huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,966
hosts
106,473
files
101
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled c2
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 172.67.156.2 United States · Cloudflare, Inc. | c2 | TXT | 1 | 2026-10-14 |
| 104.21.72.253 United States · Cloudflare, Inc. | c2 | TXT | 1 | 2026-10-14 |
| 194.163.148.133 France · Contabo GmbH | exposed-secret exploit malware mozi | PHP, TXT, MD, JS | 74 | 2026-10-14 |
| 38.54.88.188 United States · Kaopu Cloud HK Limited | malware exposed-secret mozi c2 | PY, SH, ELF, TGZ | 36 | 2026-10-14 |
| 217.6.46.91 Germany · Deutsche Telekom AG | c2 exploit exposed-secret malware | PS1 | 2 | 2026-10-14 |
| 78.17.93.224 Germany · HONGKONG XING TONG HUI TECHNOLOGY CO., LIMITED | c2 | COM | 2 | 2026-10-13 |
| 66.154.127.156 Canada · MULTACOM CORPORATION | exposed-secret exploit malware c2 | PY, ELF, SH, MD | 110 | 2026-10-13 |
| 69.46.46.62 United States · Railway | c2 exploit malware mozi | PS1 | 1 | 2026-10-12 |
| 91.215.85.103 Russia · PROSPERO OOO | c2 | 1 | 2026-10-12 | |
| 176.122.134.61 Canada · IT7 Networks Inc | c2 exploit | HTML | 1 | 2026-10-12 |
| 194.9.6.5 Germany · dataforest GmbH | c2 exposed-secret | TXT | 2 | 2026-10-10 |
| 213.136.79.115 France · Contabo GmbH | exposed-secret exploit malware c2 | SH, TXT, JSON, LOG | 460 | 2026-10-09 |
| 104.21.17.146 United States · Cloudflare, Inc. | c2 | COM | 1 | 2026-10-09 |
| 104.18.21.66 United States · Cloudflare, Inc. | c2 | NET | 1 | 2026-10-09 |
| 104.18.20.66 United States · Cloudflare, Inc. | c2 | NET | 1 | 2026-10-09 |
| 139.28.220.253 Finland · IHOR HOSTING LTD | exposed-secret exploit c2 malware | GZ, TXT, ALL, AUS | 36 | 2026-10-08 |
| 185.216.68.66 Seychelles · ALEXHOST SRL | exploit exposed-secret webshell c2 | PY, TXT, SH, JS | 339 | 2026-10-07 |
| 23.224.119.154 United States · CNSERVERS LLC | c2 exploit exposed-secret | TXT, ENV, JSON, PHP | 9 | 2026-10-07 |
| 172.67.176.216 United States · Cloudflare, Inc. | c2 | COM | 1 | 2026-10-06 |
| 172.67.198.196 United States · Cloudflare, Inc. | c2 | TXT | 1 | 2026-10-06 |
| 104.21.36.194 United States · Cloudflare, Inc. | c2 | TXT | 1 | 2026-10-06 |
| 107.173.55.151 United States · HostPapa | exploit exposed-secret c2 | HTML | 12 | 2026-10-06 |
| 5.83.144.60 India · GorillaServers, Inc. | malware exposed-secret c2 exploit | PE, ASPX, ELF, BAT | 31 | 2026-10-06 |
| 158.220.105.179 France · Contabo GmbH | coinminer malware exposed-secret c2 | SH, GZ, JS, TGZ | 13 | 2026-10-06 |
| 109.122.221.181 Hungary · Rackforest Zrt. | c2 | TXT | 4 | 2026-10-05 |
| 34.254.202.253 Ireland · Amazon.com, Inc. | malware coinminer exposed-secret exploit | LOG, TXT, PY, ELF | 26 | 2026-10-05 |
| 172.86.118.111 United States · RouterHosting LLC | exposed-secret exploit c2 malware | PY, LOG, TXT, PHP | 38 | 2026-10-04 |
| 43.163.124.78 Singapore · Shenzhen Tencent Computer Systems Company Limited | exploit exposed-secret malware meterpreter | TXT, ELF, MD, PY | 81 | 2026-10-03 |
| 94.154.43.37 Turkey · Net Gate Telecom S.R.L. | c2 tunnel | SH | 1 | 2026-10-02 |
| 172.86.94.175 United States · aurologic GmbH | c2 | COM | 3 | 2026-10-02 |
| 168.100.10.222 United States · BL Networks | c2 | COM | 3 | 2026-10-02 |
| 165.22.120.234 United Kingdom · DigitalOcean, LLC | c2 exploit exposed-secret | TXT | 1 | 2026-10-02 |
| 79.139.57.157 Hungary · Rackforest Zrt. | c2 | TXT | 1 | 2026-10-02 |
| 2.27.203.59 United States · TeraSwitch Networks Inc. | malware c2 exploit elf-binary | ELF, SH | 25 | 2026-10-02 |
| 178.16.52.154 Germany · Omegatech LTD | exposed-secret exploit malware mozi | GZ, LOG, PY, DONE | 154 | 2026-10-02 |
| 178.16.53.67 The Netherlands · Omegatech LTD | malware exposed-secret exploit webshell | PE, PS1, JSON, VBS | 154 | 2026-10-01 |
| 47.236.83.240 United States · Alibaba (US) Technology Co., Ltd. | malware exploit c2 exposed-secret | MACHO, BIN, JS, GITIGN | 65 | 2026-10-01 |
| 8.216.48.50 Singapore · Alibaba (US) Technology Co., Ltd. | exposed-secret c2 | SH, TXT, JS, LOG | 7 | 2026-10-01 |
| 62.3.58.98 Russia · TIME-HOST LTD | exposed-secret exploit malware mozi | PY, LOG, TXT, SH | 148 | 2026-09-30 |
| 124.220.164.14 China · Shenzhen Tencent Computer Systems Company Limited | malware exploit exposed-secret c2 | MACHO, TXT, JAVA, SH | 89 | 2026-09-30 |
| 37.60.248.174 France · Contabo GmbH | exploit exposed-secret webshell malware | TXT, JSON, JS, MD | 365 | 2026-09-30 |
| 194.156.117.170 Russia · Beget LLC | c2 | HTML | 1 | 2026-09-30 |
| 207.180.219.101 France · Contabo GmbH | exploit exposed-secret malware mozi | HTML, MD, PY, LOG | 34 | 2026-09-30 |
| 207.180.193.40 France · Contabo GmbH | exposed-secret exploit c2 webshell | JAR, TXT, JSON, MD | 50 | 2026-09-30 |
| 72.56.114.234 Seychelles · Timeweb, LLP | exposed-secret malware mozi exploit | PY, LOG, JSON, SH | 171 | 2026-09-30 |
| 183.101.139.124 South Korea · Korea Telecom | exposed-secret malware mozi exploit | PY, TXT, JS, MD | 95 | 2026-09-30 |
| 20.200.208.16 South Korea · Microsoft Corporation | c2 exposed-secret exploit tunnel | PY, MD, HTML, SH | 85 | 2026-09-30 |
| 159.65.0.249 Singapore · DigitalOcean, LLC | exploit exposed-secret webshell c2 | PY, MD, SH, BAT | 73 | 2026-09-30 |
| 195.154.191.187 France · Scaleway SAS | malware mozi exploit c2 | PY, CSV, MD, HTML | 17 | 2026-09-30 |
| 178.104.231.250 Germany · Hetzner Online GmbH | exploit exposed-secret c2 malware | SQL, PY, TXT, SH | 125 | 2026-09-30 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free