huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,966
hosts
106,473
files
101
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled c2
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 178.63.68.220 Germany · Hetzner Online GmbH | exploit exposed-secret c2 | TXT, JSON, LOG, PY | 7 | 2026-10-21 |
| 51.159.105.208 France · Scaleway SAS | exploit exposed-secret c2 malware | PY, LOG, TXT, SH | 334 | 2026-10-21 |
| 193.29.104.84 France · M247 Europe SRL | malware c2 exploit exposed-secret | BAT, PS1, PE | 45 | 2026-10-21 |
| 51.159.53.7 France · Scaleway SAS | exposed-secret c2 malware pe-binary | LOG, CUE, PE, PY | 33 | 2026-10-21 |
| 15.188.163.78 France · Amazon.com, Inc. | exposed-secret exploit malware mozi | LOG, SH, TXT, PY | 378 | 2026-10-21 |
| 157.245.140.34 United States · DigitalOcean, LLC | exposed-secret malware mozi exploit | PY, LOG, SH, JSON | 1,680 | 2026-10-21 |
| 151.243.11.241 Germany · LLC VASH KREDIT BANK | exploit c2 exposed-secret malware | PY, MD, LOG, TXT | 439 | 2026-10-21 |
| 142.93.57.244 United States · DigitalOcean, LLC | exposed-secret exploit malware c2 | TXT, JSON, JS, BODY | 217 | 2026-10-21 |
| 64.111.92.149 United States · BL Networks | exposed-secret exploit malware mozi | PY, YAML, TXT, MD | 108 | 2026-10-21 |
| 23.81.35.61 United Kingdom · LEASEWEB UK LIMITED | exposed-secret exploit c2 malware | PY, BAK, GZ, SH | 748 | 2026-10-21 |
| 8.217.24.92 Hong Kong · Alibaba (US) Technology Co., Ltd. | exposed-secret malware mozi webshell | PY, HTM, SH, JS | 649 | 2026-10-21 |
| 198.23.209.17 United States · HostPapa | malware webshell exploit exposed-secret | ELF, TXT, SH, MACHO | 135 | 2026-10-21 |
| 167.233.243.9 Germany · Hetzner Online GmbH | exposed-secret exploit c2 malware | SH, PY, JSON, RS | 105 | 2026-10-21 |
| 188.166.148.204 GB · DigitalOcean, LLC | c2 exposed-secret tunnel | LOG, PY, SH, YML | 12 | 2026-10-21 |
| 16.171.12.83 Sweden · Amazon.com, Inc. | malware exploit c2 meterpreter | PS1, PE, B64, VBS | 19 | 2026-10-21 |
| 175.100.42.26 Cambodia · VIETTEL (CAMBODIA) PTE., LTD | c2 malware mozi tunnel | SH | 1 | 2026-10-21 |
| 82.158.193.146 Ukraine | exploit webshell c2 exposed-secret | JS, LOG, PY, SH | 11 | 2026-10-20 |
| 45.198.224.91 Seychelles · VPSVAULT.HOST LTD | malware c2 elf-binary | ELF, SH | 14 | 2026-10-20 |
| 172.67.72.49 United States · Cloudflare, Inc. | c2 exposed-secret | COM | 1 | 2026-10-20 |
| 104.26.14.226 United States · Cloudflare, Inc. | c2 exposed-secret | COM | 1 | 2026-10-20 |
| 104.26.15.226 United States · Cloudflare, Inc. | c2 exposed-secret | COM | 1 | 2026-10-20 |
| 2.26.123.158 Germany · VPSPay Networks LTD | c2 | TXT | 2 | 2026-10-20 |
| 104.17.112.233 United States · Cloudflare, Inc. | c2 | TXT | 1 | 2026-10-19 |
| 104.18.111.161 United States · Cloudflare, Inc. | c2 | TXT | 1 | 2026-10-19 |
| 192.178.202.102 United States · Google LLC | c2 | TXT | 7 | 2026-10-19 |
| 192.178.202.100 United States · Google LLC | c2 | TXT | 7 | 2026-10-19 |
| 192.178.202.101 United States · Google LLC | c2 | TXT | 7 | 2026-10-19 |
| 209.141.43.95 United States · FranTech Solutions | exploit c2 exposed-secret webshell | PHP, ELF, SH, ZIP | 69 | 2026-10-19 |
| 185.157.161.93 Sweden · Obehosting AB | exploit c2 exposed-secret webshell | PY, SH, JS, JSON | 503 | 2026-10-19 |
| 45.142.143.235 Finland · Materialism s.r.l. | exposed-secret malware mozi exploit | PY, SQL, GZ, SH | 643 | 2026-10-19 |
| 188.120.247.225 Russia · JSC IOT | exploit exposed-secret c2 malware | PHP, TXT | 2,965 | 2026-10-19 |
| 8.138.166.206 Singapore · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret exploit malware c2 | PY, TXT, XML, LOG | 93 | 2026-10-19 |
| 45.115.26.23 Vietnam · Contrust Solutions S.R.L. | malware exploit exposed-secret c2 | ELF, TXT, PE, XML | 33 | 2026-10-19 |
| 144.172.108.144 United States · RouterHosting LLC | c2 | TODAY | 1 | 2026-10-18 |
| 144.91.94.21 France · Contabo GmbH | exploit malware c2 webshell | PS1, VBS, PE, HTA | 10 | 2026-10-18 |
| 38.9.96.215 United States · Cogent Communications | malware c2 havoc mozi | ELF, SH, LOG | 15 | 2026-10-18 |
| 194.226.98.121 Russia · JSC Avantel | c2 exposed-secret | JSON | 1 | 2026-10-17 |
| 176.12.71.122 Russia · JSC IOT | c2 exposed-secret | ENV, JSON | 2 | 2026-10-16 |
| 192.178.203.101 United States · Google LLC | c2 | TXT | 1 | 2026-10-16 |
| 192.178.203.100 United States · Google LLC | c2 | TXT | 1 | 2026-10-16 |
| 192.178.203.102 United States · Google LLC | c2 | TXT | 1 | 2026-10-16 |
| 194.233.72.68 Singapore · Contabo Asia Private Limited | exploit exposed-secret malware webshell | PY, TXT, PHP, MD | 285 | 2026-10-16 |
| 146.19.24.104 Poland · MEVSPACE sp. z o.o. | c2 | IO | 1 | 2026-10-16 |
| 213.180.204.221 Russia · YANDEX LLC | c2 | TXT | 1 | 2026-10-16 |
| 154.36.183.100 MU · NetLab Global | exposed-secret c2 malware tunnel | PY, SH, TXT, ELF | 18 | 2026-10-16 |
| 139.59.125.212 Singapore · DigitalOcean, LLC | c2 | COM | 1 | 2026-10-15 |
| 178.128.201.3 Germany · DigitalOcean, LLC | c2 | COM | 1 | 2026-10-15 |
| 186.241.117.95 United States · Uscloud Inc | c2 exposed-secret exploit malware | PS1, SQL, PE, BAT | 24 | 2026-10-15 |
| 47.102.192.23 China · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret malware exploit mozi | PY, TXT, LOG, SH | 484 | 2026-10-15 |
| 207.244.234.243 United States · Contabo Inc. | exposed-secret exploit malware c2 | TXT, ELF | 124 | 2026-10-15 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free