huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,966
hosts
106,473
files
104
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled webshell
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 23.225.71.207 United States · CNSERVERS LLC | exposed-secret exploit webshell malware | TXT, PY, DOCX, LOG | 85 | 2026-10-26 |
| 188.190.9.52 United States · EDIS GmbH | exposed-secret exploit webshell tunnel | JSP, LOG, SH, TGZ | 15 | 2026-10-26 |
| 52.128.241.77 Hong Kong · Netsec Limited | malware mozi c2 exposed-secret | PY, PS1, PE, GO | 257 | 2026-10-26 |
| 45.115.26.30 Vietnam · Contrust Solutions S.R.L. | exposed-secret exploit malware mozi | LOG, PY, SH, TXT | 1,395 | 2026-10-26 |
| 212.227.29.190 Germany · IONOS SE | exploit exposed-secret malware webshell | ELF, PHP, TXT | 3 | 2026-10-25 |
| 217.69.11.65 France · The Constant Company, LLC | exploit malware webshell pe-binary | PE, JSP, PS1, TXT | 10 | 2026-10-25 |
| 49.51.230.17 United States · Shenzhen Tencent Computer Systems Company Limited | malware exploit webshell exposed-secret | LOG, C, DLL, BIN | 56 | 2026-10-25 |
| 47.109.23.77 China · Hangzhou Alibaba Advertising Co.,Ltd. | malware cobalt-strike exploit exposed-secret | BIN, LOG, PHP, PY | 21 | 2026-10-25 |
| 156.245.146.226 Seychelles · Zillion Network Inc. | exposed-secret malware mozi exploit | SH, HTML, PY, TXT | 561 | 2026-10-25 |
| 129.159.135.190 Israel · Oracle Corporation | malware exploit exposed-secret mozi | ELF, LOG, PY, C | 40 | 2026-10-25 |
| 8.133.234.121 Singapore · Hangzhou Alibaba Advertising Co.,Ltd. | exploit exposed-secret malware mozi | SH, LOG, C, TXT | 216 | 2026-10-25 |
| 5.172.156.40 United Kingdom · Pulsant (Scotland) Ltd | exploit exposed-secret malware webshell | PY, PHP, ELF, ENV | 13 | 2026-10-25 |
| 175.159.194.157 Hong Kong · The Hong Kong Polytechnic University | exposed-secret exploit malware mozi | MD, SAMPLE, TXT, SH | 67 | 2026-10-25 |
| 47.237.84.48 United States · Alibaba (US) Technology Co., Ltd. | exposed-secret exploit webshell tunnel | MD, LOG, SH, TXT | 205 | 2026-10-25 |
| 121.4.83.178 China · Shenzhen Tencent Computer Systems Company Limited | exposed-secret c2 webshell malware | MD, GITIGN | 19 | 2026-10-25 |
| 198.46.158.18 United States · HostPapa | exposed-secret exploit malware mozi | PY, YAML, HTML, TXT | 362 | 2026-10-24 |
| 193.233.220.65 Russia · Aeza Group LLC | malware exploit c2 exposed-secret | PS1, PE, BAT, ZIP | 186 | 2026-10-24 |
| 2.26.229.254 Germany · PLAY2GO INTERNATIONAL LIMITED | malware adaptix coinminer c2 | PS1, PE, CMD, BAT | 43 | 2026-10-24 |
| 39.109.100.126 Hong Kong | exposed-secret malware mozi exploit | PY, TXT, LOG, SH | 440 | 2026-10-24 |
| 103.214.172.114 Hong Kong · Cloudie Limited | exposed-secret malware mozi exploit | PY, TXT, LOG, SH | 440 | 2026-10-24 |
| 103.39.78.45 Hong Kong · VH-GLOBAL | exploit exposed-secret malware webshell | ASPX, PE, PS1, TXT | 9 | 2026-10-24 |
| 43.254.165.70 Hong Kong · VH-GLOBAL | exploit exposed-secret malware webshell | ASPX, PE, PS1, TXT | 9 | 2026-10-24 |
