huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

6,067
hosts
115,938
files
85
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 3084malware 1261exploit 1179mozi 953c2 337webshell 304ioc-match 88coinminer 75gafgyt 63tsunami 45mirai 41sliver 32meterpreter 18havoc 16

Every host we harvested files from, newest first

HostLabelsFile typesFilesLast seen
167.172.177.125
Germany · DigitalOcean, LLC
exposed-secret exploitTXT, ENV32026-10-06
151.243.217.110
The Netherlands · HOSTKEY B.V.
exposed-secretTXT12026-10-06
124.223.94.233
China · Shenzhen Tencent Computer Systems Company Limited
exposed-secretTXT12026-10-06
183.64.171.136
China · Chinanet
exposed-secret exploitTXT22026-10-06
138.197.174.43
Canada · DigitalOcean, LLC
exposed-secretTXT12026-10-06
207.180.222.166
France · Contabo GmbH
exposed-secretTXT12026-10-06
171.244.40.23
Vietnam · Viettel Group
exposed-secretTXT12026-10-06
182.253.238.218
Indonesia · BIZNET
webshellZIP, PHP, TXT3272026-10-06
64.188.65.114
Germany · PLAY2GO INTERNATIONAL LIMITED
filesJSON22026-10-06
66.116.224.187
United Arab Emirates · Oracle Corporation
exposed-secretENV12026-10-06
68.183.87.132
India · DigitalOcean, LLC
exposed-secret exploitTXT22026-10-06
41.153.30.107
Egypt · ETISALAT MISR
exposed-secretJSON12026-10-06
159.223.40.78
Singapore · DigitalOcean, LLC
exposed-secretYAML12026-10-06
80.94.95.211
United Kingdom · SS-Net
exposed-secretENV12026-10-06
201.6.100.191
Brazil · Claro NXT Telecomunicacoes Ltda
exposed-secret exploitTXT32026-10-06
144.31.234.20
The Netherlands · PLAY2GO INTERNATIONAL LIMITED
exposed-secretJS12026-10-06
85.173.245.55
Russia · PJSC Rostelecom
exposed-secretTXT22026-10-06
94.46.167.106
Portugal · ALMOUROLTEC SERVICOS DE INFORMATICA E INTERNET LDA
exposed-secretTXT12026-10-06
47.106.234.107
China · Hangzhou Alibaba Advertising Co.,Ltd.
exposed-secretTXT12026-10-06
65.109.210.184
Finland · Hetzner Online GmbH
exposed-secretENV12026-10-06
77.90.158.103
Germany · Sculk Ltd.
exposed-secret exploitTXT22026-10-06
203.2.113.174
China · Chongqing Telecom
filesJSON12026-10-06
173.212.221.173
France · Contabo GmbH
exposed-secret exploitTXT22026-10-06
43.153.76.40
United States · Shenzhen Tencent Computer Systems Company Limited
exposed-secretYAML12026-10-06
45.153.34.85
The Netherlands · TechTies Inc.
exposed-secretTXT12026-10-06
139.224.217.14
China · Hangzhou Alibaba Advertising Co.,Ltd.
exposed-secretTXT12026-10-06
8.134.114.212
Singapore · Hangzhou Alibaba Advertising Co.,Ltd.
exposed-secretTXT12026-10-06
101.43.79.210
China · Shenzhen Tencent Computer Systems Company Limited
exposed-secretTXT, ENV, JSON, PHP52026-10-06
82.197.71.28
Singapore · Contabo Asia Private Limited
exposed-secretTXT12026-10-06
200.105.156.165
Bolivia · AXS Bolivia S. A.
exposed-secret exploitTXT22026-10-06
185.35.202.222
Norway · Blix Solutions AS
exposed-secret exploitTXT22026-10-06
139.9.204.193
China · Huawei Cloud Service data center
exposed-secretJSON, PHP, TXT32026-10-06
8.153.99.101
Singapore · Hangzhou Alibaba Advertising Co.,Ltd.
exposed-secretTXT, ENV, JSON, PHP62026-10-06
72.253.251.3
United States · Hawaiian Telcom Services Company, Inc.
exposed-secretENV, TXT22026-10-06
35.229.151.9
Taiwan · Google LLC
exposed-secretTXT12026-10-06
182.253.156.184
Indonesia · BIZNET NETWORKS
exposed-secretTXT, ENV, JSON52026-10-06
185.93.89.167
United Arab Emirates · Limited Network LTD
exposed-secretENV12026-10-06
164.90.195.37
The Netherlands · DigitalOcean, LLC
exposed-secretTXT12026-10-06
212.51.146.225
Switzerland · Init7 (Switzerland) Ltd.
exposed-secretTXT12026-10-06
84.17.55.211
Poland · Datacamp Limited
malware elf-binary tunnelELF, GZ, SH32026-10-06
66.80.117.94
Dominican Republic · ARCOFIBER CONEXIONES SRL (RODRITEL)
exposed-secretTXT12026-10-06
5.42.239.222
Saudi Arabia · Etihad Salam Telecom CJSC
filesBIN12026-10-06
45.65.233.18
Colombia · COLOMBIA MAS TV S.A.S
filesBIN12026-10-06
170.106.67.57
United States · Shenzhen Tencent Computer Systems Company Limited
exposed-secretTXT12026-10-06
195.178.110.48
AD · TECHOFF SRV LIMITED
coinminer malware exploit exposed-secretTXT, ELF, GZ, JSON82026-10-06
206.189.112.134
United Kingdom · DigitalOcean, LLC
exposed-secret exploitTXT, ENV32026-10-06
206.189.165.47
United States · DigitalOcean, LLC
exposed-secretENV12026-10-06
103.84.119.130
Indonesia · Universitas Islam Negeri Raden Fatah Palembang
filesBIN, JSON32026-10-06
36.150.236.49
China · China Mobile Communications Corporation
exposed-secretTXT, ENV, JSON52026-10-06
139.59.74.148
India · DigitalOcean, LLC
exposed-secretTXT12026-10-06
← NewerPage 92 of 122Older →
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free