huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,966
hosts
106,473
files
101
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled webshell
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 178.16.53.67 The Netherlands · Omegatech LTD | malware exposed-secret exploit webshell | PE, PS1, JSON, VBS | 154 | 2026-10-01 |
| 62.3.58.98 Russia · TIME-HOST LTD | exposed-secret exploit malware mozi | PY, LOG, TXT, SH | 148 | 2026-09-30 |
| 218.3.160.34 China · Chinanet | exposed-secret malware exploit mozi | PHP, BAT, B64, PS1 | 88 | 2026-09-30 |
| 124.220.164.14 China · Shenzhen Tencent Computer Systems Company Limited | malware exploit exposed-secret c2 | MACHO, TXT, JAVA, SH | 89 | 2026-09-30 |
| 190.84.232.232 Colombia · Telmex Colombia S.A. | coinminer malware exposed-secret webshell | K4MIL4, CMD, PHP, D34D | 28 | 2026-09-30 |
| 185.148.144.99 Bulgaria · Belcloud LTD | exposed-secret exploit malware mozi | PHP, JS, TXT, PY | 306 | 2026-09-30 |
| 46.233.50.11 Bulgaria · Point To Point Ltd. | exposed-secret exploit webshell malware | LOG, TXT, GZ, BIN | 49 | 2026-09-30 |
| 45.146.165.38 Russia · Beget LLC | malware mozi exploit webshell | PY, LOG, JSON, CSV | 46 | 2026-09-30 |
| 37.60.248.174 France · Contabo GmbH | exploit exposed-secret webshell malware | TXT, JSON, JS, MD | 365 | 2026-09-30 |
| 43.129.51.137 Indonesia · Shenzhen Tencent Computer Systems Company Limited | exposed-secret malware gafgyt exploit | PY, MD, LOG, JSON | 115 | 2026-09-30 |
| 203.195.205.151 China · Shenzhen Tencent Computer Systems Company Limited | webshell | C, TXT, ZIP | 3 | 2026-09-30 |
| 170.106.98.130 United States · Shenzhen Tencent Computer Systems Company Limited | exposed-secret exploit webshell tunnel | MD, SAMPLE, PY, TXT | 54 | 2026-09-30 |
| 138.197.72.235 United States · DigitalOcean, LLC | webshell | PY | 1 | 2026-09-30 |
| 46.225.118.210 Germany · Hetzner Online GmbH | exposed-secret exploit malware mozi | PY, JSON, LOG, BAK | 45 | 2026-09-30 |
| 61.185.204.20 China · Chinanet | exploit exposed-secret webshell forced-loot | YAML, LOG, PY, TXT | 104 | 2026-09-30 |
| 81.70.21.248 China · Shenzhen Tencent Computer Systems Company Limited | exploit malware exposed-secret webshell | TXT, PY, GITIGN, IN | 28 | 2026-09-30 |
| 207.180.193.40 France · Contabo GmbH | exposed-secret exploit c2 webshell | JAR, TXT, JSON, MD | 50 | 2026-09-30 |
| 118.25.25.81 China · Shenzhen Tencent Computer Systems Company Limited | exposed-secret exploit malware gafgyt | PY, MD, LOG, SH | 107 | 2026-09-30 |
| 84.32.34.6 The Netherlands · UAB Cherry Servers | malware exposed-secret mozi exploit | PY, GZ, TXT, BAK | 55 | 2026-09-30 |
| 65.21.188.160 Finland · Hetzner Online GmbH | exposed-secret exploit malware mozi | PHP, MD, SH, TXT | 57 | 2026-09-30 |
| 52.79.37.201 South Korea · Amazon.com, Inc. | exploit exposed-secret webshell tunnel | PY, CONFIG, MD, GITIGN | 86 | 2026-09-30 |
| 111.229.24.188 China · Shenzhen Tencent Computer Systems Company Limited | exposed-secret webshell | LOG, PY, JS | 7 | 2026-09-30 |
| 137.184.118.119 United States · DigitalOcean, LLC | exposed-secret exploit webshell tunnel | PY, TXT, SH, GITIGN | 34 | 2026-09-30 |
| 54.188.137.221 United States · Amazon.com, Inc. | exploit exposed-secret webshell tunnel | PY, CONFIG, MD, GITIGN | 87 | 2026-09-30 |
| 159.65.0.249 Singapore · DigitalOcean, LLC | exploit exposed-secret webshell c2 | PY, MD, SH, BAT | 73 | 2026-09-30 |
| 95.179.150.206 The Netherlands · The Constant Company, LLC | exposed-secret exploit webshell tunnel | PY, SH, TXT, MD | 78 | 2026-09-30 |
| 32.236.62.30 Australia · Amazon.com, Inc. | malware mozi webshell exposed-secret | JSP, JS | 11 | 2026-09-30 |
| 207.57.188.152 United States · Zillion Network Inc. | malware mozi exploit exposed-secret | PY, GO, ELF, PYC | 9 | 2026-09-30 |
| 193.233.216.44 Russia · Aeza Group LLC | exposed-secret exploit webshell | TXT, GZ, PUB, XZ | 13 | 2026-09-27 |
| 51.159.21.191 France · Scaleway SAS | exposed-secret malware c2 exploit | PHP, PS1, EXE, PY | 286 | 2026-09-26 |
| 217.217.233.97 China · TeraSwitch Networks Inc. | malware coinminer webshell c2 | SH, GZ, ELF, PS1 | 18 | 2026-09-26 |
| 66.179.31.191 United States · BL Networks | exposed-secret exploit malware mozi | PY, HTML, SH, TXT | 60 | 2026-09-15 |
← NewerPage 6 of 6
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free