huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
6,035
hosts
113,007
files
86
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Every host we harvested files from, newest first
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 79.142.194.35 Ukraine · Infomir LLC | coinminer malware | GZ | 1 | 2026-10-21 |
| 62.210.255.5 France · Scaleway SAS | malware mozi exploit | GZ, LOG, JS, TXT | 54 | 2026-10-21 |
| 176.105.214.112 Ukraine · RPC HomeNet Ltd. | malware pe-binary | PE, ZIP | 5 | 2026-10-21 |
| 51.159.53.7 France · Scaleway SAS | exposed-secret c2 malware pe-binary | LOG, CUE, PE, PY | 33 | 2026-10-21 |
| 178.215.250.94 Ukraine · TeleRadioCompany GOK LTD | malware mozi | PHP | 2 | 2026-10-21 |
| 134.249.131.123 Ukraine · "Kyivstar" PJSC | exposed-secret | BIN, TXT | 3 | 2026-10-21 |
| 15.188.163.78 France · Amazon.com, Inc. | exposed-secret exploit malware mozi | LOG, SH, TXT, PY | 378 | 2026-10-21 |
| 97.68.27.90 United States · Charter Communications, Inc | exposed-secret | PHP, TXT | 2 | 2026-10-21 |
| 157.245.140.34 United States · DigitalOcean, LLC | exposed-secret malware mozi exploit | PY, LOG, SH, JSON | 1,680 | 2026-10-21 |
| 47.104.97.238 China · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret | TXT | 2 | 2026-10-21 |
| 151.243.11.242 Germany · LLC VASH KREDIT BANK | exploit | LOG, TXT | 2 | 2026-10-21 |
| 107.173.201.172 United States · HostPapa | exposed-secret | TXT | 1 | 2026-10-21 |
| 116.63.131.238 China · China Unicom IP network | exposed-secret malware mozi | TXT | 2 | 2026-10-21 |
| 23.43.75.170 United States · Akamai Technologies, Inc. | files | TXT | 1 | 2026-10-21 |
| 151.243.11.241 Germany · LLC VASH KREDIT BANK | exploit c2 exposed-secret malware | PY, MD, LOG, TXT | 439 | 2026-10-21 |
| 112.166.33.242 South Korea · Korea Telecom | exposed-secret | TXT | 1 | 2026-10-21 |
| 208.98.38.223 United States · Sharktech | exploit exposed-secret | TXT | 1 | 2026-10-21 |
| 192.250.227.149 United States · WHG Hosting Services Ltd | files | PHP | 1 | 2026-10-21 |
| 37.77.150.177 Russia · Proton66 OOO | files | INFO | 2 | 2026-10-21 |
| 177.93.1.139 CR · Telecable Economico S.A. | exposed-secret | TXT, ENV, JSON, PHP | 9 | 2026-10-21 |
| 185.100.55.159 Uzbekistan · "Uzbektelekom" Joint Stock Company | exposed-secret | TXT, ENV, JSON, PHP | 5 | 2026-10-21 |
| 178.218.207.153 Uzbekistan · Turon Media XK | exposed-secret | TXT, ENV, JSON, PHP | 5 | 2026-10-21 |
| 142.93.57.244 United States · DigitalOcean, LLC | exposed-secret exploit malware c2 | TXT, JSON, JS, BODY | 217 | 2026-10-21 |
| 2.24.204.250 United States · Hostinger International Limited | exposed-secret exploit malware mozi | GZ, DB, MD, JSON | 136 | 2026-10-21 |
| 13.229.73.36 Singapore · Amazon.com, Inc. | exploit exposed-secret malware mozi | APK, LOG, HTML, TXT | 48 | 2026-10-21 |
| 89.116.31.49 France · Contabo GmbH | exposed-secret | TXT | 2 | 2026-10-21 |
