huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,966
hosts
106,473
files
101
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled malware
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 38.60.212.186 JP · Cogent Communications, LLC | exposed-secret malware mozi tunnel | PS1, SH, PY, PYC | 47 | 2026-11-02 |
| 156.239.47.147 United States · AROSSCLOUD INC. | exploit malware mozi c2 | LOG, JSON, PY, JS | 33 | 2026-11-02 |
| 45.156.87.230 The Netherlands · TechTies Inc. | exploit webshell exposed-secret malware | HTML, PHP, PY, TXT | 4 | 2026-11-02 |
| 104.233.217.108 United States · PEG TECH INC | exposed-secret exploit malware mozi | PY, TXT, JS, JSON | 699 | 2026-11-02 |
| 103.117.136.137 Hong Kong · cognetcloud INC | exposed-secret exploit malware mozi | PY, TGZ, SH, JS | 637 | 2026-11-01 |
| 176.123.7.7 Moldova · ALEXHOST SRL | malware c2 exposed-secret elf-binary | ELF, TXT | 19 | 2026-11-01 |
| 49.51.187.59 United States · Shenzhen Tencent Computer Systems Company Limited | malware exploit exposed-secret mozi | ELF, LOG, B64, DTD | 160 | 2026-11-01 |
| 85.137.54.178 The Netherlands · SOLLUTIUM EU Sp z.o.o. | malware elf-binary | ELF, LOG | 6 | 2026-11-01 |
| 37.187.152.46 France · OVH SAS | exposed-secret malware elf-binary tunnel | ELF, LOG | 2 | 2026-11-01 |
| 95.111.226.157 France · Contabo GmbH | exposed-secret exploit malware macho-binary | SH, JAVA, MACHO, TXT | 49 | 2026-11-01 |
| 148.113.3.32 Canada · OVH SAS | exploit malware macho-binary | LOG, TXT, JAVA, MACHO | 10 | 2026-11-01 |
| 178.95.25.224 Ukraine · The Constant Company, LLC | exposed-secret malware mozi webshell | SH, JS, TXT, LOG | 697 | 2026-11-01 |
| 77.239.124.170 The Netherlands · Alfahost LLC | malware elf-binary | ELF | 5 | 2026-11-01 |
| 31.56.228.126 France · CGI GLOBAL LIMITED | exposed-secret exploit malware mozi | PY, LOG, TXT, HTML | 62 | 2026-11-01 |
| 185.125.24.7 Switzerland · Infomaniak Network SA | exploit exposed-secret malware mozi | XZ, BUILDI, BUILD, CHANGE | 146 | 2026-11-01 |
| 104.200.73.97 United States · GWY IT PTY LTD | exposed-secret exploit malware webshell | PY, ELF, C, TXT | 134 | 2026-11-01 |
| 167.99.165.191 United States · DigitalOcean, LLC | malware elf-binary | DZ, ELF | 2 | 2026-10-31 |
| 185.228.168.9 United States · Daniel Cid | exposed-secret malware mozi | ENV, TXT | 2 | 2026-10-31 |
| 39.109.57.67 Hong Kong · XHKL-AS-AP - XUN HONG KONG LIMITED | exposed-secret malware exploit mozi | PY, LOG, ELF, SH | 26 | 2026-10-31 |
| 39.109.57.179 Hong Kong · XHKL-AS-AP - XUN HONG KONG LIMITED | malware exploit exposed-secret mozi | ELF, LOG, PY, SH | 9 | 2026-10-31 |
| 45.39.190.176 United States · Cloud Software - FZCO | exposed-secret exploit malware webshell | HTML, PHP, ELF, BIN | 212 | 2026-10-31 |
| 96.126.130.81 United States · Evoxt Sdn. Bhd. | malware mozi exploit webshell | EML, SH, PY, LOG | 1,568 | 2026-10-31 |
| 77.239.124.141 The Netherlands · Alfahost LLC | malware exploit exposed-secret elf-binary | ELF, TXT | 15 | 2026-10-31 |
| 203.204.192.28 Taiwan · Hoshin Multimedia Center Inc. | malware mozi elf-binary | A | 1 | 2026-10-31 |
