huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,966
hosts
106,473
files
101
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled webshell
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 104.248.244.66 Germany · DigitalOcean, LLC | exposed-secret malware webshell mozi | PY, PS1, LOG, CONF | 49 | 2026-10-21 |
| 91.214.17.155 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 91.214.17.154 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 91.214.17.137 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 62.210.199.73 France · Scaleway SAS | exposed-secret webshell malware exploit | SH, GZ, PY, TXT | 17 | 2026-10-21 |
| 157.245.140.34 United States · DigitalOcean, LLC | exposed-secret malware mozi exploit | PY, LOG, SH, JSON | 1,680 | 2026-10-21 |
| 151.243.11.241 Germany · LLC VASH KREDIT BANK | exploit c2 exposed-secret malware | PY, MD, LOG, TXT | 439 | 2026-10-21 |
| 13.229.73.36 Singapore · Amazon.com, Inc. | exploit exposed-secret malware mozi | APK, LOG, HTML, TXT | 48 | 2026-10-21 |
| 64.111.92.149 United States · BL Networks | exposed-secret exploit malware mozi | PY, YAML, TXT, MD | 108 | 2026-10-21 |
| 23.81.35.61 United Kingdom · LEASEWEB UK LIMITED | exposed-secret exploit c2 malware | PY, BAK, GZ, SH | 748 | 2026-10-21 |
| 8.217.24.92 Hong Kong · Alibaba (US) Technology Co., Ltd. | exposed-secret malware mozi webshell | PY, HTM, SH, JS | 649 | 2026-10-21 |
| 198.23.209.17 United States · HostPapa | malware webshell exploit exposed-secret | ELF, TXT, SH, MACHO | 135 | 2026-10-21 |
| 202.65.11.59 Bangladesh · MGH INFOTECH LTD. | exposed-secret exploit malware mozi | MD, JS, JSON, PY | 27 | 2026-10-21 |
| 167.71.128.202 United Kingdom · DigitalOcean, LLC | exploit exposed-secret webshell tunnel | PY, GZ, SH, LOG | 210 | 2026-10-21 |
| 52.90.1.165 United States · Amazon.com, Inc. | exposed-secret webshell malware exploit | SH, TXT, ELF, KEY | 29 | 2026-10-21 |
| 3.92.228.247 United States · Amazon.com, Inc. | webshell exploit exposed-secret | PHP, TXT | 12 | 2026-10-21 |
| 2.26.51.20 Germany · PLAY2GO INTERNATIONAL LIMITED | exposed-secret exploit webshell tunnel | MD, PS1, SH, PY | 55 | 2026-10-21 |
| 16.171.12.83 Sweden · Amazon.com, Inc. | malware exploit c2 meterpreter | PS1, PE, B64, VBS | 19 | 2026-10-21 |
| 202.61.139.137 Singapore · CTG Server Limited | exposed-secret exploit malware mozi | PY, LOG, SH, TXT | 130 | 2026-10-20 |
| 82.158.193.146 Ukraine | exploit webshell c2 exposed-secret | JS, LOG, PY, SH | 11 | 2026-10-20 |
| 167.88.172.3 United States · RouterHosting LLC | malware exploit webshell elf-binary | ELF, MP, XP | 9 | 2026-10-20 |
| 177.4.12.11 Hong Kong · Hong Kong Communications International Co., Limited | exploit malware coinminer exposed-secret | PY, YAML, TXT, ZIP | 25 | 2026-10-19 |
| 209.141.43.95 United States · FranTech Solutions | exploit c2 exposed-secret webshell | PHP, ELF, SH, ZIP | 69 | 2026-10-19 |
| 185.157.161.93 Sweden · Obehosting AB | exploit c2 exposed-secret webshell | PY, SH, JS, JSON | 503 | 2026-10-19 |
| 45.142.143.235 Finland · Materialism s.r.l. | exposed-secret malware mozi exploit | PY, SQL, GZ, SH | 643 | 2026-10-19 |
