huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
6,035
hosts
113,007
files
86
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Every host we harvested files from, newest first
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 3.92.228.247 United States · Amazon.com, Inc. | webshell exploit exposed-secret | PHP, TXT | 12 | 2026-10-21 |
| 209.38.170.181 United Kingdom · DigitalOcean, LLC | tunnel | TWIG, JS, SQL | 4 | 2026-10-21 |
| 37.9.62.28 United Kingdom · UK Dedicated Servers Limited | exposed-secret exploit | TXT | 2 | 2026-10-21 |
| 2.26.51.20 Germany · PLAY2GO INTERNATIONAL LIMITED | exposed-secret exploit webshell tunnel | MD, PS1, SH, PY | 55 | 2026-10-21 |
| 2.27.23.151 Sweden · PLAY2GO INTERNATIONAL LIMITED | exploit malware mozi | LOG, BIN | 5 | 2026-10-21 |
| 213.199.60.64 France · Contabo GmbH | exposed-secret | TXT | 1 | 2026-10-21 |
| 188.166.148.204 GB · DigitalOcean, LLC | c2 exposed-secret tunnel | LOG, PY, SH, YML | 12 | 2026-10-21 |
| 5.135.162.62 France · OVH SAS | files | LOG | 1 | 2026-10-21 |
| 88.99.208.237 Germany · Hetzner Online GmbH | exploit exposed-secret malware gafgyt | JAR, ZIP, GZ, TXT | 206 | 2026-10-21 |
| 70.39.95.67 United States · Sharktech | exploit exposed-secret | TXT | 1 | 2026-10-21 |
| 54.206.226.205 Australia · Amazon.com, Inc. | tunnel | LOG, SH, TOML | 9 | 2026-10-21 |
| 8.209.81.88 Singapore · Alibaba (US) Technology Co., Ltd. | files | JSON, ZIP, LUA | 28 | 2026-10-21 |
| 16.171.12.83 Sweden · Amazon.com, Inc. | malware exploit c2 meterpreter | PS1, PE, B64, VBS | 19 | 2026-10-21 |
| 82.117.243.163 The Netherlands · Scalaxy B.V. | exploit exposed-secret | GROUP | 1 | 2026-10-21 |
| 172.67.205.61 United States · Cloudflare, Inc. | exploit exposed-secret | GROUP | 1 | 2026-10-21 |
| 132.243.221.136 The Netherlands · QWINS LTD | exploit exposed-secret | GROUP | 1 | 2026-10-21 |
| 104.21.52.233 United States · Cloudflare, Inc. | exploit exposed-secret | GROUP | 1 | 2026-10-21 |
| 175.100.42.26 Cambodia · VIETTEL (CAMBODIA) PTE., LTD | c2 malware mozi tunnel | SH | 1 | 2026-10-21 |
| 14.241.33.188 Vietnam · VNPT Corp | files | BIN | 1 | 2026-10-21 |
| 27.147.137.114 Bangladesh · Link3 Technologies Limited | files | BIN | 1 | 2026-10-21 |
| 23.141.116.9 Vietnam · MINIUM NET LLC | exposed-secret | TXT | 1 | 2026-10-21 |
| 202.51.215.250 Indonesia · PT Jala Lintas Media | exposed-secret exploit | TXT | 4 | 2026-10-21 |
| 44.210.204.142 United States · Amazon.com, Inc. | exposed-secret | TXT | 1 | 2026-10-21 |
| 153.80.245.186 Russia · AdminVPS LLC | exposed-secret | TXT | 2 | 2026-10-21 |
| 109.195.60.152 Russia · JSC "ER-Telecom Holding" | exposed-secret | TXT | 1 | 2026-10-21 |
| 109.195.60.249 Russia · JSC "ER-Telecom Holding" | exposed-secret | TXT | 1 | 2026-10-21 |
| 170.78.211.67 Mexico · Wantelco SAS de CV | exposed-secret | TXT | 1 | 2026-10-21 |
| 153.52.111.73 Germany | exposed-secret | TXT | 1 | 2026-10-21 |
| 122.155.170.121 Thailand · National Telecom Public Company Limited | files | PHP | 1 | 2026-10-21 |
| 111.223.247.165 South Korea · BGP Network Limited | exposed-secret malware mozi exploit | PY, TXT, PEM, LOG | 31 | 2026-10-20 |
| 66.223.49.89 United States · Epik LLC | files | TXT | 1 | 2026-10-20 |
| 202.61.139.137 Singapore · CTG Server Limited | exposed-secret exploit malware mozi | PY, LOG, SH, TXT | 130 | 2026-10-20 |
| 82.158.193.146 Ukraine | exploit webshell c2 exposed-secret | JS, LOG, PY, SH | 11 | 2026-10-20 |
| 96.239.100.8 United States · Verizon Business | files | BIN | 1 | 2026-10-20 |
| 23.235.192.114 United States · InMotion Hosting, Inc. | files | PHP | 1 | 2026-10-20 |
| 119.2.51.194 Indonesia · PT Blip Integrator Provider | exposed-secret | TXT | 3 | 2026-10-20 |
| 16.5.0.151 United States | exposed-secret | TXT | 1 | 2026-10-20 |
| 108.61.75.13 United States · The Constant Company, LLC | exposed-secret | TXT | 1 | 2026-10-20 |
| 168.196.55.86 Brazil · Natel Telecom Ltda. - ME | files | JSON | 1 | 2026-10-20 |
| 52.74.54.75 Singapore · Amazon.com, Inc. | ioc-match malware pe-binary | PE | 1 | 2026-10-20 |
| 190.8.176.158 Colombia · WHG Hosting Services Ltd | files | CO | 1 | 2026-10-20 |
| 167.88.172.3 United States · RouterHosting LLC | malware exploit webshell elf-binary | ELF, MP, XP | 9 | 2026-10-20 |
| 45.198.224.91 Seychelles · VPSVAULT.HOST LTD | malware c2 elf-binary | ELF, SH | 14 | 2026-10-20 |
| 154.222.20.9 Seychelles · cognetcloud INC | files | CAM | 1 | 2026-10-20 |
| 177.3.47.3 United States · Hong Kong Communications International Co., Limited | files | DEV | 1 | 2026-10-20 |
| 149.88.89.180 Hong Kong · FASTNET DATA INC | tunnel | COM | 1 | 2026-10-20 |
| 190.102.43.10 Brazil · Servicos de Infraestrutura e Datacenter | files | TXT | 1 | 2026-10-20 |
| 172.67.72.49 United States · Cloudflare, Inc. | c2 exposed-secret | COM | 1 | 2026-10-20 |
| 104.26.14.226 United States · Cloudflare, Inc. | c2 exposed-secret | COM | 1 | 2026-10-20 |
| 104.26.15.226 United States · Cloudflare, Inc. | c2 exposed-secret | COM | 1 | 2026-10-20 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free