huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
6,031
hosts
112,858
files
81
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Every host we harvested files from, newest first
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 222.255.174.161 Vietnam · VNPT Corp | files | JSON | 1 | 2026-10-27 |
| 172.67.135.20 United States · Cloudflare, Inc. | exposed-secret | CYOU | 1 | 2026-10-27 |
| 64.177.66.88 Israel · The Constant Company, LLC | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-10-27 |
| 64.176.166.236 Israel · The Constant Company, LLC | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-10-27 |
| 94.72.140.191 Bulgaria · DA International Group Ltd. | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-10-27 |
| 57.131.30.6 Italy · OVH SAS | exposed-secret exploit | TXT, ENV, JSON | 12 | 2026-10-27 |
| 64.227.143.203 India · DigitalOcean, LLC | exposed-secret webshell malware mozi | CFC, JS, CFM, JAR | 31 | 2026-10-27 |
| 5.189.136.65 France · Contabo GmbH | exposed-secret | PY, DB, YAML, YML | 6 | 2026-10-27 |
| 85.190.115.218 The Netherlands · dogado GmbH | malware elf-binary | GZ, ELF | 6 | 2026-10-27 |
| 216.126.86.27 Canada · Frontier Networks | malware mozi elf-binary | A | 1 | 2026-10-27 |
| 23.94.212.249 United States · HostPapa | exposed-secret | LOG | 1 | 2026-10-27 |
| 20.49.124.158 United States · Microsoft Corporation | files | 1 | 2026-10-27 | |
| 61.53.101.67 China · CHINA UNICOM China169 Backbone | malware mozi elf-binary | 1 | 2026-10-27 | |
| 65.20.96.115 Spain · The Constant Company, LLC | exploit malware exposed-secret webshell | LOG, PY, ELF, C | 175 | 2026-10-27 |
| 91.92.43.211 Germany · DEDIK SERVICES LIMITED | exposed-secret exploit malware mozi | PY, HTML, SH, JS | 703 | 2026-10-27 |
| 51.81.244.207 United States · OVH SAS | exploit malware coinminer exposed-secret | LOG, PY, SH, ELF | 31 | 2026-10-27 |
| 45.77.131.98 Japan · The Constant Company, LLC | malware mozi webshell exposed-secret | JSON, LOG, SH, PY | 311 | 2026-10-27 |
| 209.99.190.118 Switzerland · SKN Subnet & Telecom Ltd | malware adaptix exposed-secret exploit | ELF, LOG, PY, TGZ | 98 | 2026-10-27 |
| 47.106.255.216 China · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret | TXT, ENV, JSON, PHP | 6 | 2026-10-27 |
| 108.61.161.224 Japan · The Constant Company, LLC | exposed-secret exploit malware mozi | SH, HTML, LOG, PY | 197 | 2026-10-26 |
| 178.154.214.178 Russia · Yandex.Cloud LLC | exposed-secret | TXT | 1 | 2026-10-26 |
| 152.70.78.83 India · Oracle Corporation | exploit exposed-secret | TXT | 1 | 2026-10-26 |
| 209.146.101.252 United States · Cogent Communications | exposed-secret | YAML | 1 | 2026-10-26 |
| 95.163.226.19 Russia · "Domain names registrar REG.RU", Ltd | exposed-secret | TXT | 1 | 2026-10-26 |
| 89.108.76.200 Russia · "Domain names registrar REG.RU", Ltd | coinminer malware exploit tunnel | JSON, PY, BIN, TXT | 9 | 2026-10-26 |
| 91.92.241.101 The Netherlands · Omegatech LTD | exposed-secret exploit malware mozi | META, BODY, PY, TXT | 332 | 2026-10-26 |
| 4.240.84.68 India · Microsoft Corporation | exposed-secret | TXT | 1 | 2026-10-26 |
| 135.235.195.218 India · Microsoft Corporation | exposed-secret | TXT | 1 | 2026-10-26 |
| 23.225.71.207 United States · CNSERVERS LLC | exposed-secret exploit webshell malware | TXT, PY, DOCX, LOG | 85 | 2026-10-26 |
| 150.60.154.217 Japan · KDDI Web Communications Inc. | exposed-secret exploit | TXT | 2 | 2026-10-26 |
| 202.51.9.180 Japan · CLARA, Inc. | files | PHP | 1 | 2026-10-26 |
| 16.16.63.239 Sweden · Amazon.com, Inc. | malware c2 ioc-match mozi | PS1, PE, BIN, CPL | 12 | 2026-10-26 |
| 168.138.207.32 Japan · Oracle Corporation | files | 1 | 2026-10-26 | |
| 185.239.48.112 Russia · SmartApe OU | c2 exposed-secret | PRO | 1 | 2026-10-26 |
| 172.67.148.81 United States · Cloudflare, Inc. | files | ICU | 1 | 2026-10-26 |
| 104.21.29.29 United States · Cloudflare, Inc. | files | ICU | 1 | 2026-10-26 |
| 172.232.24.161 United States · Akamai Technologies, Inc. | files | BIZ, TOP | 2 | 2026-10-26 |
| 172.232.24.235 United States · Akamai Technologies, Inc. | files | BIZ, TOP | 2 | 2026-10-26 |
| 172.234.25.42 United States · Akamai Technologies, Inc. | files | BIZ, TOP | 2 | 2026-10-26 |
| 188.190.9.52 United States · EDIS GmbH | exposed-secret exploit webshell tunnel | JSP, LOG, SH, TGZ | 15 | 2026-10-26 |
| 156.234.58.211 Seychelles · YANCY LIMITED | c2 | COM | 42 | 2026-10-26 |
| 167.148.201.67 United Kingdom · MillenialHost Limited | files | BIN | 1 | 2026-10-26 |
| 49.12.82.48 Germany · Hetzner Online GmbH | exposed-secret | COM | 2 | 2026-10-26 |
| 188.116.36.156 Romania · Host Sailor Ltd | c2 | DIGITA, TOP | 2 | 2026-10-26 |
| 104.21.43.177 United States · Cloudflare, Inc. | files | LIVE | 1 | 2026-10-26 |
| 172.67.182.165 United States · Cloudflare, Inc. | files | LIVE | 1 | 2026-10-26 |
| 42.56.35.3 China · CHINA UNICOM China169 Backbone | malware mozi elf-binary | ELF | 1 | 2026-10-26 |
| 167.148.88.198 United States · Wave Broadband | files | COM | 1 | 2026-10-26 |
| 82.27.71.218 Germany · Wave Broadband | files | COM | 1 | 2026-10-26 |
| 167.148.88.191 United States · Wave Broadband | files | COM | 1 | 2026-10-26 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free