huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,966
hosts
106,473
files
104
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled c2
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 23.19.231.52 United States · Leaseweb USA, Inc. | malware mozi exposed-secret exploit | PY, GZ, JS, SH | 577 | 2026-10-27 |
| 62.60.226.140 Germany · FEMO IT SOLUTIONS LIMITED | c2 exploit | EXE | 5 | 2026-10-27 |
| 103.179.44.239 India · WebHorizon Internet Services | malware mozi c2 exploit | PY, LOG | 7 | 2026-10-27 |
| 191.217.250.227 United States | malware c2 coinminer exploit | PHP, GZ, BIN, SH | 33 | 2026-10-27 |
| 91.92.43.211 Germany · DEDIK SERVICES LIMITED | exposed-secret exploit malware mozi | PY, HTML, SH, JS | 703 | 2026-10-27 |
| 51.81.244.207 United States · OVH SAS | exploit malware coinminer exposed-secret | LOG, PY, SH, ELF | 31 | 2026-10-27 |
| 209.99.190.118 Switzerland · SKN Subnet & Telecom Ltd | malware adaptix exposed-secret exploit | ELF, LOG, PY, TGZ | 98 | 2026-10-27 |
| 108.61.161.224 Japan · The Constant Company, LLC | exposed-secret exploit malware mozi | SH, HTML, LOG, PY | 197 | 2026-10-26 |
| 91.92.241.101 The Netherlands · Omegatech LTD | exposed-secret exploit malware mozi | META, BODY, PY, TXT | 332 | 2026-10-26 |
| 16.16.63.239 Sweden · Amazon.com, Inc. | malware c2 ioc-match mozi | PS1, PE, BIN, CPL | 12 | 2026-10-26 |
| 185.239.48.112 Russia · SmartApe OU | c2 exposed-secret | PRO | 1 | 2026-10-26 |
| 156.234.58.211 Seychelles · YANCY LIMITED | c2 | COM | 42 | 2026-10-26 |
| 188.116.36.156 Romania · Host Sailor Ltd | c2 | DIGITA, TOP | 2 | 2026-10-26 |
| 52.128.241.77 Hong Kong · Netsec Limited | malware mozi c2 exposed-secret | PY, PS1, PE, GO | 257 | 2026-10-26 |
| 45.115.26.30 Vietnam · Contrust Solutions S.R.L. | exposed-secret exploit malware mozi | LOG, PY, SH, TXT | 1,395 | 2026-10-26 |
| 82.156.186.185 China · Shenzhen Tencent Computer Systems Company Limited | malware cobalt-strike c2 mozi | PY, JAR, TXT, LOG | 88 | 2026-10-25 |
| 49.51.230.17 United States · Shenzhen Tencent Computer Systems Company Limited | malware exploit webshell exposed-secret | LOG, C, DLL, BIN | 56 | 2026-10-25 |
| 156.245.146.226 Seychelles · Zillion Network Inc. | exposed-secret malware mozi exploit | SH, HTML, PY, TXT | 561 | 2026-10-25 |
| 129.159.135.190 Israel · Oracle Corporation | malware exploit exposed-secret mozi | ELF, LOG, PY, C | 40 | 2026-10-25 |
| 209.38.235.232 Germany · DigitalOcean, LLC | exposed-secret malware mozi exploit | JSON, JS, LOG, MD | 118 | 2026-10-25 |
| 45.67.86.32 Japan · Host Universal Pty Ltd | exploit malware exposed-secret mozi | LOG, PY, MACHO, TXT | 83 | 2026-10-25 |
| 121.4.83.178 China · Shenzhen Tencent Computer Systems Company Limited | exposed-secret c2 webshell malware | MD, GITIGN | 19 | 2026-10-25 |
| 95.179.212.2 France · The Constant Company, LLC | c2 malware pe-binary | PY, PS1, TXT, EXE | 13 | 2026-10-25 |
| 119.45.236.76 China · Shenzhen Tencent Computer Systems Company Limited | malware exploit c2 meterpreter | LOG, PE, BIN, ELF | 26 | 2026-10-24 |
