huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,967
hosts
106,479
files
102
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled malware
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 112.229.244.155 China · CHINA UNICOM China169 Backbone | malware mozi elf-binary | A | 1 | 2026-10-24 |
| 118.232.137.101 Taiwan · kbro CO. Ltd. | malware mozi elf-binary | A | 1 | 2026-10-24 |
| 187.110.176.65 Brazil · MHNET TELECOM | malware exposed-secret mozi exploit | LOG, PE, ZIP, TXT | 480 | 2026-10-24 |
| 151.242.30.142 South Africa · Internet Magnate (Pty) Ltd | exploit malware mozi exposed-secret | JS, ZIP, C, PY | 454 | 2026-10-23 |
| 104.21.52.227 United States · Cloudflare, Inc. | malware mozi | STORE | 1 | 2026-10-23 |
| 173.249.7.242 France · Contabo GmbH | exposed-secret malware elf-binary | ELF, TXT, KEY, LOG | 11 | 2026-10-23 |
| 82.180.145.166 India · Contabo Asia Private Limited | webshell exposed-secret exploit malware | PHP, TXT, PY, JSP | 50 | 2026-10-23 |
| 202.61.139.15 Singapore · CTG Server Limited | exposed-secret exploit malware mozi | LOG, PY, JSON, PHP | 262 | 2026-10-23 |
| 52.188.156.253 United States · Microsoft Corporation | malware exploit mozi pe-binary | PE, PS1, COM | 7 | 2026-10-23 |
| 113.229.109.233 China · CHINA UNICOM China169 Backbone | malware mozi elf-binary | ELF | 1 | 2026-10-23 |
| 159.203.115.164 United States · DigitalOcean, LLC | exposed-secret c2 webshell malware | PY, SH, JS, TS | 459 | 2026-10-22 |
| 165.232.41.141 United Kingdom · DigitalOcean, LLC | exposed-secret exploit malware mozi | SH, TXT, GZ, JSON | 30 | 2026-10-22 |
| 54.169.109.7 Singapore · Amazon.com, Inc. | exposed-secret exploit malware mozi | LOG, PY, OVPN, TXT | 55 | 2026-10-22 |
| 92.118.112.100 United States · GLOBAL CONNECTIVITY SOLUTIONS LLP | malware elf-binary | ELF, TXT | 2 | 2026-10-22 |
| 14.29.208.101 China · Chinanet | malware exploit elf-binary macho-binary | RS, DB, ELF, GZ | 8 | 2026-10-22 |
| 212.232.23.75 Singapore · ROCKHOSTER PRIVATE LIMITED | exposed-secret exploit malware mozi | PY, LOG, TXT, BIN | 341 | 2026-10-21 |
| 91.92.43.221 Germany · DEDIK SERVICES LIMITED | malware elf-binary | ELF, SH | 6 | 2026-10-21 |
| 75.1.240.64 United States · AT&T Enterprises, LLC | malware mozi elf-binary | A | 1 | 2026-10-21 |
| 31.56.209.86 The Netherlands · SWISSNET LLC | c2 malware elf-binary tunnel | ELF, SH | 2 | 2026-10-21 |
| 89.32.46.87 Romania · Cyber_Folks SRL | exposed-secret exploit malware elf-binary | PY, TXT, HTML, DB | 65 | 2026-10-21 |
| 91.214.17.136 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 91.214.17.151 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 195.201.83.167 Germany · Hetzner Online GmbH | exposed-secret exploit malware mozi | SH, PY, SCIENC, JSON | 400 | 2026-10-21 |
| 85.215.219.126 Germany · IONOS SE | coinminer malware tunnel | GZ, PY, JS, TGZ | 12 | 2026-10-21 |
| 212.244.203.102 Poland · Orange Polska Spolka Akcyjna | webshell exposed-secret malware c2 | C, SQL, IN, PL | 300 | 2026-10-21 |
| 91.214.17.138 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 81.181.166.24 Romania · DataNode DC SRL | exposed-secret exploit malware mozi | BIN, LOG, TXT, JSON | 28 | 2026-10-21 |
| 91.214.17.190 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 95.43.220.235 Bulgaria · Vivacom Bulgaria EAD | malware c2 webshell elf-binary | GZ, C, BIN, ELF | 44 | 2026-10-21 |
| 87.121.52.82 Bulgaria · Neterra Ltd. | exposed-secret malware mozi exploit | GO, DB, JSON, KEY | 60 | 2026-10-21 |
| 176.103.62.56 Ukraine · Ivanov Vitaliy Sergeevich | malware exploit pe-binary elf-binary | BIN, ZIP, PE, ELF | 12 | 2026-10-21 |
| 185.232.170.43 Bulgaria · FIRST SERVER LIMITED | malware coinminer elf-binary | SH, GZ, ELF, JSON | 12 | 2026-10-21 |
| 82.118.235.179 Bulgaria · DA International Group Ltd. | exposed-secret exploit malware mozi | TXT, HTML | 28 | 2026-10-21 |
| 159.69.66.161 Germany · Hetzner Online GmbH | exposed-secret malware mozi exploit | PY, LOG, TXT, JSON | 705 | 2026-10-21 |
| 93.123.85.46 Germany · dataforest GmbH | exploit exposed-secret malware gafgyt | JAR, ZIP, GZ, TXT | 206 | 2026-10-21 |
| 188.210.220.194 Poland · DATASPACE P.S.A. | exposed-secret malware pe-binary | PHP, LOG, PE, YML | 9 | 2026-10-21 |
| 78.9.235.120 Poland · Netia SA | exposed-secret exploit malware elf-binary | TXT, ZIP, ELF | 8 | 2026-10-21 |
| 87.251.64.224 Poland · ISAEV Igor | c2 exposed-secret malware exploit | C, LOG, CSV, EXE | 8 | 2026-10-21 |
| 92.5.117.191 SE · Oracle Svenska AB | malware mozi tunnel | SH, TOML | 3 | 2026-10-21 |
| 91.214.17.130 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 188.245.31.251 Germany · Hetzner Online GmbH | exploit exposed-secret malware webshell | SH, PY, C, ELF | 58 | 2026-10-21 |
| 91.214.17.135 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 104.248.244.66 Germany · DigitalOcean, LLC | exposed-secret malware webshell mozi | PY, PS1, LOG, CONF | 49 | 2026-10-21 |
| 91.214.17.155 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 91.214.17.154 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 91.214.17.137 Ukraine · PollyComm LTD | exposed-secret malware mozi exploit | FRM, TXT, MYD, MYI | 38 | 2026-10-21 |
| 51.159.105.208 France · Scaleway SAS | exploit exposed-secret c2 malware | PY, LOG, TXT, SH | 334 | 2026-10-21 |
| 62.210.199.73 France · Scaleway SAS | exposed-secret webshell malware exploit | SH, GZ, PY, TXT | 17 | 2026-10-21 |
| 193.29.104.84 France · M247 Europe SRL | malware c2 exploit exposed-secret | BAT, PS1, PE | 45 | 2026-10-21 |
| 79.142.194.35 Ukraine · Infomir LLC | coinminer malware | GZ | 1 | 2026-10-21 |
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free