| 8.220.87.150 Singapore · Alibaba (US) Technology Co., Ltd. | coinminer malware elf-binary tunnel | ELF, SH | 2 | 2026-10-31 |
| 45.155.19.244 Turkey · Samet Girginer | malware mozi exploit exposed-secret | JS, TS, MJS, JSON | 56 | 2026-10-31 |
| 38.60.205.58 United States · Kaopu Cloud HK Limited | exploit exposed-secret malware mozi | PY, HTML, TXT, LOG | 30 | 2026-10-31 |
| 38.97.253.252 United States · Cogent Communications | exposed-secret malware mozi webshell | JS, JSON, PO, PY | 31 | 2026-10-31 |
| 38.76.199.210 United States · cognetcloud INC | exposed-secret malware mozi tunnel | JS, JSON, HTML, PL | 22 | 2026-10-31 |
| 38.224.162.188 United States · GTHost | exposed-secret malware mozi webshell | JS, JSON, PO, PY | 31 | 2026-10-31 |
| 154.89.148.84 HK · Cloudie Limited | malware exposed-secret c2 exploit | ELF, HTML, PY, SH | 78 | 2026-10-31 |
| 38.49.210.117 Canada · Rica Web Services | exposed-secret exploit webshell c2 | JSON, GO, SH, JS | 1,165 | 2026-10-31 |
| 85.11.167.108 The Netherlands · TechTies Inc. | malware mozi exposed-secret | PY, LOG | 4 | 2026-10-30 |
| 85.11.167.6 The Netherlands · TechTies Inc. | malware mozi exposed-secret | TXT, ENV, JSON, PHP | 9 | 2026-10-30 |
| 172.67.158.135 United States · Cloudflare, Inc. | exploit exposed-secret malware mozi | CYOU | 2 | 2026-10-30 |
| 104.21.14.88 United States · Cloudflare, Inc. | exploit exposed-secret malware mozi | CYOU | 2 | 2026-10-30 |
| 31.128.39.24 Russia · Beget LLC | malware mozi exploit exposed-secret | JS, PY, SH, TXT | 455 | 2026-10-30 |
| 165.154.225.131 Singapore · Scloud Pte Ltd | exposed-secret exploit malware mozi | TXT, BIN, PY, HEADER | 842 | 2026-10-30 |
| 104.238.140.55 United States · The Constant Company, LLC | malware exposed-secret c2 exploit | PE, PS1 | 9 | 2026-10-30 |
| 64.177.33.68 United States | coinminer malware elf-binary | ELF | 1 | 2026-10-30 |
| 39.107.106.210 China · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret exploit malware mozi | PHP, LOG, SH, TXT | 421 | 2026-10-30 |
| 186.241.74.242 United States · AROSSCLOUD INC. | malware elf-binary pe-binary | ELF, PE | 5 | 2026-10-30 |
| 45.117.83.34 Vietnam · NhanHoa Software company | exposed-secret malware exploit webshell | LOG, PE, PY, JSON | 48 | 2026-10-30 |
| 39.106.140.144 China · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret exploit malware mozi | SH, ELF, LOG, PE | 31 | 2026-10-30 |
| 93.102.144.219 Portugal · NOS COMUNICACOES, S.A. | malware mozi elf-binary | ELF | 1 | 2026-10-29 |
| 46.166.162.142 Lithuania · UAB Cherry Servers | exploit malware exposed-secret webshell | LOG, SEEDS, JS, TXT | 1,393 | 2026-10-29 |
| 153.75.81.83 United Arab Emirates · RouterHosting LLC | exploit exposed-secret malware c2 | PY, TXT, LOG, ELF | 91 | 2026-10-29 |
| 38.134.189.93 Singapore · Ultahost, Inc. | malware c2 exposed-secret meterpreter | ELF, MD, TXT | 3 | 2026-10-29 |
| 209.99.184.246 Switzerland · SKN Subnet & Telecom Ltd | exploit exposed-secret c2 webshell | TXT, MD, PY, JSON | 866 | 2026-10-29 |
| 141.147.70.247 United Kingdom · Oracle Corporation | exposed-secret exploit malware mozi | JSON, TS, JS, MD | 162 | 2026-10-29 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free