huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,967
hosts
106,479
files
102
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled malware
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 31.56.209.34 The Netherlands · SWISSNET LLC | malware elf-binary | ELF | 1 | 2026-10-26 |
| 124.77.222.157 China · China Telecom (Group) | malware mozi elf-binary | A | 1 | 2026-10-25 |
| 95.216.224.44 Finland · Hetzner Online GmbH | exploit exposed-secret malware gafgyt | JAR, ZIP, GZ, TXT | 206 | 2026-10-25 |
| 218.38.52.211 South Korea · SK Broadband Co Ltd | exposed-secret malware mozi elf-binary | PHP, ZIP, TXT, ELF | 30 | 2026-10-25 |
| 212.227.29.190 Germany · IONOS SE | exploit exposed-secret malware webshell | ELF, PHP, TXT | 3 | 2026-10-25 |
| 182.114.197.218 China · CHINA UNICOM China169 Backbone | malware mozi elf-binary | 1 | 2026-10-25 | |
| 82.156.186.185 China · Shenzhen Tencent Computer Systems Company Limited | malware cobalt-strike c2 mozi | PY, JAR, TXT, LOG | 88 | 2026-10-25 |
| 2.29.112.91 Finland · Hetzner Online GmbH | malware mozi | ZIP, CSV, JSON, LOG | 9 | 2026-10-25 |
| 45.151.122.34 France · Contabo GmbH | malware coinminer exposed-secret exploit | ELF, PY, SH, CMD | 109 | 2026-10-25 |
| 217.69.11.65 France · The Constant Company, LLC | exploit malware webshell pe-binary | PE, JSP, PS1, TXT | 10 | 2026-10-25 |
| 193.36.119.24 The Netherlands · EstNOC OU | exposed-secret malware mozi pe-binary | LOG, VBS, PY, ELF | 21 | 2026-10-25 |
| 49.51.230.17 United States · Shenzhen Tencent Computer Systems Company Limited | malware exploit webshell exposed-secret | LOG, C, DLL, BIN | 56 | 2026-10-25 |
| 47.109.23.77 China · Hangzhou Alibaba Advertising Co.,Ltd. | malware cobalt-strike exploit exposed-secret | BIN, LOG, PHP, PY | 21 | 2026-10-25 |
| 111.231.116.164 China · Shenzhen Tencent Computer Systems Company Limited | malware mozi exposed-secret | TXT, ENV, JSON, PHP | 9 | 2026-10-25 |
| 156.245.146.226 Seychelles · Zillion Network Inc. | exposed-secret malware mozi exploit | SH, HTML, PY, TXT | 561 | 2026-10-25 |
| 45.198.224.188 Seychelles · VPSVAULT.HOST LTD | malware exposed-secret elf-binary pe-binary | ELF, PE, TXT | 6 | 2026-10-25 |
| 129.159.135.190 Israel · Oracle Corporation | malware exploit exposed-secret mozi | ELF, LOG, PY, C | 40 | 2026-10-25 |
| 192.236.229.229 United States · HostPapa | malware mozi exposed-secret exploit | PY, SH, LOG, TXT | 33 | 2026-10-25 |
| 8.133.234.121 Singapore · Hangzhou Alibaba Advertising Co.,Ltd. | exploit exposed-secret malware mozi | SH, LOG, C, TXT | 216 | 2026-10-25 |
| 51.159.184.76 France · Scaleway SAS | exposed-secret malware mozi exploit | JSON, JS, TXT, HTML | 38 | 2026-10-25 |
| 64.226.89.20 Germany · DigitalOcean, LLC | exploit exposed-secret malware mozi | PY, TXT, CSV, JS | 14 | 2026-10-25 |
| 209.38.235.232 Germany · DigitalOcean, LLC | exposed-secret malware mozi exploit | JSON, JS, LOG, MD | 118 | 2026-10-25 |
| 5.172.156.40 United Kingdom · Pulsant (Scotland) Ltd | exploit exposed-secret malware webshell | PY, PHP, ELF, ENV | 13 | 2026-10-25 |
| 175.159.194.157 Hong Kong · The Hong Kong Polytechnic University | exposed-secret exploit malware mozi | MD, SAMPLE, TXT, SH | 67 | 2026-10-25 |
