huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,973
hosts
106,581
files
126
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Every host we harvested files from, newest first
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 38.76.199.210 United States · cognetcloud INC | exposed-secret malware mozi tunnel | JS, JSON, HTML, PL | 22 | 2026-10-31 |
| 38.255.47.37 United States · Hyonix | exploit exposed-secret | BAT, PY, TXT, ENV | 8 | 2026-10-31 |
| 45.77.40.17 Singapore · The Constant Company, LLC | exposed-secret | TXT, BIN, ENV, JSON | 10 | 2026-10-31 |
| 38.224.162.188 United States · GTHost | exposed-secret malware mozi webshell | JS, JSON, PO, PY | 31 | 2026-10-31 |
| 45.86.61.144 Cyprus | exposed-secret | LOG | 2 | 2026-10-31 |
| 154.89.148.84 HK · Cloudie Limited | malware exposed-secret c2 exploit | ELF, HTML, PY, SH | 78 | 2026-10-31 |
| 38.49.210.117 Canada · Rica Web Services | exposed-secret exploit webshell c2 | JSON, GO, SH, JS | 1,165 | 2026-10-31 |
| 45.138.12.32 The Netherlands | exposed-secret tunnel forced-loot | SH, BAK, TXT | 7 | 2026-10-30 |
| 38.55.131.39 United States · Uscloud Inc | exposed-secret | TXT | 1 | 2026-10-30 |
| 154.36.173.248 United States · NetLab Global | exposed-secret tunnel | JSON | 1 | 2026-10-30 |
| 222.255.174.162 Vietnam · VNPT Corp | exposed-secret | TXT | 1 | 2026-10-30 |
| 45.76.235.119 United States · The Constant Company, LLC | exposed-secret | HTML | 1 | 2026-10-30 |
| 18.136.195.216 Singapore · Amazon.com, Inc. | exposed-secret exploit | TXT | 2 | 2026-10-30 |
| 18.136.195.197 Singapore · Amazon.com, Inc. | exposed-secret | TXT | 1 | 2026-10-30 |
| 85.11.167.74 The Netherlands · TechTies Inc. | exposed-secret | TXT | 1 | 2026-10-30 |
| 85.11.167.179 The Netherlands · TechTies Inc. | exposed-secret | TXT | 1 | 2026-10-30 |
| 85.11.167.7 The Netherlands · TechTies Inc. | exposed-secret | TXT | 1 | 2026-10-30 |
| 85.11.167.133 The Netherlands · TechTies Inc. | exposed-secret | TXT | 1 | 2026-10-30 |
| 85.11.167.108 The Netherlands · TechTies Inc. | malware mozi exposed-secret | PY, LOG | 4 | 2026-10-30 |
| 85.11.167.6 The Netherlands · TechTies Inc. | malware mozi exposed-secret | TXT, ENV, JSON, PHP | 9 | 2026-10-30 |
| 91.108.103.143 United Kingdom · Hostinger International Limited | files | CYOU | 1 | 2026-10-30 |
| 185.77.97.159 United States · Hostinger International Limited | files | CYOU | 1 | 2026-10-30 |
| 154.9.26.131 US · Cogent Communications, LLC | exposed-secret | TXT, ENV, JSON, PHP | 6 | 2026-10-30 |
| 89.116.109.166 United Kingdom · Hostinger International Limited | files | CYOU | 1 | 2026-10-30 |
| 195.200.9.103 United Kingdom · Hostinger International Limited | files | CYOU | 1 | 2026-10-30 |
| 45.39.190.88 United States · Cloud Software - FZCO | exposed-secret | TXT, ENV, JSON, PHP | 6 | 2026-10-30 |
| 172.67.163.156 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 172.67.151.22 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 172.67.163.96 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 104.21.81.183 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 172.67.158.135 United States · Cloudflare, Inc. | exploit exposed-secret malware mozi | CYOU | 2 | 2026-10-30 |
| 104.21.14.88 United States · Cloudflare, Inc. | exploit exposed-secret malware mozi | CYOU | 2 | 2026-10-30 |
| 104.21.27.242 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 104.21.89.22 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 172.67.136.81 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 104.21.41.230 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 172.67.195.153 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 104.21.5.230 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 172.67.133.244 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 172.67.158.68 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 104.21.73.56 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 172.67.181.238 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 104.21.96.141 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 104.21.10.150 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 104.21.60.74 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 195.200.9.199 United Kingdom · Hostinger International Limited | files | CYOU | 1 | 2026-10-30 |
| 104.21.33.224 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 172.67.193.218 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 172.67.136.168 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
| 104.21.62.143 United States · Cloudflare, Inc. | exploit | CYOU | 1 | 2026-10-30 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free