Live findsCVE IntelResearchConsoleStart free
huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

6,035
hosts
113,007
files
86
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 3057malware 1248exploit 1168mozi 943c2 328webshell 296ioc-match 88coinminer 72gafgyt 63tsunami 44mirai 40sliver 32meterpreter 17havoc 15

Every host we harvested files from, newest first

HostLabelsFile typesFilesLast seen
16.15.213.52
United States · Amazon.com, Inc.
filesHTML12026-10-19
16.15.173.216
United States · Amazon.com, Inc.
filesHTML12026-10-19
16.15.238.99
United States · Amazon.com, Inc.
filesHTML12026-10-19
16.15.207.247
United States · Amazon.com, Inc.
filesHTML12026-10-19
16.15.183.218
United States · Amazon.com, Inc.
filesHTML12026-10-19
16.15.183.147
United States · Amazon.com, Inc.
filesHTML12026-10-19
209.99.186.104
Switzerland · SKN Subnet & Telecom Ltd
exposed-secretCOM, TXT42026-10-19
65.20.107.61
Spain · The Constant Company, LLC
malware pe-binaryPE12026-10-19
122.188.44.139
China · CHINA UNICOM China169 Backbone
filesTXT12026-10-19
116.153.42.50
China · CHINA UNICOM China169 Backbone
filesTXT12026-10-19
101.72.248.60
China · CHINA UNICOM China169 Backbone
filesTXT12026-10-19
16.15.183.225
United States · Amazon.com, Inc.
filesHTML12026-10-19
16.15.207.153
United States · Amazon.com, Inc.
filesHTML12026-10-19
192.178.202.102
United States · Google LLC
c2TXT72026-10-19
192.178.202.100
United States · Google LLC
c2TXT72026-10-19
192.178.202.101
United States · Google LLC
c2TXT72026-10-19
103.163.47.98
China · Cloud Computing Corporation
exposed-secretTXT, ENV72026-10-19
8.234.120.254
India · Google LLC
exposed-secret exploitTXT, ENV32026-10-19
191.40.41.246
Hong Kong · Eons Data Communications Limited
exposed-secretTXT12026-10-19
177.4.12.11
Hong Kong · Hong Kong Communications International Co., Limited
exploit malware coinminer exposed-secretPY, YAML, TXT, ZIP252026-10-19
120.28.194.92
Philippines · Globe Telecom Inc.
malware mozi elf-binaryA12026-10-19
209.141.43.95
United States · FranTech Solutions
exploit c2 exposed-secret webshellPHP, ELF, SH, ZIP692026-10-19
3.136.126.149
United States · Amazon.com, Inc.
filesPHP12026-10-19
185.157.161.93
Sweden · Obehosting AB
exploit c2 exposed-secret webshellPY, SH, JS, JSON5032026-10-19
44.206.141.94
United States · Amazon.com, Inc.
exposed-secretTXT12026-10-19
47.83.16.171
United States · Alibaba (US) Technology Co., Ltd.
exposed-secretTXT22026-10-19
177.240.17.178
Mexico · Mega Cable, S.A. de C.V.
filesBIN12026-10-19
177.229.198.158
Mexico · Mega Cable, S.A. de C.V.
exposed-secretTXT12026-10-19
45.142.143.235
Finland · Materialism s.r.l.
exposed-secret malware mozi exploitPY, SQL, GZ, SH6432026-10-19
188.120.247.225
Russia · JSC IOT
exploit exposed-secret c2 malwarePHP, TXT2,9652026-10-19
195.178.110.204
AD · TECHOFF SRV LIMITED
filesTXT12026-10-19
45.81.33.16
Russia · Delta Ltd
exposed-secretTXT12026-10-19
168.138.13.221
Australia · Oracle Corporation
exposed-secret malware mozi exploitSH, BAT, LOG, TXT202026-10-19
81.71.153.119
China · Shenzhen Tencent Computer Systems Company Limited
exposed-secret forced-lootTXT12026-10-19
38.76.223.35
United States · cognetcloud INC
exposed-secret webshellBIN, JSON, PHP, TXT42026-10-19
217.216.78.183
India · Contabo Asia Private Limited
exposed-secretTXT, ENV, JSON, PHP62026-10-19
209.50.60.40
United States · UpCloud USA Inc
exploit exposed-secret webshellLOG, PHP, TXT, ZIP42026-10-19
122.10.12.174
Hong Kong · DingFeng XinHui(HongKong) Technology Limited
exposed-secretTXT12026-10-19
122.10.10.228
Hong Kong · DingFeng XinHui(HongKong) Technology Limited
exposed-secretTXT12026-10-19
122.10.20.216
Hong Kong · DingFeng XinHui(HongKong) Technology Limited
exposed-secretTXT12026-10-19
193.123.81.25
United Arab Emirates · Oracle Corporation
exposed-secret malware elf-binary tunnelLOG, PY, JSON, ELF162026-10-19
94.237.73.153
Singapore · UpCloud Ltd
exploit exposed-secret malware gafgytJAR, ZIP, GZ, TXT1912026-10-19
77.236.89.203
Russia · Ltd. "SPA"Impulse"
exposed-secret malware mozi pe-binaryBZ2, ZIP, PE, KEY1012026-10-19
144.172.88.115
LU · FranTech Solutions
exposed-secretOVPN, LOG, SH52026-10-19
8.138.166.206
Singapore · Hangzhou Alibaba Advertising Co.,Ltd.
exposed-secret exploit malware c2PY, TXT, XML, LOG932026-10-19
47.76.239.114
United States · Alibaba (US) Technology Co., Ltd.
malware coinminer exposed-secret exploitPE, BIN, PEM, CMD252026-10-19
8.138.46.135
Singapore · Hangzhou Alibaba Advertising Co.,Ltd.
forced-lootRAR22026-10-19
47.52.70.58
United States · Alibaba (US) Technology Co., Ltd.
exploit exposed-secret malware moziPY, JS, MD, BAT132026-10-19
89.161.143.90
Poland · home.pl S.A.
webshellBAK, SUSPEC22026-10-19
146.103.123.60
The Netherlands · SERVERS TECH FZCO
exposed-secret exploit malware moziLOG, PY, KEY, TXT1092026-10-19
← NewerPage 70 of 121Older →
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free