huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,965
hosts
106,472
files
103
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled webshell
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 18.136.195.202 Singapore · Amazon.com, Inc. | exploit exposed-secret malware mozi | PY, LOG, TXT, SH | 213 | 2026-11-02 |
| 31.56.228.136 France · CGI GLOBAL LIMITED | exploit exposed-secret webshell c2 | PY, GDB, MD, PHP | 386 | 2026-11-02 |
| 101.36.112.205 Hong Kong · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED | exposed-secret exploit malware webshell | PY, PHP, JS, SH | 161 | 2026-11-02 |
| 43.133.242.81 South Korea · Shenzhen Tencent Computer Systems Company Limited | exposed-secret exploit malware mozi | SH, PY, LOG, TXT | 441 | 2026-11-02 |
| 38.76.208.29 United States · cognetcloud INC | exploit malware exposed-secret c2 | LOG, PY, JAVA, MACHO | 78 | 2026-11-02 |
| 31.184.195.114 Russia · Petersburg Internet Network ltd. | webshell | PHP | 1 | 2026-11-02 |
| 66.42.33.224 Japan · The Constant Company, LLC | malware exposed-secret mozi sliver | JSON, PS1, PY, LOG | 21 | 2026-11-02 |
| 216.167.81.141 United States · NTT America, Inc. | exposed-secret webshell | TXT | 3 | 2026-11-02 |
| 45.156.87.230 The Netherlands · TechTies Inc. | exploit webshell exposed-secret malware | HTML, PHP, PY, TXT | 4 | 2026-11-02 |
| 104.233.217.108 United States · PEG TECH INC | exposed-secret exploit malware mozi | PY, TXT, JS, JSON | 699 | 2026-11-02 |
| 103.117.136.137 Hong Kong · cognetcloud INC | exposed-secret exploit malware mozi | PY, TGZ, SH, JS | 637 | 2026-11-01 |
| 49.51.187.59 United States · Shenzhen Tencent Computer Systems Company Limited | malware exploit exposed-secret mozi | ELF, LOG, B64, DTD | 160 | 2026-11-01 |
| 178.95.25.224 Ukraine · The Constant Company, LLC | exposed-secret malware mozi webshell | SH, JS, TXT, LOG | 697 | 2026-11-01 |
| 15.204.59.70 United States · OVH SAS | c2 exposed-secret webshell | LOG, PHP, SH, TXT | 4 | 2026-11-01 |
| 185.125.24.7 Switzerland · Infomaniak Network SA | exploit exposed-secret malware mozi | XZ, BUILDI, BUILD, CHANGE | 146 | 2026-11-01 |
| 104.200.73.97 United States · GWY IT PTY LTD | exposed-secret exploit malware webshell | PY, ELF, C, TXT | 134 | 2026-11-01 |
| 39.109.57.67 Hong Kong · XHKL-AS-AP - XUN HONG KONG LIMITED | exposed-secret malware exploit mozi | PY, LOG, ELF, SH | 26 | 2026-10-31 |
| 45.39.190.176 United States · Cloud Software - FZCO | exposed-secret exploit malware webshell | HTML, PHP, ELF, BIN | 212 | 2026-10-31 |
| 96.126.130.81 United States · Evoxt Sdn. Bhd. | malware mozi exploit webshell | EML, SH, PY, LOG | 1,568 | 2026-10-31 |
| 45.155.19.244 Turkey · Samet Girginer | malware mozi exploit exposed-secret | JS, TS, MJS, JSON | 56 | 2026-10-31 |
| 38.97.253.252 United States · Cogent Communications | exposed-secret malware mozi webshell | JS, JSON, PO, PY | 31 | 2026-10-31 |
| 38.224.162.188 United States · GTHost | exposed-secret malware mozi webshell | JS, JSON, PO, PY | 31 | 2026-10-31 |
| 38.49.210.117 Canada · Rica Web Services | exposed-secret exploit webshell c2 | JSON, GO, SH, JS | 1,165 | 2026-10-31 |
| 31.128.39.24 Russia · Beget LLC | malware mozi exploit exposed-secret | JS, PY, SH, TXT | 455 | 2026-10-30 |
