Live findsCVE IntelResearchConsoleStart free
huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

5,965
hosts
106,472
files
103
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 2996malware 1224exploit 1134mozi 921c2 314webshell 282ioc-match 88coinminer 66gafgyt 56tsunami 41mirai 38sliver 31meterpreter 16havoc 15

Hosts labelled exposed-secret

HostLabelsFile typesFilesLast seen
185.77.97.229
United States · Hostinger International Limited
exposed-secretSHOP12026-11-11
91.108.103.243
United Kingdom · Hostinger International Limited
exposed-secretPHP, TECH22026-11-11
89.116.109.216
United Kingdom · Hostinger International Limited
exposed-secretPHP, TECH22026-11-11
89.116.109.242
United Kingdom · Hostinger International Limited
exposed-secretCYOU, TECH22026-11-11
89.116.109.137
United Kingdom · Hostinger International Limited
exposed-secretCOM, SHOP22026-11-11
91.108.103.85
United Kingdom · Hostinger International Limited
exposed-secretSHOP12026-11-11
195.200.9.43
United Kingdom · Hostinger International Limited
exposed-secretPHP, TECH22026-11-11
144.91.73.87
France · Contabo GmbH
exposed-secretTXT, ENV, JSON102026-11-11
195.200.9.130
United Kingdom · Hostinger International Limited
exposed-secretCOM, SHOP22026-11-11
91.108.103.128
United Kingdom · Hostinger International Limited
exposed-secretPHP, TECH22026-11-11
185.77.97.118
United States · Hostinger International Limited
exposed-secretPHP12026-11-11
89.116.109.177
United Kingdom · Hostinger International Limited
exposed-secretSHOP12026-11-11
185.77.97.102
United States · Hostinger International Limited
exposed-secretSHOP12026-11-11
89.116.109.144
United Kingdom · Hostinger International Limited
exposed-secretCOM, PHP, TECH32026-11-11
185.77.97.174
United States · Hostinger International Limited
exposed-secretPHP, TECH22026-11-11
199.91.221.237
United States · BL Networks
c2 exposed-secret exploit malwareJS22026-11-11
89.58.25.93
Germany · netcup GmbH
malware exposed-secret pe-binaryPE, MANIFE, DEPLOY1142026-11-11
178.128.133.89
United States · DigitalOcean, LLC
exposed-secretENV, JSON22026-11-11
172.104.60.192
Singapore · Akamai Technologies, Inc.
exposed-secretENV, TXT22026-11-11
57.128.226.85
Poland · OVH SAS
exposed-secret exploitTXT, ENV, JSON122026-11-11
45.32.57.42
Japan · The Constant Company, LLC
exposed-secretTXT, ENV, JSON, PHP82026-11-11
167.99.212.57
The Netherlands · DigitalOcean, LLC
exposed-secretTXT, ENV42026-11-11
5.189.164.179
France · Contabo GmbH
exposed-secret tunnelJSON, YAML, LOCK, LOG82026-11-11
176.9.164.182
Germany · Hetzner Online GmbH
exposed-secretTXT12026-11-11
135.181.250.118
Finland · Hetzner Online GmbH
exposed-secretTXT12026-11-11
51.68.160.101
Ireland · OVH SAS
exposed-secretTXT12026-11-11
149.28.139.214
Singapore · The Constant Company, LLC
malware mozi exposed-secretTXT, ENV, JSON, PHP182026-11-11
124.156.203.61
India · Shenzhen Tencent Computer Systems Company Limited
exposed-secretTXT22026-11-11
51.83.108.104
France · OVH SAS
malware mozi exposed-secretTXT, ENV, JSON, PHP182026-11-11
15.204.57.219
United States · OVH SAS
exposed-secret exploitTXT22026-11-11
176.9.125.11
Germany · Hetzner Online GmbH
malware mozi exposed-secretTXT, ENV, JSON, PHP182026-11-11
165.227.115.29
United States · DigitalOcean, LLC
exposed-secret exploitTXT32026-11-11
159.69.15.66
Germany · Hetzner Online GmbH
exposed-secretENV12026-11-11
216.144.226.116
United States · HostPapa
exposed-secretJSON12026-11-11
185.34.144.137
United States · CNServer LLC
malware mozi exposed-secret elf-binaryELF, MACHO, BAT, JAR2692026-11-11
23.251.47.199
Germany · Zenlayer Inc
exposed-secretTXT22026-11-11
13.184.160.26
United States
exposed-secretTXT12026-11-11
67.217.49.246
United States · Interserver, Inc
exposed-secretTXT12026-11-11
13.184.160.241
United States
exposed-secretTXT12026-11-11
45.76.89.20
Germany · The Constant Company, LLC
exposed-secretTXT12026-11-11
199.36.158.100
United States · Fastly, Inc.
exposed-secretAPP, COM82026-11-11
62.141.40.187
Germany · WIIT AG
exposed-secretTXT12026-11-11
23.88.104.213
Germany · Hetzner Online GmbH
exposed-secret malware moziTXT22026-11-11
45.63.71.130
United States · The Constant Company, LLC
malware mozi exposed-secretTXT, ENV, JSON, PHP362026-11-11
45.77.179.49
Japan · The Constant Company, LLC
malware mozi exposed-secretTXT, ENV, JSON, PHP92026-11-11
46.224.139.234
Germany · Hetzner Online GmbH
malware mozi exposed-secretTXT42026-11-10
195.200.9.125
United Kingdom · Hostinger International Limited
exposed-secretPHP12026-11-10
91.108.103.43
United Kingdom · Hostinger International Limited
exposed-secretPHP, TECH22026-11-10
46.225.33.61
Germany · Hetzner Online GmbH
malware mozi exposed-secretTXT, ENV, JSON, PHP182026-11-10
209.38.61.60
United States · DigitalOcean, LLC
exposed-secretTXT12026-11-10
← NewerPage 3 of 60Older →
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free