huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
6,063
hosts
115,929
files
114
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Every host we harvested files from, newest first
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 16.15.246.118 United States · Amazon.com, Inc. | files | HTML | 1 | 2026-10-16 |
| 16.15.247.18 United States · Amazon.com, Inc. | files | HTML | 1 | 2026-10-16 |
| 16.15.199.125 United States · Amazon.com, Inc. | files | HTML | 1 | 2026-10-16 |
| 16.15.164.43 United States · Amazon.com, Inc. | files | HTML | 1 | 2026-10-16 |
| 16.15.163.111 United States · Amazon.com, Inc. | files | HTML | 1 | 2026-10-16 |
| 38.137.248.35 Ukraine · Lekol LLC | malware mozi elf-binary | 1 | 2026-10-16 | |
| 129.121.62.230 United States · Oracle Corporation | files | BIN | 2 | 2026-10-16 |
| 103.185.249.13 Hong Kong · cognetcloud INC | files | 1 | 2026-10-16 | |
| 45.152.149.39 United States · 1337 Services GmbH | exposed-secret | ENV | 1 | 2026-10-16 |
| 152.32.154.231 Indonesia · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED | exposed-secret | TXT | 3 | 2026-10-16 |
| 8.243.73.163 United States · Level 3 Communications, Inc. | files | BIN | 1 | 2026-10-16 |
| 5.39.10.252 France · OVH SAS | exposed-secret | TXT | 1 | 2026-10-16 |
| 16.15.213.114 United States · Amazon.com, Inc. | files | HTML | 1 | 2026-10-16 |
| 16.15.207.30 United States · Amazon.com, Inc. | files | HTML | 1 | 2026-10-16 |
| 16.15.228.11 United States · Amazon.com, Inc. | files | HTML | 1 | 2026-10-16 |
| 192.178.203.101 United States · Google LLC | c2 | TXT | 1 | 2026-10-16 |
| 192.178.203.100 United States · Google LLC | c2 | TXT | 1 | 2026-10-16 |
| 192.178.203.102 United States · Google LLC | c2 | TXT | 1 | 2026-10-16 |
| 194.233.72.68 Singapore · Contabo Asia Private Limited | exploit exposed-secret malware webshell | PY, TXT, PHP, MD | 285 | 2026-10-16 |
| 182.253.221.146 Indonesia · BIZNET | exposed-secret malware mirai | CSV | 22 | 2026-10-16 |
| 134.122.170.22 Japan · CTG Server Limited | files | COM | 1 | 2026-10-16 |
| 109.111.45.108 United States · ULTRA ONE | files | TXT | 1 | 2026-10-16 |
| 16.15.229.224 United States · Amazon.com, Inc. | files | HTML | 1 | 2026-10-16 |
| 16.15.236.59 United States · Amazon.com, Inc. | files | HTML | 1 | 2026-10-16 |
| 16.15.213.0 United States · Amazon.com, Inc. | files | HTML | 1 | 2026-10-16 |
| 103.118.42.120 Hong Kong · CoreNET Inc. | files | 1 | 2026-10-16 | |
| 168.220.248.106 India · WEBYNE DATA CENTRE PRIVATE LIMITED | exploit malware mozi | SH | 1 | 2026-10-16 |
| 156.234.225.68 Seychelles · YANCY LIMITED | files | COM | 1 | 2026-10-16 |
| 156.234.225.69 Seychelles · YANCY LIMITED | files | COM | 1 | 2026-10-16 |
| 156.234.225.67 Seychelles · YANCY LIMITED | files | COM | 1 | 2026-10-16 |
| 37.77.150.214 Russia · Proton66 OOO | exposed-secret | 1 | 2026-10-16 | |
| 27.50.59.62 Hong Kong · CTG Server Limited | files | MSI | 1 | 2026-10-16 |
| 146.19.24.104 Poland · MEVSPACE sp. z o.o. | c2 | IO | 1 | 2026-10-16 |
| 196.251.121.216 Seychelles · AS219443 | ioc-match | VBS | 1 | 2026-10-16 |
| 93.152.220.124 Bulgaria · Cyberzone S.A. | files | DZ | 1 | 2026-10-16 |
| 182.127.111.173 China · CHINA UNICOM China169 Backbone | malware mozi elf-binary | 1 | 2026-10-16 | |
| 219.155.202.252 China · CHINA UNICOM China169 Backbone | malware elf-binary | ELF | 1 | 2026-10-16 |
| 182.117.119.237 China · CHINA UNICOM China169 Backbone | malware mozi elf-binary | 1 | 2026-10-16 | |
| 218.61.29.103 China · CHINA UNICOM China169 Backbone | malware mozi elf-binary | ELF | 1 | 2026-10-16 |
| 176.9.116.24 Germany · Hetzner Online GmbH | exposed-secret | HTML | 1 | 2026-10-16 |
| 38.127.61.130 United States · Enzu Inc | files | BIN, ENV, JSON, PHP | 5 | 2026-10-16 |
| 213.180.204.221 Russia · YANDEX LLC | c2 | TXT | 1 | 2026-10-16 |
| 31.56.209.55 The Netherlands · SWISSNET LLC | files | BIN, ENV, JSON, PHP | 5 | 2026-10-16 |
| 45.139.104.29 United States · 49.3 Networking LLC | files | BIN, ENV, JSON, PHP | 5 | 2026-10-16 |
| 8.152.6.86 Singapore · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret | TXT | 1 | 2026-10-16 |
| 85.90.244.171 Germany · Akamai Technologies, Inc. | exposed-secret | TXT | 1 | 2026-10-16 |
| 74.208.201.158 United States · IONOS SE | exposed-secret | TXT | 1 | 2026-10-16 |
| 92.63.163.8 The Netherlands · Vertixo BV | exposed-secret | TXT | 1 | 2026-10-16 |
| 87.106.203.84 United Kingdom · IONOS SE | exposed-secret | TXT | 1 | 2026-10-16 |
| 45.9.63.19 Germany · netcup GmbH | exposed-secret | TXT | 1 | 2026-10-16 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free