| 198.46.158.18 United States · HostPapa | exposed-secret exploit malware mozi | PY, YAML, HTML, TXT | 362 | 2026-10-24 |
| 193.233.220.65 Russia · Aeza Group LLC | malware exploit c2 exposed-secret | PS1, PE, BAT, ZIP | 186 | 2026-10-24 |
| 2.26.229.254 Germany · PLAY2GO INTERNATIONAL LIMITED | malware adaptix coinminer c2 | PS1, PE, CMD, BAT | 43 | 2026-10-24 |
| 58.221.60.160 China · Chinanet | malware exploit mozi c2 | MACHO, JAVA, PY, SH | 35 | 2026-10-24 |
| 103.241.181.29 India · CtrlS | c2 | ASP, HTM | 6 | 2026-10-24 |
| 39.109.100.126 Hong Kong | exposed-secret malware mozi exploit | PY, TXT, LOG, SH | 440 | 2026-10-24 |
| 103.214.172.114 Hong Kong · Cloudie Limited | exposed-secret malware mozi exploit | PY, TXT, LOG, SH | 440 | 2026-10-24 |
| 54.69.111.24 United States · Amazon.com, Inc. | exploit exposed-secret webshell c2 | BIN, JSON, ZIP, PY | 114 | 2026-10-24 |
| 204.168.225.59 Finland · Hetzner Online GmbH | exposed-secret malware mozi exploit | PEM, TXT, PY, SH | 487 | 2026-10-24 |
| 104.160.169.204 United States · Sharktech | exposed-secret exploit malware tsunami | SH, LOG, TXT, PY | 170 | 2026-10-24 |
| 50.210.239.219 United States · Comcast Cable Communications, LLC | exposed-secret exploit c2 webshell | PHP, PY, HTML, LOG | 45 | 2026-10-24 |
| 172.67.205.146 United States · Cloudflare, Inc. | c2 exposed-secret | LINK | 1 | 2026-10-24 |
| 104.21.85.114 United States · Cloudflare, Inc. | c2 exposed-secret | LINK | 1 | 2026-10-24 |
| 104.21.83.147 United States · Cloudflare, Inc. | c2 exposed-secret tunnel | WIN | 1 | 2026-10-24 |
| 172.67.177.115 United States · Cloudflare, Inc. | c2 exposed-secret tunnel | WIN | 1 | 2026-10-24 |
| 151.242.30.142 South Africa · Internet Magnate (Pty) Ltd | exploit malware mozi exposed-secret | JS, ZIP, C, PY | 454 | 2026-10-23 |
| 195.208.21.65 Russia · Autonomous Nonprofit Organisation "Russian Scientific-Research Institute for Pu | c2 exposed-secret | JSON | 1 | 2026-10-23 |
| 82.180.145.166 India · Contabo Asia Private Limited | webshell exposed-secret exploit malware | PHP, TXT, PY, JSP | 50 | 2026-10-23 |
| 159.203.115.164 United States · DigitalOcean, LLC | exposed-secret c2 webshell malware | PY, SH, JS, TS | 459 | 2026-10-22 |
| 54.169.109.7 Singapore · Amazon.com, Inc. | exposed-secret exploit malware mozi | LOG, PY, OVPN, TXT | 55 | 2026-10-22 |
| 31.56.209.86 The Netherlands · SWISSNET LLC | c2 malware elf-binary tunnel | ELF, SH | 2 | 2026-10-21 |
| 212.244.203.102 Poland · Orange Polska Spolka Akcyjna | webshell exposed-secret malware c2 | C, SQL, IN, PL | 300 | 2026-10-21 |
| 81.181.166.24 Romania · DataNode DC SRL | exposed-secret exploit malware mozi | BIN, LOG, TXT, JSON | 28 | 2026-10-21 |
| 95.43.220.235 Bulgaria · Vivacom Bulgaria EAD | malware c2 webshell elf-binary | GZ, C, BIN, ELF | 44 | 2026-10-21 |
| 159.69.66.161 Germany · Hetzner Online GmbH | exposed-secret malware mozi exploit | PY, LOG, TXT, JSON | 705 | 2026-10-21 |
| 87.251.64.224 Poland · ISAEV Igor | c2 exposed-secret malware exploit | C, LOG, CSV, EXE | 8 | 2026-10-21 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free