIN | 1 | 2026-10-29 |
| 217.154.101.100 Spain · IONOS SE | exploit c2 exposed-secret malware | HTML, JS, TXT | 5 | 2026-10-29 |
| 91.224.92.16 United Kingdom · UAB Host Baltic | exposed-secret malware c2 exploit | SH, TXT, ELF, JAVA | 62 | 2026-10-28 |
| 50.210.239.213 United States · Comcast Cable Communications, LLC | exposed-secret exploit c2 webshell | PHP, PY, HTML, PHTML | 43 | 2026-10-28 |
| 217.160.244.175 Germany · IONOS SE | exploit c2 exposed-secret | HTML, TXT | 13 | 2026-10-28 |
| 209.209.8.8 Canada · Rica Web Services | c2 exploit exposed-secret | M3U | 1 | 2026-10-28 |
| 167.17.69.200 Canada · GTHost | exploit webshell exposed-secret malware | PY, PHP, ELF, SH | 27 | 2026-10-28 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free