| 45.67.86.32 Japan · Host Universal Pty Ltd | exploit malware exposed-secret mozi | LOG, PY, MACHO, TXT | 83 | 2026-10-25 |
| 115.29.202.62 China · Hangzhou Alibaba Advertising Co.,Ltd. | malware exploit exposed-secret mozi | ELF, LOG, PY, MD | 139 | 2026-10-25 |
| 89.19.223.126 Russia · SYSECT D.O.O. | malware elf-binary | ELF | 4 | 2026-10-25 |
| 74.73.65.132 United States · Charter Communications Inc | exposed-secret malware mozi exploit | PY, TXT, MD, CSV | 81 | 2026-10-25 |
| 121.4.83.178 China · Shenzhen Tencent Computer Systems Company Limited | exposed-secret c2 webshell malware | MD, GITIGN | 19 | 2026-10-25 |
| 95.179.212.2 France · The Constant Company, LLC | c2 malware pe-binary | PY, PS1, TXT, EXE | 13 | 2026-10-25 |
| 114.215.184.158 China · Hangzhou Alibaba Advertising Co.,Ltd. | malware pe-binary | PE | 1 | 2026-10-24 |
| 119.45.236.76 China · Shenzhen Tencent Computer Systems Company Limited | malware exploit c2 meterpreter | LOG, PE, BIN, ELF | 26 | 2026-10-24 |
| 198.46.158.18 United States · HostPapa | exposed-secret exploit malware mozi | PY, YAML, HTML, TXT | 362 | 2026-10-24 |
| 193.233.220.65 Russia · Aeza Group LLC | malware exploit c2 exposed-secret | PS1, PE, BAT, ZIP | 186 | 2026-10-24 |
| 2.26.229.254 Germany · PLAY2GO INTERNATIONAL LIMITED | malware adaptix coinminer c2 | PS1, PE, CMD, BAT | 43 | 2026-10-24 |
| 5.83.136.39 Germany · Finn Hess trading as Ryzehosting | malware elf-binary pe-binary | ELF, PE, SH | 10 | 2026-10-24 |
| 58.221.60.160 China · Chinanet | malware exploit mozi c2 | MACHO, JAVA, PY, SH | 35 | 2026-10-24 |
| 67.215.232.25 United States · HostPapa | malware exploit pe-binary | PE, EXE, ASP, ASPX | 15 | 2026-10-24 |
| 39.109.100.126 Hong Kong | exposed-secret malware mozi exploit | PY, TXT, LOG, SH | 440 | 2026-10-24 |
| 103.214.172.114 Hong Kong · Cloudie Limited | exposed-secret malware mozi exploit | PY, TXT, LOG, SH | 440 | 2026-10-24 |
| 103.39.78.45 Hong Kong · VH-GLOBAL | exploit exposed-secret malware webshell | ASPX, PE, PS1, TXT | 9 | 2026-10-24 |
| 43.254.165.70 Hong Kong · VH-GLOBAL | exploit exposed-secret malware webshell | ASPX, PE, PS1, TXT | 9 | 2026-10-24 |
| 23.111.31.154 The Netherlands · Servers.com, Inc. | malware pe-binary | PE, ZIP, COM | 59 | 2026-10-24 |
| 199.19.77.37 United States · VegasNAP, LLC | malware exploit pe-binary | RSP, PE, ZIP, BIN | 48 | 2026-10-24 |
| 139.162.97.181 Japan · Akamai Technologies, Inc. | malware mozi exposed-secret gafgyt | MICROH, TXT | 53 | 2026-10-24 |
| 204.168.225.59 Finland · Hetzner Online GmbH | exposed-secret malware mozi exploit | PEM, TXT, PY, SH | 487 | 2026-10-24 |
| 104.160.169.204 United States · Sharktech | exposed-secret exploit malware tsunami | SH, LOG, TXT, PY | 170 | 2026-10-24 |
| 194.11.226.41 United Kingdom · ROCKHOSTER PRIVATE LIMITED | exposed-secret malware mozi exploit | PY, TXT, LOG, JS | 106 | 2026-10-24 |
| 195.154.79.206 France · Scaleway SAS | malware exposed-secret pe-binary elf-binary | PE, JOBX, SH, TXT | 16 | 2026-10-24 |
| 84.38.180.187 Russia · JSC Selectel | exploit malware pe-binary | PE, APPLIC, BAT, HTA | 9 | 2026-10-24 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free