Live findsCVE IntelResearchConsoleStart free
huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

5,971
hosts
106,553
files
124
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 3001malware 1226exploit 1136mozi 923c2 314webshell 282ioc-match 87coinminer 67gafgyt 56tsunami 41mirai 38sliver 31meterpreter 16havoc 15

Every host we harvested files from, newest first

HostLabelsFile typesFilesLast seen
101.69.207.118
China · CHINA UNICOM China169 Backbone
filesBIN, JSON22026-11-02
43.133.242.81
South Korea · Shenzhen Tencent Computer Systems Company Limited
exposed-secret exploit malware moziSH, PY, LOG, TXT4412026-11-02
101.47.156.26
Singapore · Byteplus Pte. Ltd.
exposed-secretTXT12026-11-02
103.106.191.40
Hong Kong · cognetcloud INC
malware elf-binaryELF12026-11-02
212.103.62.205
United States · CNSERVERS LLC
exposed-secret malware exploit moziSH, PY, ELF, JSON3872026-11-02
8.217.64.30
Hong Kong · Alibaba (US) Technology Co., Ltd.
filesJSON12026-11-02
173.255.203.189
United States · Akamai Technologies, Inc.
exposed-secretTXT12026-11-02
156.0.255.70
Nigeria · Nigeria Inter-Bank Settlement System Plc
exposed-secretTXT12026-11-02
197.255.244.24
Nigeria · Etranzact Int'l Plc
filesJSON12026-11-02
38.76.208.29
United States · cognetcloud INC
exploit malware exposed-secret c2LOG, PY, JAVA, MACHO782026-11-02
31.184.195.114
Russia · Petersburg Internet Network ltd.
webshellPHP12026-11-02
39.106.13.235
China · Hangzhou Alibaba Advertising Co.,Ltd.
exploit malware mozi exposed-secretPY, LOG, OUT, JAR212026-11-02
15.204.59.195
United States · OVH SAS
exposed-secretTXT12026-11-02
66.42.33.224
Japan · The Constant Company, LLC
malware exposed-secret mozi sliverJSON, PS1, PY, LOG212026-11-02
74.161.43.26
Switzerland · Microsoft Corporation
exposed-secret malware exploit moziC, PS1, ELF, PY182026-11-02
216.167.81.141
United States · NTT America, Inc.
exposed-secret webshellTXT32026-11-02
38.60.212.186
JP · Cogent Communications, LLC
exposed-secret malware mozi tunnelPS1, SH, PY, PYC472026-11-02
156.239.47.147
United States · AROSSCLOUD INC.
exploit malware mozi c2LOG, JSON, PY, JS332026-11-02
106.53.211.43
China · Shenzhen Tencent Computer Systems Company Limited
tunnelTXT22026-11-02
2.27.61.186
The Netherlands · ETERNITY INTERNATIONAL LIMITED
exposed-secretTXT12026-11-02
103.75.199.75
Germany · BitCommand LLC
exploit exposed-secret c2TXT, PY, ENV, JS112026-11-02
45.156.87.230
The Netherlands · TechTies Inc.
exploit webshell exposed-secret malwareHTML, PHP, PY, TXT42026-11-02
104.233.217.108
United States · PEG TECH INC
exposed-secret exploit malware moziPY, TXT, JS, JSON6992026-11-02
172.67.190.43
United States · Cloudflare, Inc.
filesPICS12026-11-02
104.21.10.132
United States · Cloudflare, Inc.
filesPICS12026-11-02
194.233.72.249
Singapore · Contabo Asia Private Limited
exposed-secretTXT12026-11-02
82.27.116.42
Hong Kong · DEBEE NETWORK LIMITED
filesJSON12026-11-02
194.233.72.242
Singapore · Contabo Asia Private Limited
exposed-secretTXT12026-11-02
194.233.72.124
Singapore · Contabo Asia Private Limited
exposed-secretTXT, ENV, JSON, PHP72026-11-02
194.233.72.126
Singapore · Contabo Asia Private Limited
exposed-secret exploitTXT22026-11-02
194.233.72.121
Singapore · Contabo Asia Private Limited
exposed-secret exploitTXT22026-11-01
208.98.38.114
United States · Sharktech
exploit exposed-secret tunnelTXT12026-11-01
58.144.196.192
China · CHINA UNICOM China169 Backbone
exposed-secretTXT, ENV, JSON, PHP112026-11-01
103.117.136.137
Hong Kong · cognetcloud INC
exposed-secret exploit malware moziPY, TGZ, SH, JS6372026-11-01
194.233.72.59
Singapore · Contabo Asia Private Limited
exposed-secret forced-lootTXT12026-11-01
138.16.187.93
Russia · Hosting technology LTD
exposed-secret exploitTXT, ENV, JSON122026-11-01
154.219.127.31
Hong Kong · FASTNET DATA INC
filesBIN12026-11-01
84.199.144.234
Belgium · Telenet BV
filesBIN12026-11-01
176.123.7.7
Moldova · ALEXHOST SRL
malware c2 exposed-secret elf-binaryELF, TXT192026-11-01
118.99.85.200
Indonesia · BIZNET NETWORKS
exposed-secret exploitTXT22026-11-01
49.51.187.59
United States · Shenzhen Tencent Computer Systems Company Limited
malware exploit exposed-secret moziELF, LOG, B64, DTD1602026-11-01
80.87.206.91
The Netherlands · OVH SAS
exposed-secretTXT12026-11-01
80.87.206.95
The Netherlands · OVH SAS
exposed-secretTXT12026-11-01
85.137.54.178
The Netherlands · SOLLUTIUM EU Sp z.o.o.
malware elf-binaryELF, LOG62026-11-01
37.187.152.46
France · OVH SAS
exposed-secret malware elf-binary tunnelELF, LOG22026-11-01
43.155.217.92
South Korea · Shenzhen Tencent Computer Systems Company Limited
exposed-secretTXT, YAML22026-11-01
95.111.226.157
France · Contabo GmbH
exposed-secret exploit malware macho-binarySH, JAVA, MACHO, TXT492026-11-01
206.82.2.6
United States · N963
exposed-secretTXT12026-11-01
129.226.71.134
Hong Kong · Shenzhen Tencent Computer Systems Company Limited
filesLOG, ZIP22026-11-01
148.113.3.32
Canada · OVH SAS
exploit malware macho-binaryLOG, TXT, JAVA, MACHO102026-11-01
← NewerPage 35 of 120Older →
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free