| 62.238.122.155 The Netherlands · Hetzner Online GmbH | exploit exposed-secret malware mozi | ZIP, TXT, YAML, JSON | 16 | 2026-10-21 |
| 43.167.171.106 Singapore · Shenzhen Tencent Computer Systems Company Limited | exploit malware macho-binary tunnel | JAVA, MACHO | 2 | 2026-10-21 |
| 64.111.92.149 United States · BL Networks | exposed-secret exploit malware mozi | PY, YAML, TXT, MD | 108 | 2026-10-21 |
| 23.81.35.61 United Kingdom · LEASEWEB UK LIMITED | exposed-secret exploit c2 malware | PY, BAK, GZ, SH | 748 | 2026-10-21 |
| 8.215.31.102 Singapore · Alibaba (US) Technology Co., Ltd. | gafgyt malware | ZIP | 55 | 2026-10-21 |
| 8.217.24.92 Hong Kong · Alibaba (US) Technology Co., Ltd. | exposed-secret malware mozi webshell | PY, HTM, SH, JS | 649 | 2026-10-21 |
| 176.104.108.18 Serbia · NINET Company Nis d.o.o. | malware mozi exploit exposed-secret | PE, PS1, HTML, BIN | 17 | 2026-10-21 |
| 198.23.209.17 United States · HostPapa | malware webshell exploit exposed-secret | ELF, TXT, SH, MACHO | 135 | 2026-10-21 |
| 157.230.117.70 Germany · DigitalOcean, LLC | exploit exposed-secret malware mozi | PY, MD, JSON, CFG | 79 | 2026-10-21 |
| 18.220.4.102 United States · Amazon.com, Inc. | malware pe-binary | PE, ZIP | 3 | 2026-10-21 |
| 147.139.136.66 United States · Alibaba (US) Technology Co., Ltd. | gafgyt malware | ZIP | 55 | 2026-10-21 |
| 148.116.90.65 Canada · Oracle Corporation | exposed-secret malware mozi exploit | LOG, PY, PYC, BAK | 29 | 2026-10-21 |
| 208.85.17.99 Spain · The Constant Company, LLC | malware elf-binary | ELF | 1 | 2026-10-21 |
| 167.233.243.9 Germany · Hetzner Online GmbH | exposed-secret exploit c2 malware | SH, PY, JSON, RS | 105 | 2026-10-21 |
| 198.55.116.60 United States · HostPapa | exposed-secret exploit tunnel | PY, SH, SQL, EXAMPL | 11 | 2026-10-21 |
| 202.65.11.59 Bangladesh · MGH INFOTECH LTD. | exposed-secret exploit malware mozi | MD, JS, JSON, PY | 27 | 2026-10-21 |
| 198.44.38.209 United States · HostPapa | malware exploit exposed-secret macho-binary | MACHO, JAVA, PY, TOML | 134 | 2026-10-21 |
| 108.61.219.168 United States · The Constant Company, LLC | exposed-secret | TXT | 2 | 2026-10-21 |
| 139.162.230.213 United Kingdom · Akamai Technologies, Inc. | exposed-secret malware mozi exploit | PHP, HTML, JS, TXT | 22 | 2026-10-21 |
| 5.39.254.211 United Kingdom · Baxet Group Inc. | malware exposed-secret coinminer elf-binary | SH, ELF, LOG, TGZ | 9 | 2026-10-21 |
| 45.152.65.157 Hong Kong · LUCIDACLOUD LIMITED | tunnel | SHA256, SH, JSON | 9 | 2026-10-21 |
| 167.71.128.202 United Kingdom · DigitalOcean, LLC | exploit exposed-secret webshell tunnel | PY, GZ, SH, LOG | 210 | 2026-10-21 |
| 104.131.123.117 United States · DigitalOcean, LLC | exposed-secret malware mozi | JS, KEY, LOG, ZIP | 4 | 2026-10-21 |
| 52.90.1.165 United States · Amazon.com, Inc. | exposed-secret webshell malware exploit | SH, TXT, ELF, KEY | 29 | 2026-10-21 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free