huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,966
hosts
106,473
files
104
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled malware
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 43.135.35.8 Hong Kong · Shenzhen Tencent Computer Systems Company Limited | malware mozi exposed-secret exploit | SH, PY, LOG, JS | 582 | 2026-11-05 |
| 109.238.87.159 United Kingdom · B2 Net Solutions Inc. | exposed-secret malware mozi exploit | TXT, SH, BIN, JSON | 11 | 2026-11-05 |
| 89.108.69.89 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
| 37.140.193.79 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
| 89.108.69.204 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
| 194.58.127.32 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
| 37.140.193.250 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
| 89.108.69.94 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
| 43.164.138.101 South Korea · Shenzhen Tencent Computer Systems Company Limited | malware coinminer elf-binary | SH, GZ, ELF, CONF | 159 | 2026-11-05 |
| 89.108.69.159 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
| 89.108.69.77 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
| 161.33.148.80 Japan · Oracle Corporation | exposed-secret malware mozi exploit | HDR, SH, TGZ, TXT | 294 | 2026-11-05 |
| 31.31.194.141 Russia · "Domain names registrar REG.RU", Ltd | malware mozi | JS | 1 | 2026-11-05 |
| 43.161.243.73 Hong Kong · Shenzhen Tencent Computer Systems Company Limited | exploit malware exposed-secret mozi | LOG, PY, MACHO, SH | 417 | 2026-11-05 |
| 217.142.239.53 Japan · Oracle Corporation | exposed-secret exploit malware tunnel | BAT, CMD, PE, SH | 5 | 2026-11-05 |
| 143.246.202.252 United States | exposed-secret exploit c2 malware | PS1, PY, HTML, PE | 8 | 2026-11-05 |
| 64.93.12.85 United States · GTT Communications Inc. | c2 coinminer exposed-secret malware | LOG, TXT | 2 | 2026-11-05 |
| 125.78.242.26 China · Chinanet | malware pe-binary | PE, BIN, RAR, TXT | 6 | 2026-11-05 |
| 176.65.132.7 The Netherlands · Pfcloud UG (haftungsbeschrankt) | malware tsunami c2 exposed-secret | ELF, DZ, SH, TXT | 8 | 2026-11-05 |
| 51.15.107.106 France · Scaleway SAS | c2 cobalt-strike exploit malware | TXT | 1 | 2026-11-05 |
| 168.144.251.199 United States | exploit exposed-secret webshell malware | PHP, HTML, LOG, PY | 146 | 2026-11-05 |
| 94.130.22.61 Germany · Hetzner Online GmbH | exposed-secret exploit malware mozi | PY, EML, JSON, TXT | 1,209 | 2026-11-05 |
| 23.27.25.75 United States · Evoxt Sdn. Bhd. | exposed-secret malware mozi exploit | PY, SQL, JSON, LOG | 129 | 2026-11-05 |
| 85.215.73.250 Germany · IONOS SE | malware elf-binary pe-binary tunnel | ELF, PE, SH | 21 | 2026-11-04 |
| 202.95.14.76 Hong Kong · CTG Server Limited | exploit malware mozi exposed-secret | PHP, PY, TXT, ZIP | 417 | 2026-11-04 |
| 202.95.14.69 Hong Kong · CTG Server Limited | exploit malware mozi exposed-secret | PHP, PY, TXT, ZIP | 417 | 2026-11-04 |
| 23.248.226.189 United States · YANCY LIMITED | exposed-secret exploit malware mozi | GZ, GITIGN, MD, PHP | 115 | 2026-11-04 |
| 23.248.226.187 United States · YANCY LIMITED | exposed-secret exploit malware mozi | GZ, GITIGN, MD, PHP | 115 | 2026-11-04 |
| 23.248.226.188 United States · YANCY LIMITED | exposed-secret exploit malware mozi | GZ, GITIGN, MD, PHP | 115 | 2026-11-04 |
| 23.248.226.186 United States · YANCY LIMITED | exposed-secret exploit malware mozi | GZ, GITIGN, MD, PHP | 115 | 2026-11-04 |
| 23.248.226.190 United States · YANCY LIMITED | exposed-secret exploit malware mozi | GZ, GITIGN, MD, PHP | 115 | 2026-11-04 |
| 202.95.14.60 Hong Kong · CTG Server Limited | exploit malware mozi exposed-secret | PHP, PY, TXT, ZIP | 417 | 2026-11-04 |
| 130.94.31.86 South Korea · NTT America, Inc. | malware mozi exposed-secret tunnel | TXT, PY, ENV, JSON | 11 | 2026-11-04 |
| 154.255.225.214 DZ · Telecom Algeria | exploit malware elf-binary | ELF, LRC | 2 | 2026-11-04 |
| 5.175.192.232 The Netherlands · Simon Mariacher | malware elf-binary | ELF | 9 | 2026-11-04 |
| 139.84.162.69 India · The Constant Company, LLC | malware elf-binary | ELF | 1 | 2026-11-04 |
| 202.182.101.198 Japan · The Constant Company, LLC | exposed-secret malware elf-binary | ELF, TXT | 2 | 2026-11-04 |
| 207.56.221.47 United States · NTT America, Inc. | exposed-secret malware mozi exploit | PY, LOG, SH, TXT | 625 | 2026-11-04 |
| 38.54.88.171 United States · Kaopu Cloud HK Limited | exploit exposed-secret malware mozi | PY, SH, LOG, TXT | 200 | 2026-11-04 |
| 38.60.227.210 United States · Kaopu Cloud HK Limited | exposed-secret malware mozi c2 | PY, TXT, SH, PS1 | 1,000 | 2026-11-04 |
| 158.247.218.226 South Korea · The Constant Company, LLC | exposed-secret malware mozi exploit | PY, JS, LOG, TXT | 388 | 2026-11-04 |
| 64.177.47.135 United States | malware exposed-secret exploit c2 | PE, PY, MD, TXT | 97 | 2026-11-04 |
| 172.104.173.165 Singapore · Akamai Technologies, Inc. | exposed-secret exploit webshell malware | PY, SH, ELF, LOG | 85 | 2026-11-04 |
| 139.162.50.39 Singapore · Akamai Technologies, Inc. | exposed-secret malware tunnel elf-binary | LOG, SH, ELF | 12 | 2026-11-04 |
| 177.3.43.43 United States · Hong Kong Communications International Co., Limited | malware c2 exposed-secret webshell | PE, PY, PHP, SH | 24 | 2026-11-04 |
| 108.165.95.10 United States · Nodestop LLC | malware elf-binary | ELF, SH | 8 | 2026-11-04 |
| 172.105.156.56 United States · Akamai Technologies, Inc. | exposed-secret malware mozi exploit | PHP, TXT | 4 | 2026-11-04 |
| 172.105.156.109 United States · Akamai Technologies, Inc. | exposed-secret malware mozi exploit | PHP, TXT | 4 | 2026-11-04 |
| 172.105.156.161 United States · Akamai Technologies, Inc. | exposed-secret malware mozi exploit | PHP, TXT | 4 | 2026-11-04 |
| 64.20.61.134 United States · Interserver, Inc | exposed-secret malware mozi tunnel | JSON, JS, TXT, HTML | 38 | 2026-11-03 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free