| 54.69.111.24 United States · Amazon.com, Inc. | exploit exposed-secret webshell c2 | BIN, JSON, ZIP, PY | 114 | 2026-10-24 |
| 194.11.226.41 United Kingdom · ROCKHOSTER PRIVATE LIMITED | exposed-secret malware mozi exploit | PY, TXT, LOG, JS | 106 | 2026-10-24 |
| 50.210.239.219 United States · Comcast Cable Communications, LLC | exposed-secret exploit c2 webshell | PHP, PY, HTML, LOG | 45 | 2026-10-24 |
| 151.242.30.142 South Africa · Internet Magnate (Pty) Ltd | exploit malware mozi exposed-secret | JS, ZIP, C, PY | 454 | 2026-10-23 |
| 82.180.145.166 India · Contabo Asia Private Limited | webshell exposed-secret exploit malware | PHP, TXT, PY, JSP | 50 | 2026-10-23 |
| 202.61.139.15 Singapore · CTG Server Limited | exposed-secret exploit malware mozi | LOG, PY, JSON, PHP | 262 | 2026-10-23 |
| 154.219.98.61 Hong Kong · cognetcloud INC | exploit exposed-secret webshell tunnel | PY, MD, JAR, SH | 14 | 2026-10-23 |
| 79.127.237.104 United Kingdom · Datacamp Limited | webshell | PS1, XYZ | 2 | 2026-10-23 |
| 159.203.115.164 United States · DigitalOcean, LLC | exposed-secret c2 webshell malware | PY, SH, JS, TS | 459 | 2026-10-22 |
| 54.169.109.7 Singapore · Amazon.com, Inc. | exposed-secret exploit malware mozi | LOG, PY, OVPN, TXT | 55 | 2026-10-22 |
| 79.127.237.132 United Kingdom · Datacamp Limited | webshell | PS1, XYZ | 2 | 2026-10-22 |
| 212.232.23.75 Singapore · ROCKHOSTER PRIVATE LIMITED | exposed-secret exploit malware mozi | PY, LOG, TXT, BIN | 341 | 2026-10-21 |
| 91.214.17.136 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 91.214.17.151 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 195.201.83.167 Germany · Hetzner Online GmbH | exposed-secret exploit malware mozi | SH, PY, SCIENC, JSON | 400 | 2026-10-21 |
| 212.244.203.102 Poland · Orange Polska Spolka Akcyjna | webshell exposed-secret malware c2 | C, SQL, IN, PL | 300 | 2026-10-21 |
| 91.214.17.138 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 81.181.166.24 Romania · DataNode DC SRL | exposed-secret exploit malware mozi | BIN, LOG, TXT, JSON | 28 | 2026-10-21 |
| 91.214.17.190 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 95.43.220.235 Bulgaria · Vivacom Bulgaria EAD | malware c2 webshell elf-binary | GZ, C, BIN, ELF | 44 | 2026-10-21 |
| 78.130.211.168 Bulgaria · "Cooolbox" AD | exposed-secret webshell | GZ, BZ2, ZIP, JAR | 27 | 2026-10-21 |
| 82.118.235.179 Bulgaria · DA International Group Ltd. | exposed-secret exploit malware mozi | TXT, HTML | 28 | 2026-10-21 |
| 159.69.66.161 Germany · Hetzner Online GmbH | exposed-secret malware mozi exploit | PY, LOG, TXT, JSON | 705 | 2026-10-21 |
| 87.251.64.224 Poland · ISAEV Igor | c2 exposed-secret malware exploit | C, LOG, CSV, EXE | 8 | 2026-10-21 |
| 91.214.17.130 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 188.245.31.251 Germany · Hetzner Online GmbH | exploit exposed-secret malware webshell | SH, PY, C, ELF | 58 | 2026-10-21 |
| 91.214.17.135 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 144.76.236.71 Germany · Hetzner Online GmbH | exposed-secret exploit webshell | MD, PHP | 12 | 2026-10-21 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free