Live findsCVE IntelResearchConsoleStart free
huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

6,035
hosts
112,874
files
86
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 3057malware 1248exploit 1168mozi 943c2 328webshell 296ioc-match 88coinminer 72gafgyt 63tsunami 44mirai 40sliver 32meterpreter 17havoc 15

Every host we harvested files from, newest first

HostLabelsFile typesFilesLast seen
31.56.209.86
The Netherlands · SWISSNET LLC
c2 malware elf-binary tunnelELF, SH22026-10-21
89.32.46.87
Romania · Cyber_Folks SRL
exposed-secret exploit malware elf-binaryPY, TXT, HTML, DB652026-10-21
91.214.17.136
Ukraine · PollyComm LTD
exposed-secret malware mozi exploitFRM, TXT, MYD, MYI382026-10-21
151.236.29.109
Greece · SYNAPSECOM S.A. Provider of Telecommunications and Internet Services
exposed-secretENV, TXT22026-10-21
104.244.104.234
United States · Shenandoah Cable Television LLC
filesBIN12026-10-21
91.214.17.151
Ukraine · PollyComm LTD
exposed-secret malware mozi exploitFRM, TXT, MYD, MYI382026-10-21
195.201.83.167
Germany · Hetzner Online GmbH
exposed-secret exploit malware moziSH, PY, SCIENC, JSON4002026-10-21
85.215.219.126
Germany · IONOS SE
coinminer malware tunnelGZ, PY, JS, TGZ122026-10-21
212.244.203.102
Poland · Orange Polska Spolka Akcyjna
webshell exposed-secret malware c2C, SQL, IN, PL3002026-10-21
91.214.17.138
Ukraine · PollyComm LTD
exposed-secret malware mozi exploitFRM, TXT, MYD, MYI382026-10-21
81.181.166.24
Romania · DataNode DC SRL
exposed-secret exploit malware moziBIN, LOG, TXT, JSON282026-10-21
91.214.17.190
Ukraine · PollyComm LTD
exposed-secret malware mozi exploitFRM, TXT, MYD, MYI382026-10-21
80.97.51.103
Romania · Full Duplex SRL
exposed-secretDB, TXT72026-10-21
146.19.133.108
Romania · Exim Host SRL
filesHTACCE22026-10-21
95.43.220.235
Bulgaria · Vivacom Bulgaria EAD
malware c2 webshell elf-binaryGZ, C, BIN, ELF442026-10-21
141.85.224.150
Romania · Agentia de Administrare a Retelei Nationale de Informatica pentru Educatie si C
filesPEM12026-10-21
87.121.52.82
Bulgaria · Neterra Ltd.
exposed-secret malware mozi exploitGO, DB, JSON, KEY602026-10-21
176.103.62.56
Ukraine · Ivanov Vitaliy Sergeevich
malware exploit pe-binary elf-binaryBIN, ZIP, PE, ELF122026-10-21
78.130.211.168
Bulgaria · "Cooolbox" AD
exposed-secret webshellGZ, BZ2, ZIP, JAR272026-10-21
185.232.170.43
Bulgaria · FIRST SERVER LIMITED
malware coinminer elf-binarySH, GZ, ELF, JSON122026-10-21
45.84.187.47
Bulgaria · Burgasnet LTD
exposed-secretNFO, SRT32026-10-21
82.118.235.179
Bulgaria · DA International Group Ltd.
exposed-secret exploit malware moziTXT, HTML282026-10-21
159.69.66.161
Germany · Hetzner Online GmbH
exposed-secret malware mozi exploitPY, LOG, TXT, JSON7052026-10-21
93.123.85.46
Germany · dataforest GmbH
exploit exposed-secret malware gafgytJAR, ZIP, GZ, TXT2062026-10-21
188.210.220.194
Poland · DATASPACE P.S.A.
exposed-secret malware pe-binaryPHP, LOG, PE, YML92026-10-21
78.9.235.120
Poland · Netia SA
exposed-secret exploit malware elf-binaryTXT, ZIP, ELF82026-10-21
213.222.201.184
Poland · Asseco Cloud Sp. z o. o.
filesPEM, BAT132026-10-21
89.161.135.49
Poland · home.pl S.A.
exploitHTML, PHP, PY52026-10-21
87.251.64.224
Poland · ISAEV Igor
c2 exposed-secret malware exploitC, LOG, CSV, EXE82026-10-21
87.199.203.242
The Netherlands · SERVERS TECH FZCO
exposed-secret exploit tunnelSH, COMPLE, ENV, KEY3022026-10-21
92.5.117.191
SE · Oracle Svenska AB
malware mozi tunnelSH, TOML32026-10-21
195.201.25.85
Germany · Hetzner Online GmbH
exposed-secretBACKUP, ZIP22026-10-21
91.214.17.130
Ukraine · PollyComm LTD
exposed-secret malware mozi exploitFRM, TXT, MYD, MYI382026-10-21
188.245.31.251
Germany · Hetzner Online GmbH
exploit exposed-secret malware webshellSH, PY, C, ELF582026-10-21
91.236.251.38
Ukraine · IP-Connect LLC
exploit exposed-secret tunnelGZ, TXT, BIN, PUB72026-10-21
91.214.17.135
Ukraine · PollyComm LTD
exposed-secret malware mozi exploitFRM, TXT, MYD, MYI382026-10-21
178.63.68.220
Germany · Hetzner Online GmbH
exploit exposed-secret c2TXT, JSON, LOG, PY72026-10-21
91.236.251.34
Ukraine · IP-Connect LLC
exploit exposed-secret tunnelGZ, TXT, BIN, PUB72026-10-21
91.236.251.35
Ukraine · IP-Connect LLC
exploit exposed-secret tunnelGZ, TXT, BIN, PUB72026-10-21
144.76.236.71
Germany · Hetzner Online GmbH
exposed-secret exploit webshellMD, PHP122026-10-21
142.132.232.189
Germany · Hetzner Online GmbH
exposed-secretBACKUP, CONF, SH, ZIP62026-10-21
104.248.244.66
Germany · DigitalOcean, LLC
exposed-secret malware webshell moziPY, PS1, LOG, CONF492026-10-21
91.214.17.155
Ukraine · PollyComm LTD
exposed-secret malware mozi exploitFRM, TXT, MYD, MYI382026-10-21
185.193.67.26
France · Contabo GmbH
filesSORRY72026-10-21
91.214.17.154
Ukraine · PollyComm LTD
exposed-secret malware mozi exploitFRM, TXT, MYD, MYI382026-10-21
91.214.17.137
Ukraine · PollyComm LTD
exposed-secret malware mozi exploitFRM, TXT, MYD, MYI382026-10-21
51.159.105.208
France · Scaleway SAS
exploit exposed-secret c2 malwarePY, LOG, TXT, SH3342026-10-21
91.236.251.14
Ukraine · IP-Connect LLC
exploit exposed-secret tunnelGZ, TXT, BIN, PUB72026-10-21
62.210.199.73
France · Scaleway SAS
exposed-secret webshell malware exploitSH, GZ, PY, TXT172026-10-21
193.29.104.84
France · M247 Europe SRL
malware c2 exploit exposed-secretBAT, PS1, PE452026-10-21
← NewerPage 66 of 121Older →
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free