huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,965
hosts
106,472
files
103
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled malware
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 124.198.131.63 United States · 1337 Services GmbH | exposed-secret malware exploit mozi | PY, SH, PE, RAR | 217 | 2026-11-08 |
| 136.244.109.179 The Netherlands · The Constant Company, LLC | malware exposed-secret elf-binary | ELF, LOG | 12 | 2026-11-08 |
| 179.43.171.203 Panama · Private Layer INC | exposed-secret exploit malware mozi | LOG, PY, JSON, TXT | 76 | 2026-11-08 |
| 179.43.171.202 Panama · Private Layer INC | exposed-secret exploit malware mozi | LOG, PY, JSON, TXT | 76 | 2026-11-08 |
| 223.151.76.117 China · Chinanet | malware mozi elf-binary | A | 1 | 2026-11-08 |
| 130.94.44.130 Singapore · NTT America, Inc. | exposed-secret exploit webshell malware | TXT, PS1, PY, TOML | 98 | 2026-11-07 |
| 150.171.109.213 United States · Microsoft Corporation | exploit c2 malware sliver | HTML, TXT | 2 | 2026-11-07 |
| 212.11.60.95 Taiwan · OCTOPUS WEB SOLUTION INC | exposed-secret malware mozi | COM, CYOU | 3 | 2026-11-07 |
| 31.57.38.70 Canada · 12651980 CANADA INC. | exposed-secret malware pe-binary | PE | 2 | 2026-11-07 |
| 163.52.135.106 unknown network | malware mozi exploit exposed-secret | ELF, JS, TXT, JSON | 33 | 2026-11-07 |
| 191.44.112.76 Germany · NODE HOST LIMITED | malware elf-binary | ELF | 24 | 2026-11-07 |
| 38.60.91.186 United States · FASTNET DATA INC | exposed-secret malware mozi exploit | SH, PY, LOG, TXT | 1,039 | 2026-11-07 |
| 192.236.152.232 United States · HostPapa | exploit exposed-secret malware mozi | PY, TXT, SH, LOG | 241 | 2026-11-07 |
| 3.84.186.180 United States · Amazon.com, Inc. | exposed-secret malware mozi exploit | PY, HTML, JS, TXT | 829 | 2026-11-07 |
| 3.128.117.168 United States · Amazon.com, Inc. | exposed-secret exploit malware mozi | PHP, JS, BIN, DB | 256 | 2026-11-07 |
| 64.23.240.211 United States · DigitalOcean, LLC | malware exploit coinminer exposed-secret | PY, LOG, TXT, SH | 386 | 2026-11-07 |
| 8.212.181.6 Philippines · Alibaba (US) Technology Co., Ltd. | exposed-secret malware cobalt-strike c2 | GO, BIN, TXT, PE | 77 | 2026-11-07 |
| 13.215.184.109 Singapore · Amazon.com, Inc. | exposed-secret malware exploit mozi | JSON, TXT, SH, PY | 136 | 2026-11-07 |
| 16.59.36.98 United States · Amazon.com, Inc. | c2 exposed-secret exploit malware | LOG, SH, PY, JSON | 72 | 2026-11-07 |
| 18.139.222.103 Singapore · Amazon.com, Inc. | malware exploit macho-binary tunnel | LOG, MACHO, JAVA, PY | 14 | 2026-11-07 |
| 3.26.94.147 Australia · Amazon.com, Inc. | c2 exploit malware exposed-secret | PY, TOC, PE, MD | 67 | 2026-11-07 |
| 3.144.74.60 United States · Amazon.com, Inc. | exposed-secret malware tunnel elf-binary | LOG, JSON, SH, HTML | 65 | 2026-11-07 |
| 13.63.179.207 Sweden · Amazon.com, Inc. | exposed-secret malware mozi c2 | TXT, APK, GITIGN, KEYSTO | 39 | 2026-11-07 |
| 27.206.88.201 China · CHINA UNICOM China169 Backbone | malware mozi elf-binary | 1 | 2026-11-07 | |
| 216.24.57.18 United States · Render | malware pe-binary | PE, TXT | 2 | 2026-11-07 |
| 216.24.57.16 United States · Render | malware pe-binary | PE, TXT | 2 | 2026-11-07 |
| 154.29.75.185 United States · Tier.Net Technologies LLC | malware coinminer pe-binary tunnel | PE, PS1, SH, ELF | 13 | 2026-11-07 |
| 89.36.231.178 France · ROCKHOSTER PRIVATE LIMITED | malware coinminer exploit c2 | XML, SH, BAT, JAR | 281 | 2026-11-07 |
| 152.175.230.66 Hong Kong · SKR-DE SAKURA INTERNATIONAL INVESTMENT LIMITED | exposed-secret malware mozi exploit | JSON, JS, HTML, TXT | 35 | 2026-11-07 |
| 189.105.68.190 Hong Kong | exploit exposed-secret malware mozi | PY, LOG, JSONL, TXT | 13 | 2026-11-07 |
| 47.99.157.12 China · Hangzhou Alibaba Advertising Co.,Ltd. | exploit exposed-secret malware webshell | PY, SH, PHP, C | 14 | 2026-11-06 |
| 104.16.231.132 United States · Cloudflare, Inc. | c2 malware mozi | COM, JS | 4 | 2026-11-06 |
| 104.16.230.132 United States · Cloudflare, Inc. | c2 malware mozi | COM, JS | 4 | 2026-11-06 |
| 44.212.213.251 United States · Amazon.com, Inc. | malware pe-binary | PE, ZIP | 2 | 2026-11-06 |
| 222.127.77.227 Philippines · Globe Telecom Inc. | malware mozi elf-binary | A | 1 | 2026-11-06 |
| 110.42.215.163 China · Shenzhen Tencent Computer Systems Company Limited | exploit exposed-secret malware mozi | GO, LOG, PY, PS1 | 317 | 2026-11-06 |
| 125.44.58.32 China · CHINA UNICOM China169 Backbone | malware mozi elf-binary | 1 | 2026-11-06 | |
| 46.216.199.241 Belarus · Mobile TeleSystems JLLC | malware mozi elf-binary | ELF | 1 | 2026-11-06 |
| 120.28.222.207 Philippines · Globe Telecom Inc. | malware mozi elf-binary | A | 1 | 2026-11-05 |
| 185.28.119.18 United Kingdom · BlueVPS OU | exploit exposed-secret webshell malware | MD, PY, SH, LOG | 160 | 2026-11-05 |
| 178.83.45.33 Germany · OVH SAS | coinminer exposed-secret malware tunnel | LOG, SH | 2 | 2026-11-05 |
| 35.190.27.135 United States · Google LLC | malware mozi | ONLINE | 2 | 2026-11-05 |
| 212.11.60.204 Taiwan · OCTOPUS WEB SOLUTION INC | exposed-secret malware mozi | COM | 2 | 2026-11-05 |
| 89.108.69.199 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
| 89.108.69.158 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
| 89.108.69.108 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
| 37.140.192.28 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
| 89.108.69.148 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
| 185.217.198.154 Russia · FIRST SERVER LIMITED | malware mozi | M3U | 1 | 2026-11-05 |
| 43.135.35.8 Hong Kong · Shenzhen Tencent Computer Systems Company Limited | malware mozi exposed-secret exploit | SH, PY, LOG, JS | 582 | 2026-11-05 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free