Live findsCVE IntelResearchConsoleStart free
huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

5,966
hosts
106,473
files
101
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 2996malware 1225exploit 1134mozi 922c2 314webshell 282ioc-match 88coinminer 66gafgyt 56tsunami 41mirai 38sliver 31meterpreter 16havoc 15

Hosts labelled mozi

HostLabelsFile typesFilesLast seen
38.60.205.58
United States · Kaopu Cloud HK Limited
exploit exposed-secret malware moziPY, HTML, TXT, LOG302026-10-31
38.97.253.252
United States · Cogent Communications
exposed-secret malware mozi webshellJS, JSON, PO, PY312026-10-31
38.76.199.210
United States · cognetcloud INC
exposed-secret malware mozi tunnelJS, JSON, HTML, PL222026-10-31
38.224.162.188
United States · GTHost
exposed-secret malware mozi webshellJS, JSON, PO, PY312026-10-31
154.89.148.84
HK · Cloudie Limited
malware exposed-secret c2 exploitELF, HTML, PY, SH782026-10-31
38.49.210.117
Canada · Rica Web Services
exposed-secret exploit webshell c2JSON, GO, SH, JS1,1652026-10-31
85.11.167.108
The Netherlands · TechTies Inc.
malware mozi exposed-secretPY, LOG42026-10-30
85.11.167.6
The Netherlands · TechTies Inc.
malware mozi exposed-secretTXT, ENV, JSON, PHP92026-10-30
172.67.158.135
United States · Cloudflare, Inc.
exploit exposed-secret malware moziCYOU22026-10-30
104.21.14.88
United States · Cloudflare, Inc.
exploit exposed-secret malware moziCYOU22026-10-30
31.128.39.24
Russia · Beget LLC
malware mozi exploit exposed-secretJS, PY, SH, TXT4552026-10-30
165.154.225.131
Singapore · Scloud Pte Ltd
exposed-secret exploit malware moziTXT, BIN, PY, HEADER8422026-10-30
39.107.106.210
China · Hangzhou Alibaba Advertising Co.,Ltd.
exposed-secret exploit malware moziPHP, LOG, SH, TXT4212026-10-30
45.117.83.34
Vietnam · NhanHoa Software company
exposed-secret malware exploit webshellLOG, PE, PY, JSON482026-10-30
39.106.140.144
China · Hangzhou Alibaba Advertising Co.,Ltd.
exposed-secret exploit malware moziSH, ELF, LOG, PE312026-10-30
93.102.144.219
Portugal · NOS COMUNICACOES, S.A.
malware mozi elf-binaryELF12026-10-29
46.166.162.142
Lithuania · UAB Cherry Servers
exploit malware exposed-secret webshellLOG, SEEDS, JS, TXT1,3932026-10-29
153.75.81.83
United Arab Emirates · RouterHosting LLC
exploit exposed-secret malware c2PY, TXT, LOG, ELF912026-10-29
209.99.184.246
Switzerland · SKN Subnet & Telecom Ltd
exploit exposed-secret c2 webshellTXT, MD, PY, JSON8662026-10-29
141.147.70.247
United Kingdom · Oracle Corporation
exposed-secret exploit malware moziJSON, TS, JS, MD1622026-10-29
217.154.101.100
Spain · IONOS SE
exploit c2 exposed-secret malwareHTML, JS, TXT52026-10-29
143.246.203.114
United States
exploit exposed-secret malware moziLOG, MD, PY, RB852026-10-29
147.45.133.66
The Netherlands · Timeweb, LLP
malware moziGZ, TAR52026-10-28
218.1.211.104
China · China Telecom (Group)
malware mozi elf-binaryA12026-10-28
114.132.61.189
China · Shenzhen Tencent Computer Systems Company Limited
exposed-secret malware exploit moziLOG, PY, SH, DB392026-10-28
101.43.25.15
China · Shenzhen Tencent Computer Systems Company Limited
exposed-secret malware mozi exploitJSON, JS, HTML, TXT352026-10-28
54.158.237.206
United States · Amazon.com, Inc.
exposed-secret exploit malware moziLOG, JS, ZIP, SH1602026-10-28
187.188.165.243
Mexico · TOTAL PLAY TELECOMUNICACIONES SA DE CV
malware mozi webshell exposed-secretPHP, JS, LIB, SWF3632026-10-28
167.17.69.200
Canada · GTHost
exploit webshell exposed-secret malwarePY, PHP, ELF, SH272026-10-28
23.19.231.52
United States · Leaseweb USA, Inc.
malware mozi exposed-secret exploitPY, GZ, JS, SH5772026-10-27
103.179.44.239
India · WebHorizon Internet Services
malware mozi c2 exploitPY, LOG72026-10-27
191.217.250.227
United States
malware c2 coinminer exploitPHP, GZ, BIN, SH332026-10-27
13.239.40.119
Australia · Amazon.com, Inc.
exploit malware mozi exposed-secretJS, MD, JSON, EDITOR342026-10-27
167.71.19.245
United States · DigitalOcean, LLC
exposed-secret exploit malware moziGO, TXT, BAT, LOG442026-10-27
47.108.183.238
China · Hangzhou Alibaba Advertising Co.,Ltd.
malware mozi tunnelLOG, PS1, PY, TOML172026-10-27
164.90.209.4
Germany · DigitalOcean, LLC
exposed-secret webshell malware moziCFC, JS, CFM, JAR312026-10-27
178.62.64.147
United Kingdom · DigitalOcean, LLC
exposed-secret webshell malware moziCFC, JS, CFM, JAR312026-10-27
64.227.143.203
India · DigitalOcean, LLC
exposed-secret webshell malware moziCFC, JS, CFM, JAR312026-10-27
216.126.86.27
Canada · Frontier Networks
malware mozi elf-binaryA12026-10-27
61.53.101.67
China · CHINA UNICOM China169 Backbone
malware mozi elf-binary12026-10-27
65.20.96.115
Spain · The Constant Company, LLC
exploit malware exposed-secret webshellLOG, PY, ELF, C1752026-10-27
91.92.43.211
Germany · DEDIK SERVICES LIMITED
exposed-secret exploit malware moziPY, HTML, SH, JS7032026-10-27
45.77.131.98
Japan · The Constant Company, LLC
malware mozi webshell exposed-secretJSON, LOG, SH, PY3112026-10-27
209.99.190.118
Switzerland · SKN Subnet & Telecom Ltd
malware adaptix exposed-secret exploitELF, LOG, PY, TGZ982026-10-27
108.61.161.224
Japan · The Constant Company, LLC
exposed-secret exploit malware moziSH, HTML, LOG, PY1972026-10-26
91.92.241.101
The Netherlands · Omegatech LTD
exposed-secret exploit malware moziMETA, BODY, PY, TXT3322026-10-26
23.225.71.207
United States · CNSERVERS LLC
exposed-secret exploit webshell malwareTXT, PY, DOCX, LOG852026-10-26
16.16.63.239
Sweden · Amazon.com, Inc.
malware c2 ioc-match moziPS1, PE, BIN, CPL122026-10-26
42.56.35.3
China · CHINA UNICOM China169 Backbone
malware mozi elf-binaryELF12026-10-26
52.128.241.77
Hong Kong · Netsec Limited
malware mozi c2 exposed-secretPY, PS1, PE, GO2572026-10-26
← NewerPage 5 of 19Older →
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free