| 165.154.225.131 Singapore · Scloud Pte Ltd | exposed-secret exploit malware mozi | TXT, BIN, PY, HEADER | 842 | 2026-10-30 |
| 85.132.34.10 Azerbaijan · CASPEL LLC | webshell exposed-secret | PY, ZIP, SQL, RAR | 24 | 2026-10-30 |
| 39.107.106.210 China · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret exploit malware mozi | PHP, LOG, SH, TXT | 421 | 2026-10-30 |
| 45.117.83.34 Vietnam · NhanHoa Software company | exposed-secret malware exploit webshell | LOG, PE, PY, JSON | 48 | 2026-10-30 |
| 13.140.168.109 France · Contabo GmbH | exposed-secret webshell | ZIP, PHP | 14 | 2026-10-30 |
| 46.166.162.142 Lithuania · UAB Cherry Servers | exploit malware exposed-secret webshell | LOG, SEEDS, JS, TXT | 1,393 | 2026-10-29 |
| 153.75.81.83 United Arab Emirates · RouterHosting LLC | exploit exposed-secret malware c2 | PY, TXT, LOG, ELF | 91 | 2026-10-29 |
| 209.99.184.246 Switzerland · SKN Subnet & Telecom Ltd | exploit exposed-secret c2 webshell | TXT, MD, PY, JSON | 866 | 2026-10-29 |
| 141.147.70.247 United Kingdom · Oracle Corporation | exposed-secret exploit malware mozi | JSON, TS, JS, MD | 162 | 2026-10-29 |
| 91.224.92.16 United Kingdom · UAB Host Baltic | exposed-secret malware c2 exploit | SH, TXT, ELF, JAVA | 62 | 2026-10-28 |
| 5.78.205.230 United States · Hetzner Online GmbH | exposed-secret exploit malware webshell | PY, SAMPLE, TXT, LOG | 66 | 2026-10-28 |
| 50.210.239.213 United States · Comcast Cable Communications, LLC | exposed-secret exploit c2 webshell | PHP, PY, HTML, PHTML | 43 | 2026-10-28 |
| 187.188.165.243 Mexico · TOTAL PLAY TELECOMUNICACIONES SA DE CV | malware mozi webshell exposed-secret | PHP, JS, LIB, SWF | 363 | 2026-10-28 |
| 192.236.208.97 United States · HostPapa | exposed-secret webshell | JSON | 1 | 2026-10-28 |
| 167.17.69.200 Canada · GTHost | exploit webshell exposed-secret malware | PY, PHP, ELF, SH | 27 | 2026-10-28 |
| 23.19.231.52 United States · Leaseweb USA, Inc. | malware mozi exposed-secret exploit | PY, GZ, JS, SH | 577 | 2026-10-27 |
| 191.217.250.227 United States | malware c2 coinminer exploit | PHP, GZ, BIN, SH | 33 | 2026-10-27 |
| 13.239.40.119 Australia · Amazon.com, Inc. | exploit malware mozi exposed-secret | JS, MD, JSON, EDITOR | 34 | 2026-10-27 |
| 164.90.209.4 Germany · DigitalOcean, LLC | exposed-secret webshell malware mozi | CFC, JS, CFM, JAR | 31 | 2026-10-27 |
| 178.62.64.147 United Kingdom · DigitalOcean, LLC | exposed-secret webshell malware mozi | CFC, JS, CFM, JAR | 31 | 2026-10-27 |
| 64.227.143.203 India · DigitalOcean, LLC | exposed-secret webshell malware mozi | CFC, JS, CFM, JAR | 31 | 2026-10-27 |
| 65.20.96.115 Spain · The Constant Company, LLC | exploit malware exposed-secret webshell | LOG, PY, ELF, C | 175 | 2026-10-27 |
| 91.92.43.211 Germany · DEDIK SERVICES LIMITED | exposed-secret exploit malware mozi | PY, HTML, SH, JS | 703 | 2026-10-27 |
| 45.77.131.98 Japan · The Constant Company, LLC | malware mozi webshell exposed-secret | JSON, LOG, SH, PY | 311 | 2026-10-27 |
| 108.61.161.224 Japan · The Constant Company, LLC | exposed-secret exploit malware mozi | SH, HTML, LOG, PY | 197 | 2026-10-26 |
| 91.92.241.101 The Netherlands · Omegatech LTD | exposed-secret exploit malware mozi | META, BODY, PY, TXT | 332 | 2026-10-26 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free