huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,966
hosts
106,473
files
101
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Every host we harvested files from, newest first
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 32.190.234.241 United States · Amazon.com, Inc. | exposed-secret | TXT | 1 | 2026-11-10 |
| 32.190.234.175 United States · Amazon.com, Inc. | exposed-secret | TXT | 1 | 2026-11-10 |
| 32.190.234.213 United States · Amazon.com, Inc. | exposed-secret | TXT | 1 | 2026-11-10 |
| 152.42.162.237 Singapore · DigitalOcean, LLC | exposed-secret exploit malware mozi | PY, TXT, LOG, ELF | 135 | 2026-11-09 |
| 163.52.135.151 unknown network | exposed-secret exploit webshell malware | PY, HTML, TXT, PHP | 611 | 2026-11-09 |
| 207.148.8.12 United States · The Constant Company, LLC | tunnel | NET | 3 | 2026-11-09 |
| 69.10.38.126 United States · Interserver, Inc | files | COM | 1 | 2026-11-09 |
| 185.77.97.147 United States · Hostinger International Limited | files | CYOU, SHOP | 2 | 2026-11-09 |
| 104.21.27.66 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-09 |
| 172.67.141.198 United States · Cloudflare, Inc. | files | COM | 1 | 2026-11-09 |
| 172.64.146.81 United States · Cloudflare, Inc. | files | TXT | 3 | 2026-11-09 |
| 104.18.41.175 United States · Cloudflare, Inc. | files | TXT | 3 | 2026-11-09 |
| 195.200.9.246 United Kingdom · Hostinger International Limited | exposed-secret | HTA, IN | 2 | 2026-11-09 |
| 89.116.109.80 United Kingdom · Hostinger International Limited | files | SHOP | 1 | 2026-11-09 |
| 185.77.97.207 United States · Hostinger International Limited | exposed-secret | HTA, IN | 2 | 2026-11-09 |
| 5.231.45.175 Germany · Philip Fjaera trading as PFWeb Solutions | exposed-secret forced-loot | TXT | 1 | 2026-11-09 |
| 121.36.206.152 China · Huawei Cloud Service data center | malware coinminer exposed-secret c2 | ELF, TXT, LOG, PY | 24 | 2026-11-09 |
| 168.144.157.73 India · DigitalOcean, LLC | exposed-secret malware mozi exploit | PY, SH, JS, TXT | 633 | 2026-11-09 |
| 101.96.207.153 China · Beijing Volcano Engine Technology Co., Ltd. | exposed-secret | TXT | 1 | 2026-11-09 |
| 110.38.169.115 Pakistan · Wateen Telecom Limited | files | BIN | 1 | 2026-11-09 |
| 149.154.167.99 United Kingdom · Telegram Messenger Inc | files | TXT | 3 | 2026-11-09 |
| 185.199.110.133 United States · Fastly, Inc. | exploit ioc-match malware mozi | BAT, DBF, HTA, PS1 | 5 | 2026-11-09 |
| 185.199.111.133 United States · Fastly, Inc. | exploit malware mozi | HTA, TXT | 2 | 2026-11-09 |
| 147.182.133.56 United States · DigitalOcean, LLC | exposed-secret malware exploit c2 | BIN, TXT, PE, HTML | 237 | 2026-11-09 |
| 13.202.120.3 India · Amazon.com, Inc. | exposed-secret | TXT | 2 | 2026-11-09 |
| 104.248.53.161 United States · DigitalOcean, LLC | exploit exposed-secret webshell tunnel | PY, LOG, SH, HTML | 374 | 2026-11-09 |
| 178.62.235.52 The Netherlands · DigitalOcean, LLC | exposed-secret exploit malware mozi | PY, LOG, HTML, TXT | 209 | 2026-11-09 |
| 107.148.227.57 United States · PEG TECH INC | malware tunnel pe-binary elf-binary | LOG, PS1, PE, PY | 25 | 2026-11-09 |
| 132.226.169.119 South Korea · Oracle Corporation | exposed-secret malware mozi tunnel | YAML, SH, BAK, ELF | 36 | 2026-11-09 |
| 8.138.12.59 Singapore · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret exploit malware mozi | PY, JS, LOG, SH | 99 | 2026-11-09 |
| 46.101.155.48 Germany · DigitalOcean, LLC | exposed-secret malware mozi tunnel | JS, LOG, TXT, ELF | 18 | 2026-11-09 |
| 46.101.142.226 Germany · DigitalOcean, LLC | exposed-secret | TXT | 3 | 2026-11-09 |
| 129.212.194.246 Germany · DigitalOcean, LLC | exposed-secret | TXT | 2 | 2026-11-09 |
| 154.217.248.243 United States · AROSSCLOUD INC. | malware mozi exposed-secret | TXT, ENV, JSON, PHP | 9 | 2026-11-09 |
| 64.29.17.67 United States · Amazon.com, Inc. | exposed-secret | APP | 19 | 2026-11-09 |
| 216.198.79.67 United States · Amazon.com, Inc. | exposed-secret | APP | 19 | 2026-11-09 |
| 201.18.196.57 India · Hostinger International Limited | files | FAMILY | 1 | 2026-11-09 |
| 199.19.77.18 United States · VegasNAP, LLC | tunnel | 1 | 2026-11-09 | |
| 104.21.5.118 United States · Cloudflare, Inc. | files | DEV | 1 | 2026-11-09 |
| 172.67.133.97 United States · Cloudflare, Inc. | files | DEV | 1 | 2026-11-09 |
| 72.60.175.59 United States · Hostinger International Limited | files | ONLINE | 1 | 2026-11-09 |
| 104.21.32.1 United States · Cloudflare, Inc. | files | ICU | 1 | 2026-11-09 |
| 63.176.8.218 Germany · Amazon.com, Inc. | exposed-secret ioc-match malware pe-binary | APP, JAR, CLICK, COM | 10 | 2026-11-09 |
| 104.21.16.1 United States · Cloudflare, Inc. | files | ICU | 1 | 2026-11-09 |
| 185.77.97.48 United States · Hostinger International Limited | exposed-secret | SHOP | 1 | 2026-11-09 |
| 35.157.26.135 Germany · Amazon.com, Inc. | exposed-secret ioc-match malware pe-binary | APP, JAR, CLICK, COM | 10 | 2026-11-09 |
| 91.108.103.246 United Kingdom · Hostinger International Limited | exposed-secret | SHOP | 1 | 2026-11-09 |
| 89.116.109.26 United Kingdom · Hostinger International Limited | files | SHOP | 1 | 2026-11-09 |
| 91.108.103.144 United Kingdom · Hostinger International Limited | files | SHOP | 1 | 2026-11-09 |
| 91.108.103.8 United Kingdom · Hostinger International Limited | exposed-secret | PHP, TECH | 2 | 2026-11-09 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free