Live findsCVE IntelResearchConsoleStart free
huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

5,966
hosts
106,473
files
101
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 2996malware 1225exploit 1134mozi 922c2 314webshell 282ioc-match 88coinminer 66gafgyt 56tsunami 41mirai 38sliver 31meterpreter 16havoc 15

Hosts labelled malware

HostLabelsFile typesFilesLast seen
217.154.101.100
Spain · IONOS SE
exploit c2 exposed-secret malwareHTML, JS, TXT52026-10-29
143.246.203.114
United States
exploit exposed-secret malware moziLOG, MD, PY, RB852026-10-29
202.61.73.177
Brazil · Evoxt Sdn. Bhd.
malware exposed-secret pe-binary tunnelPE, BIN, PS1, TXT232026-10-29
141.98.10.25
Lithuania · UAB Host Baltic
malware elf-binaryELF22026-10-28
91.224.92.16
United Kingdom · UAB Host Baltic
exposed-secret malware c2 exploitSH, TXT, ELF, JAVA622026-10-28
103.252.72.150
Vietnam · VIETNAM POSTS AND TELECOMMUNICATIONS GROUP
coinminer malware elf-binary tunnelLOG, ELF, GZ, PY62026-10-28
147.45.133.66
The Netherlands · Timeweb, LLP
malware moziGZ, TAR52026-10-28
5.78.205.230
United States · Hetzner Online GmbH
exposed-secret exploit malware webshellPY, SAMPLE, TXT, LOG662026-10-28
218.1.211.104
China · China Telecom (Group)
malware mozi elf-binaryA12026-10-28
85.190.115.121
The Netherlands · dogado GmbH
malware elf-binaryELF, GZ122026-10-28
114.132.61.189
China · Shenzhen Tencent Computer Systems Company Limited
exposed-secret malware exploit moziLOG, PY, SH, DB392026-10-28
101.43.25.15
China · Shenzhen Tencent Computer Systems Company Limited
exposed-secret malware mozi exploitJSON, JS, HTML, TXT352026-10-28
54.158.237.206
United States · Amazon.com, Inc.
exposed-secret exploit malware moziLOG, JS, ZIP, SH1602026-10-28
157.180.71.22
Finland · Hetzner Online GmbH
exposed-secret malware coinminer tunnelSH, SQL, TXT, ELF282026-10-28
54.215.75.164
United States · Amazon.com, Inc.
coinminer exploit exposed-secret malwareZIP12026-10-28
52.9.172.225
United States · Amazon.com, Inc.
coinminer exploit exposed-secret malwareZIP12026-10-28
187.188.165.243
Mexico · TOTAL PLAY TELECOMUNICACIONES SA DE CV
malware mozi webshell exposed-secretPHP, JS, LIB, SWF3632026-10-28
178.218.42.34
Russia · ATEXS PLUS Ltd.
malware pe-binaryRAR, ZIP, DB, PE972026-10-28
176.126.36.87
Russia · Sigma-Soft Ltd
malware pe-binaryPE22026-10-28
167.17.69.200
Canada · GTHost
exploit webshell exposed-secret malwarePY, PHP, ELF, SH272026-10-28
114.67.182.214
China · CHINANET Guangdong province network
exposed-secret malware pe-binary tunnelHTML, PE, MD, ZIP82026-10-27
23.19.231.52
United States · Leaseweb USA, Inc.
malware mozi exposed-secret exploitPY, GZ, JS, SH5772026-10-27
148.135.195.145
United States · Datacamp Limited
ioc-match malware pe-binaryBIN, PE22026-10-27
45.154.255.98
Sweden · KeFF Networks Ltd
exposed-secret malware pe-binaryGZ, BZ2, TXT, PE802026-10-27
103.179.44.239
India · WebHorizon Internet Services
malware mozi c2 exploitPY, LOG72026-10-27
191.217.250.227
United States
malware c2 coinminer exploitPHP, GZ, BIN, SH332026-10-27
13.239.40.119
Australia · Amazon.com, Inc.
exploit malware mozi exposed-secretJS, MD, JSON, EDITOR342026-10-27
167.71.19.245
United States · DigitalOcean, LLC
exposed-secret exploit malware moziGO, TXT, BAT, LOG442026-10-27
47.108.183.238
China · Hangzhou Alibaba Advertising Co.,Ltd.
malware mozi tunnelLOG, PS1, PY, TOML172026-10-27
164.90.209.4
Germany · DigitalOcean, LLC
exposed-secret webshell malware moziCFC, JS, CFM, JAR312026-10-27
178.62.64.147
United Kingdom · DigitalOcean, LLC
exposed-secret webshell malware moziCFC, JS, CFM, JAR312026-10-27
144.91.103.172
France · Contabo GmbH
exposed-secret malware tunnel elf-binaryLOG, PY, ELF, SH512026-10-27
64.227.143.203
India · DigitalOcean, LLC
exposed-secret webshell malware moziCFC, JS, CFM, JAR312026-10-27
85.190.115.218
The Netherlands · dogado GmbH
malware elf-binaryGZ, ELF62026-10-27
216.126.86.27
Canada · Frontier Networks
malware mozi elf-binaryA12026-10-27
61.53.101.67
China · CHINA UNICOM China169 Backbone
malware mozi elf-binary12026-10-27
65.20.96.115
Spain · The Constant Company, LLC
exploit malware exposed-secret webshellLOG, PY, ELF, C1752026-10-27
91.92.43.211
Germany · DEDIK SERVICES LIMITED
exposed-secret exploit malware moziPY, HTML, SH, JS7032026-10-27
51.81.244.207
United States · OVH SAS
exploit malware coinminer exposed-secretLOG, PY, SH, ELF312026-10-27
45.77.131.98
Japan · The Constant Company, LLC
malware mozi webshell exposed-secretJSON, LOG, SH, PY3112026-10-27
209.99.190.118
Switzerland · SKN Subnet & Telecom Ltd
malware adaptix exposed-secret exploitELF, LOG, PY, TGZ982026-10-27
108.61.161.224
Japan · The Constant Company, LLC
exposed-secret exploit malware moziSH, HTML, LOG, PY1972026-10-26
89.108.76.200
Russia · "Domain names registrar REG.RU", Ltd
coinminer malware exploit tunnelJSON, PY, BIN, TXT92026-10-26
91.92.241.101
The Netherlands · Omegatech LTD
exposed-secret exploit malware moziMETA, BODY, PY, TXT3322026-10-26
23.225.71.207
United States · CNSERVERS LLC
exposed-secret exploit webshell malwareTXT, PY, DOCX, LOG852026-10-26
16.16.63.239
Sweden · Amazon.com, Inc.
malware c2 ioc-match moziPS1, PE, BIN, CPL122026-10-26
42.56.35.3
China · CHINA UNICOM China169 Backbone
malware mozi elf-binaryELF12026-10-26
52.128.241.77
Hong Kong · Netsec Limited
malware mozi c2 exposed-secretPY, PS1, PE, GO2572026-10-26
198.204.230.122
United States · Nocix, LLC
malware elf-binaryELF, LOG22026-10-26
45.115.26.30
Vietnam · Contrust Solutions S.R.L.
exposed-secret exploit malware moziLOG, PY, SH, TXT1,3952026-10-26
← NewerPage 7 of 25Older →
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free