huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
6,031
hosts
112,857
files
81
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Every host we harvested files from, newest first
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 13.224.95.54 United States · Amazon.com, Inc. | files | TXT | 1 | 2026-10-27 |
| 13.224.95.26 United States · Amazon.com, Inc. | files | TXT | 1 | 2026-10-27 |
| 159.223.198.83 United States · DigitalOcean, LLC | exposed-secret | PHP, TXT | 2 | 2026-10-27 |
| 45.154.255.98 Sweden · KeFF Networks Ltd | exposed-secret malware pe-binary | GZ, BZ2, TXT, PE | 80 | 2026-10-27 |
| 45.154.255.51 Sweden · KeFF Networks Ltd | exposed-secret | TXT | 1 | 2026-10-27 |
| 102.134.35.141 Taiwan · Turing Group Limited | exposed-secret | TXT | 2 | 2026-10-27 |
| 62.60.226.140 Germany · FEMO IT SOLUTIONS LIMITED | c2 exploit | EXE | 5 | 2026-10-27 |
| 172.239.193.194 United States · Akamai Technologies, Inc. | files | LIVE | 1 | 2026-10-27 |
| 172.234.212.77 United States · Akamai Technologies, Inc. | files | LIVE | 1 | 2026-10-27 |
| 45.194.66.165 Poland · ExpressHost Ltd | exposed-secret | CC | 1 | 2026-10-27 |
| 172.236.103.15 United States · Akamai Technologies, Inc. | files | LIVE | 1 | 2026-10-27 |
| 103.179.44.239 India · WebHorizon Internet Services | malware mozi c2 exploit | PY, LOG | 7 | 2026-10-27 |
| 191.217.250.227 United States | malware c2 coinminer exploit | PHP, GZ, BIN, SH | 33 | 2026-10-27 |
| 63.133.254.188 United States · DQE Communications LLC | exposed-secret | TXT | 2 | 2026-10-27 |
| 177.52.110.176 Brazil · XTURBO PROVEDOR DE INTERNET LTDA - EPP | exposed-secret exploit | TXT | 2 | 2026-10-27 |
| 190.109.118.92 Brazil · WorldConect telecom | files | JSON | 1 | 2026-10-27 |
| 202.181.147.249 Hong Kong · IXTech Limited | exposed-secret | TXT | 2 | 2026-10-27 |
| 190.109.118.203 Brazil · WorldConect telecom | files | JSON | 1 | 2026-10-27 |
| 178.62.244.85 The Netherlands · DigitalOcean, LLC | files | BIN | 1 | 2026-10-27 |
| 210.87.125.235 Indonesia · CV Brawijaya Giga Network | exposed-secret | TXT | 2 | 2026-10-27 |
| 45.224.226.224 Brazil · Netlife Provedor de Internet | files | JSON | 1 | 2026-10-27 |
| 13.239.40.119 Australia · Amazon.com, Inc. | exploit malware mozi exposed-secret | JS, MD, JSON, EDITOR | 34 | 2026-10-27 |
| 167.71.19.245 United States · DigitalOcean, LLC | exposed-secret exploit malware mozi | GO, TXT, BAT, LOG | 44 | 2026-10-27 |
| 47.108.183.238 China · Hangzhou Alibaba Advertising Co.,Ltd. | malware mozi tunnel | LOG, PS1, PY, TOML | 17 | 2026-10-27 |
| 130.12.180.212 United States · Omegatech LTD | exploit | TXT | 1 | 2026-10-27 |
| 85.121.50.9 Romania · M247 Europe SRL | exposed-secret exploit | TXT, ENV, JSON | 11 | 2026-10-27 |
| 151.158.0.240 Hong Kong · Evoxt Sdn. Bhd. | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-10-27 |
| 104.21.87.109 United States · Cloudflare, Inc. | exposed-secret | CYOU | 1 | 2026-10-27 |
| 108.165.121.127 United States · Snaju Development | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-10-27 |
| 107.191.102.241 United States · InMotion Hosting, Inc. | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-10-27 |
| 185.106.102.5 Cyprus · CLOUDLAYER8 LIMITED | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-10-27 |
| 171.22.174.161 Germany · MASSIVEGRID LTD | exposed-secret exploit | TXT, ENV, JSON | 11 | 2026-10-27 |
| 194.5.98.34 Norway · WebHorizon Internet Services | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-10-27 |
| 103.254.63.94 Canada · HostBilby Inc. | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-10-27 |
| 2.59.219.69 Moldova · ALEXHOST SRL | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-10-27 |
| 89.45.45.56 Turkey · 2E TELEKOMUNIKASYON LTD STI | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-10-27 |
| 62.105.222.164 The Netherlands · GTT Communications Inc. | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-10-27 |
| 185.157.217.98 Turkey · ENIYISUNUCUM VERI MERKEZI BILISIM HIZMETLERI TICARET VE SANAYI LIMITED SIRKETI | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-10-27 |
| 176.125.243.42 Moldova · ALEXHOST SRL | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-10-27 |
| 5.83.150.29 Germany · Tech Tide Portugal Unipessoal LDA | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-10-27 |
| 104.192.42.94 The Netherlands · EUROHOSTER Ltd. | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-10-27 |
| 148.135.207.70 The Netherlands · Matteo Martelloni trading as DELUXHOST | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-10-27 |
| 87.106.35.8 United Kingdom · IONOS SE | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-10-27 |
| 164.90.209.4 Germany · DigitalOcean, LLC | exposed-secret webshell malware mozi | CFC, JS, CFM, JAR | 31 | 2026-10-27 |
| 178.62.64.147 United Kingdom · DigitalOcean, LLC | exposed-secret webshell malware mozi | CFC, JS, CFM, JAR | 31 | 2026-10-27 |
| 1.13.14.74 China · Shenzhen Tencent Computer Systems Company Limited | exposed-secret | TXT, ENV, JSON, PHP | 5 | 2026-10-27 |
| 172.233.230.62 United States · Akamai Technologies, Inc. | exposed-secret | TXT | 2 | 2026-10-27 |
| 144.91.103.172 France · Contabo GmbH | exposed-secret malware tunnel elf-binary | LOG, PY, ELF, SH | 51 | 2026-10-27 |
| 122.114.158.226 China · CHINA UNICOM China169 Backbone | exposed-secret | TXT | 2 | 2026-10-27 |
| 104.21.6.176 United States · Cloudflare, Inc. | exposed-secret | CYOU | 1 | 2026-10-27 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free