Live findsCVE IntelResearchConsoleStart free
huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

5,966
hosts
106,473
files
104
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 2996malware 1225exploit 1134mozi 922c2 314webshell 282ioc-match 88coinminer 66gafgyt 56tsunami 41mirai 38sliver 31meterpreter 16havoc 15

Hosts labelled exploit

HostLabelsFile typesFilesLast seen
151.101.194.217
United States · Fastly, Inc.
exploitTXT12026-11-07
151.101.130.217
United States · Fastly, Inc.
exploitTXT12026-11-07
151.101.2.217
United States · Fastly, Inc.
exploitTXT12026-11-07
40.74.12.40
The Netherlands · Microsoft Corporation
exploitTXT12026-11-07
172.67.176.86
United States · Cloudflare, Inc.
exploitTXT22026-11-07
104.21.80.83
United States · Cloudflare, Inc.
exploitTXT22026-11-07
158.94.185.4
United Kingdom · Internetty Ltd
exposed-secret exploitTXT22026-11-07
158.94.172.117
United States · CNServer LLC
exposed-secret exploitPO, LOG, PY, JS492026-11-07
158.94.172.119
United States · CNServer LLC
exposed-secret exploitPO, LOG, PY, JS492026-11-07
158.94.172.118
United States · CNServer LLC
exposed-secret exploitPO, LOG, PY, JS492026-11-07
158.94.172.120
United States · CNServer LLC
exposed-secret exploitPO, LOG, PY, JS492026-11-07
158.94.172.116
United States · CNServer LLC
exposed-secret exploitPO, LOG, PY, JS492026-11-07
104.21.1.52
United States · Cloudflare, Inc.
exploitCOM12026-11-07
172.67.128.140
United States · Cloudflare, Inc.
exploitCOM12026-11-07
163.52.135.106
unknown network
malware mozi exploit exposed-secretELF, JS, TXT, JSON332026-11-07
38.60.91.186
United States · FASTNET DATA INC
exposed-secret malware mozi exploitSH, PY, LOG, TXT1,0392026-11-07
195.26.246.148
United States · Contabo Inc.
exposed-secret webshell exploit tunnelTXT, SAMPLE, PY, TGZ542026-11-07
192.236.152.232
United States · HostPapa
exploit exposed-secret malware moziPY, TXT, SH, LOG2412026-11-07
198.137.202.133
United States · Mojo Networks
exposed-secret exploitTXT22026-11-07
90.155.92.199
United Kingdom · Andrews & Arnold Ltd
exposed-secret exploitTXT22026-11-07
178.238.156.105
United Kingdom · Andrews & Arnold Ltd
exposed-secret exploitTXT22026-11-07
103.102.131.30
Vietnam · VGP JOINT STOCK COMPANY
exploit exposed-secretTXT, ENV, JSON, PHP102026-11-07
3.84.186.180
United States · Amazon.com, Inc.
exposed-secret malware mozi exploitPY, HTML, JS, TXT8292026-11-07
3.128.117.168
United States · Amazon.com, Inc.
exposed-secret exploit malware moziPHP, JS, BIN, DB2562026-11-07
64.23.240.211
United States · DigitalOcean, LLC
malware exploit coinminer exposed-secretPY, LOG, TXT, SH3862026-11-07
8.212.181.6
Philippines · Alibaba (US) Technology Co., Ltd.
exposed-secret malware cobalt-strike c2GO, BIN, TXT, PE772026-11-07
23.148.145.226
United States · VolumeDrive
exposed-secret exploitTXT, ENV32026-11-07
13.215.184.109
Singapore · Amazon.com, Inc.
exposed-secret malware exploit moziJSON, TXT, SH, PY1362026-11-07
16.59.36.98
United States · Amazon.com, Inc.
c2 exposed-secret exploit malwareLOG, SH, PY, JSON722026-11-07
18.139.222.103
Singapore · Amazon.com, Inc.
malware exploit macho-binary tunnelLOG, MACHO, JAVA, PY142026-11-07
3.26.94.147
Australia · Amazon.com, Inc.
c2 exploit malware exposed-secretPY, TOC, PE, MD672026-11-07
13.63.179.207
Sweden · Amazon.com, Inc.
exposed-secret malware mozi c2TXT, APK, GITIGN, KEYSTO392026-11-07
13.202.179.30
India · Amazon.com, Inc.
exposed-secret exploit tunnelMD, PHP, YML, JE82026-11-07
89.36.231.178
France · ROCKHOSTER PRIVATE LIMITED
malware coinminer exploit c2XML, SH, BAT, JAR2812026-11-07
152.175.230.66
Hong Kong · SKR-DE SAKURA INTERNATIONAL INVESTMENT LIMITED
exposed-secret malware mozi exploitJSON, JS, HTML, TXT352026-11-07
189.105.68.190
Hong Kong
exploit exposed-secret malware moziPY, LOG, JSONL, TXT132026-11-07
209.38.98.70
The Netherlands · DigitalOcean, LLC
exposed-secret exploitTXT22026-11-07
47.99.157.12
China · Hangzhou Alibaba Advertising Co.,Ltd.
exploit exposed-secret malware webshellPY, SH, PHP, C142026-11-06
157.230.88.27
United States · DigitalOcean, LLC
exposed-secret exploitTXT22026-11-06
164.90.158.217
United States · DigitalOcean, LLC
exposed-secret exploitTXT22026-11-06
187.124.84.80
United States · Hostinger International Limited
exposed-secret exploitTXT22026-11-06
47.79.90.89
United States · Alibaba (US) Technology Co., Ltd.
exploitSITE, NET32026-11-06
84.46.244.238
France · Contabo GmbH
exposed-secret exploitTXT22026-11-06
110.42.215.163
China · Shenzhen Tencent Computer Systems Company Limited
exploit exposed-secret malware moziGO, LOG, PY, PS13172026-11-06
185.199.110.153
United States · Fastly, Inc.
exploit ioc-matchIO, DMG32026-11-06
185.199.109.153
United States · Fastly, Inc.
exploit ioc-matchIO, DMG32026-11-06
185.28.119.18
United Kingdom · BlueVPS OU
exploit exposed-secret webshell malwareMD, PY, SH, LOG1602026-11-05
95.182.90.214
United Arab Emirates · Cloud Software - FZCO
exploit exposed-secretKEY12026-11-05
43.135.35.8
Hong Kong · Shenzhen Tencent Computer Systems Company Limited
malware mozi exposed-secret exploitSH, PY, LOG, JS5822026-11-05
43.159.51.87
Singapore · Shenzhen Tencent Computer Systems Company Limited
webshell exposed-secret exploit tunnelPHP, PHTML, PHP5, TXT942026-11-05
← NewerPage 4 of 23Older →
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free