huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,966
hosts
106,473
files
101
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled c2
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 169.58.33.122 United States · TerraTransit AG | c2 exposed-secret | TXT | 1 | 2026-09-30 |
| 131.123.43.239 United States | exposed-secret exploit c2 tunnel | SH, PY, TXT, JSP | 104 | 2026-09-29 |
| 104.192.2.46 United States · DataWagon LLC | c2 | 1 | 2026-09-28 | |
| 104.219.237.146 United States · DataWagon LLC | c2 | 1 | 2026-09-28 | |
| 104.219.238.66 United States · DataWagon LLC | c2 | 1 | 2026-09-28 | |
| 193.143.1.35 Russia · Proton66 OOO | exploit exposed-secret c2 tunnel | CSV, PY | 57 | 2026-09-27 |
| 23.252.123.134 United States · WebNX, Inc. | exposed-secret malware c2 mozi | BIN, SH, ZIP, PY | 72 | 2026-09-27 |
| 68.65.122.208 United States · Namecheap, Inc. | c2 exploit exposed-secret | SITE | 1 | 2026-09-27 |
| 51.159.21.191 France · Scaleway SAS | exposed-secret malware c2 exploit | PHP, PS1, EXE, PY | 286 | 2026-09-26 |
| 149.137.136.16 United States · Backblaze Inc | c2 exposed-secret | COM | 1 | 2026-09-26 |
| 217.217.233.97 China · TeraSwitch Networks Inc. | malware coinminer webshell c2 | SH, GZ, ELF, PS1 | 18 | 2026-09-26 |
| 45.13.239.249 Germany · Florian Kolb | exposed-secret malware c2 adaptix | JSON, TXT, BIN, EXE | 141 | 2026-09-26 |
| 138.197.174.121 Canada · DigitalOcean, LLC | coinminer malware exposed-secret c2 | GZ, SH, JS | 9 | 2026-09-22 |
| 66.179.31.191 United States · BL Networks | exposed-secret exploit malware mozi | PY, HTML, SH, TXT | 60 | 2026-09-15 |
← NewerPage 7 of 7
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free