huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
6,031
hosts
112,857
files
81
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled exposed-secret
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 221.239.59.59 China · ASN for TIANJIN Provincial Net of CT | exposed-secret | TXT, ENV, JSON, PHP | 6 | 2026-09-30 |
| 101.36.127.225 Hong Kong · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED | exploit exposed-secret | TXT, ENV, JSON, PHP | 16 | 2026-09-30 |
| 124.220.164.14 China · Shenzhen Tencent Computer Systems Company Limited | malware exploit exposed-secret c2 | MACHO, TXT, JAVA, SH | 89 | 2026-09-30 |
| 5.61.31.52 Iran · Negah Roshan Pars Company (PJS) | exposed-secret tunnel | PHP, GITIGN | 71 | 2026-09-30 |
| 190.84.232.232 Colombia · Telmex Colombia S.A. | coinminer malware exposed-secret webshell | K4MIL4, CMD, PHP, D34D | 28 | 2026-09-30 |
| 185.148.144.99 Bulgaria · Belcloud LTD | exposed-secret exploit malware mozi | PHP, JS, TXT, PY | 306 | 2026-09-30 |
| 95.81.98.36 The Netherlands · CLODO CLOUD SERVICE CO. L.L.C | exploit exposed-secret | HTML, TXT | 5 | 2026-09-30 |
| 94.26.3.238 United States · MillenialHost Limited | exposed-secret malware mozi exploit | LOG, SH, PY, ZIP | 70 | 2026-09-30 |
| 85.198.90.230 Kazakhstan · ITGLOBAL.COM KZ LLP | exposed-secret | DAT | 1 | 2026-09-30 |
| 81.82.11.65 Belgium · Telenet BV | exposed-secret exploit tunnel | TXT, PY, BAS | 16 | 2026-09-30 |
| 46.233.50.11 Bulgaria · Point To Point Ltd. | exposed-secret exploit webshell malware | LOG, TXT, GZ, BIN | 49 | 2026-09-30 |
| 34.22.116.191 Belgium · Google LLC | exposed-secret malware mozi tunnel | JS, JSON, HTML, PL | 22 | 2026-09-30 |
| 95.81.127.78 Finland · IHOR HOSTING LTD | exposed-secret exploit tunnel mirror | PY, TXT, BAK, SH | 39 | 2026-09-30 |
| 5.202.105.149 Iran · Pishgaman Toseeh Ertebatat Company (Private Joint Stock) | exposed-secret | OVPN | 2 | 2026-09-30 |
| 45.80.70.124 Russia · Beget LLC | exposed-secret exploit tunnel | SH, GZ, PHP, TXT | 186 | 2026-09-30 |
| 45.146.165.38 Russia · Beget LLC | malware mozi exploit webshell | PY, LOG, JSON, CSV | 46 | 2026-09-30 |
| 185.23.34.58 Russia · Beget LLC | exposed-secret malware elf-binary | SH, BAK, ELF, SERVER | 6 | 2026-09-30 |
| 91.197.98.188 Russia · "Domain names registrar REG.RU", Ltd | malware exposed-secret mozi pe-binary | PE, BAT, PS1 | 12 | 2026-09-30 |
| 185.134.201.155 Russia · MapmakersGroup "MapMakers Group" Ltd | exposed-secret malware pe-binary | LOG, DAT, PE | 4 | 2026-09-30 |
| 2.59.218.32 Bulgaria · BlueVPS OU | exposed-secret exploit malware tunnel | TGZ, PY, ELF, SH | 33 | 2026-09-30 |
| 78.153.155.55 United States · GLOBAL CONNECTIVITY SOLUTIONS LLP | exposed-secret exploit tunnel | TXT, BAT, HTML, PY | 5 | 2026-09-30 |
| 37.60.248.174 France · Contabo GmbH | exploit exposed-secret webshell malware | TXT, JSON, JS, MD | 365 | 2026-09-30 |
| 194.226.192.40 Russia · SCIENTIFIC RESEARCH INSTITUTE FOR SYSTEM ANALYSIS OF THE NATIONAL RESEARCH CENT | exposed-secret exploit tunnel | SAMPLE, TXT, LOG, GITIGN | 25 | 2026-09-30 |
| 45.153.190.16 Russia · Beget LLC | exposed-secret exploit | PY, DB, ENV, EXAMPL | 23 | 2026-09-30 |