| 38.76.223.35 United States · cognetcloud INC | exposed-secret webshell | BIN, JSON, PHP, TXT | 4 | 2026-10-19 |
| 209.50.60.40 United States · UpCloud USA Inc | exploit exposed-secret webshell | LOG, PHP, TXT, ZIP | 4 | 2026-10-19 |
| 8.138.166.206 Singapore · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret exploit malware c2 | PY, TXT, XML, LOG | 93 | 2026-10-19 |
| 89.161.143.90 Poland · home.pl S.A. | webshell | BAK, SUSPEC | 2 | 2026-10-19 |
| 65.20.109.231 Spain · The Constant Company, LLC | malware exploit webshell pe-binary | PE, ZIP, LOG, PS1 | 37 | 2026-10-18 |
| 144.91.94.21 France · Contabo GmbH | exploit malware c2 webshell | PS1, VBS, PE, HTA | 10 | 2026-10-18 |
| 179.43.175.2 Panama · Private Layer INC | exploit malware webshell exposed-secret | CMD, PE, PS1 | 40 | 2026-10-18 |
| 172.67.156.156 United States · Cloudflare, Inc. | webshell | ID | 1 | 2026-10-17 |
| 104.21.8.11 United States · Cloudflare, Inc. | webshell | ID | 1 | 2026-10-17 |
| 45.139.104.36 United States · 49.3 Networking LLC | malware mozi exploit exposed-secret | MD, JSON, JS, MJS | 31 | 2026-10-16 |
| 194.233.72.68 Singapore · Contabo Asia Private Limited | exploit exposed-secret malware webshell | PY, TXT, PHP, MD | 285 | 2026-10-16 |
| 47.102.192.23 China · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret malware exploit mozi | PY, TXT, LOG, SH | 484 | 2026-10-15 |
| 103.170.217.170 India · WebHorizon Internet Services | malware exploit webshell elf-binary | ELF, PE, PHP, SH | 16 | 2026-10-14 |
| 162.214.157.245 United States · Unified Layer | exposed-secret webshell exploit tunnel | PHP, TXT, ZIP, BAK | 27 | 2026-10-14 |
| 66.154.127.156 Canada · MULTACOM CORPORATION | exposed-secret exploit malware c2 | PY, ELF, SH, MD | 110 | 2026-10-13 |
| 167.233.36.82 Germany · Hetzner Online GmbH | exposed-secret malware mozi webshell | PHP, SH, JS, PY | 25 | 2026-10-08 |
| 37.69.77.150 France · Societe Francaise Du Radiotelephone - SFR SA | exposed-secret webshell exploit tunnel | PY, PYO, TXT, LOG | 81 | 2026-10-08 |
| 185.216.68.66 Seychelles · ALEXHOST SRL | exploit exposed-secret webshell c2 | PY, TXT, SH, JS | 339 | 2026-10-07 |
| 104.131.177.14 United States · DigitalOcean, LLC | webshell | PY | 1 | 2026-10-06 |
| 164.68.118.218 France · Contabo GmbH | exposed-secret exploit malware webshell | TXT, MD, GITIGN, JS | 137 | 2026-10-06 |
| 182.253.238.218 Indonesia · BIZNET | webshell | ZIP, PHP, TXT | 327 | 2026-10-06 |
| 51.144.45.141 The Netherlands · Microsoft Corporation | malware exploit exposed-secret webshell | PS1, JAR, PE, ZIP | 22 | 2026-10-03 |
| 43.163.124.78 Singapore · Shenzhen Tencent Computer Systems Company Limited | exploit exposed-secret malware meterpreter | TXT, ELF, MD, PY | 81 | 2026-10-03 |
| 209.99.188.155 Switzerland · SKN Subnet & Telecom Ltd | exposed-secret malware mozi exploit | TXT, SH, PY, JSON | 347 | 2026-10-02 |
| 89.124.67.72 The Netherlands · SERVERS TECH FZCO | exposed-secret exploit malware mozi | PY, MD, LOG, JSON | 10,428 | 2026-10-01 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free