| 43.129.51.137 Indonesia · Shenzhen Tencent Computer Systems Company Limited | exposed-secret malware gafgyt exploit | PY, MD, LOG, JSON | 115 | 2026-09-30 |
| 45.12.18.80 Russia · Beget LLC | exposed-secret exploit tunnel | PY, TXT, ENV, GITIGN | 19 | 2026-09-30 |
| 122.166.178.204 India · Bharti Airtel Limited | exposed-secret exploit malware sliver | PY, TXT, ENV, GITIGN | 77 | 2026-09-30 |
| 51.79.251.75 Canada · OVH SAS | exposed-secret exploit malware tunnel | LOG, PY, TXT, BAK | 34 | 2026-09-30 |
| 84.46.247.54 France · Contabo GmbH | exposed-secret malware sliver | LOG | 1 | 2026-09-30 |
| 170.106.98.130 United States · Shenzhen Tencent Computer Systems Company Limited | exposed-secret exploit webshell tunnel | MD, SAMPLE, PY, TXT | 54 | 2026-09-30 |
| 23.94.223.7 United States · HostPapa | exposed-secret tunnel | LOG, YAML | 3 | 2026-09-30 |
| 173.254.242.131 United States · HostPapa | exposed-secret tunnel | YAML | 7 | 2026-09-30 |
| 132.226.90.98 United States · Oracle Corporation | exposed-secret tunnel | HTML, MD, YAML | 4 | 2026-09-30 |
| 64.83.20.32 United States · NetLab Global | exposed-secret tunnel | LOG, CONF | 4 | 2026-09-30 |
| 152.232.90.185 Canada · B2 Net Solutions Inc. | exposed-secret | HTML, ZIP | 20 | 2026-09-30 |
| 183.177.228.152 Japan · ARTERIA Networks Corporation | exposed-secret | PY | 5 | 2026-09-30 |
| 132.226.85.167 United States · Oracle Corporation | exposed-secret tunnel | CONF, YAML | 2 | 2026-09-30 |
| 154.12.56.159 United States · Zhihua Lu | exposed-secret | YAML | 1 | 2026-09-30 |
| 172.245.136.132 United States · HostPapa | exposed-secret exploit tunnel | LOG, JSON, ENV, JSONL | 23 | 2026-09-30 |
| 70.39.196.94 United States · GTT Communications Inc. | exposed-secret | YAML | 1 | 2026-09-30 |
| 46.225.118.210 Germany · Hetzner Online GmbH | exposed-secret exploit malware mozi | PY, JSON, LOG, BAK | 45 | 2026-09-30 |
| 101.35.210.248 China · Shenzhen Tencent Computer Systems Company Limited | exposed-secret malware mozi tunnel | JS, JSON, HTML, PL | 22 | 2026-09-30 |
| 102.134.50.57 South Korea · VMISS Inc. | exposed-secret | TXT | 1 | 2026-09-30 |
| 43.157.202.180 Indonesia · Shenzhen Tencent Computer Systems Company Limited | exploit exposed-secret | HTML | 1 | 2026-09-30 |
| 49.234.49.58 China · Shenzhen Tencent Computer Systems Company Limited | exposed-secret malware gafgyt exploit | JSON, PY, SH, DB | 63 | 2026-09-30 |
| 61.185.204.20 China · Chinanet | exploit exposed-secret webshell forced-loot | YAML, LOG, PY, TXT | 104 | 2026-09-30 |
| 118.193.37.113 Hong Kong · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED | exposed-secret | TXT, LOG, SH | 6 | 2026-09-30 |
| 81.70.21.248 China · Shenzhen Tencent Computer Systems Company Limited | exploit malware exposed-secret webshell | TXT, PY, GITIGN, IN | 28 | 2026-09-30 |
| 82.156.242.82 China · Shenzhen Tencent Computer Systems Company Limited | exposed-secret | TXT | 1 | 2026-09-30 |
| 207.180.219.101 France · Contabo GmbH | exploit exposed-secret malware mozi | HTML, MD, PY, LOG | 34 | 2026-09-30 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free