Live findsCVE IntelResearchConsoleStart free
huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

5,965
hosts
106,472
files
103
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 2996malware 1224exploit 1134mozi 921c2 314webshell 282ioc-match 88coinminer 66gafgyt 56tsunami 41mirai 38sliver 31meterpreter 16havoc 15

Hosts labelled c2

HostLabelsFile typesFilesLast seen
41.223.30.7
CM · Creolink Communications
exploit exposed-secret malware moziPY, JSON, BIN, LOG7122026-11-12
217.198.6.226
Russia · JSC "TIMEWEB"
exposed-secret malware exploit webshellMD, LOG, PE, TXT2622026-11-12
202.162.109.6
Australia · CTG Server Limited
exploit exposed-secret malware moziLOG, SH, PY, BIN1162026-11-12
143.92.57.247
Hong Kong · CTG Server Limited
exploit exposed-secret malware moziLOG, SH, PY, BIN1162026-11-12
5.129.198.149
Russia · JSC "TIMEWEB"
exposed-secret exploit c2 webshellPY, PHP, LOG, JS1232026-11-12
202.162.109.5
Australia · CTG Server Limited
exploit exposed-secret malware moziLOG, PY, SH, BIN1612026-11-12
202.95.17.200
Singapore · CTG Server Limited
exposed-secret malware mozi c2SH, HTML, JSON, PY1042026-11-12
209.99.191.184
Switzerland · SKN Subnet & Telecom Ltd
malware mozi exposed-secret exploitSH, PY, TXT, HTML5332026-11-12
23.149.28.46
United States · NetLab Global
exploit malware mozi exposed-secretPY, SH, LOG, GZ1,2622026-11-12
134.122.169.32
Japan · CTG Server Limited
malware mozi exposed-secret exploitLOG, PY, SH, TXT1702026-11-12
5.42.107.183
Russia · JSC "TIMEWEB"
exposed-secret exploit malware webshellLOG, BIN, PEM, PY1162026-11-12
31.76.94.111
United States · VPSPay Networks LTD
exploit malware exposed-secret moziPY, ELF, LOG, SH632026-11-12
144.91.73.103
France · Contabo GmbH
exposed-secret malware mozi exploitPY, SH, TXT, PS15632026-11-12
13.184.160.159
United States
exposed-secret exploit malware moziPY, SH, LOG, GO1,0292026-11-12
168.144.111.89
Singapore · DigitalOcean, LLC
exposed-secret exploit webshell malwareTXT, HTML, PHP, SH3282026-11-12
206.189.167.156
United States · DigitalOcean, LLC
malware mozi exposed-secret exploitPY, SH, MD, TXT3262026-11-12
217.160.132.82
Spain · IONOS SE
exposed-secret exploit malware moziPY, SH, PHP, TXT9112026-11-12
193.180.209.78
Denmark · Webdock.io ApS
malware exploit c2 moziSH, PE, ZIP, GO322026-11-11
199.91.221.237
United States · BL Networks
c2 exposed-secret exploit malwareJS22026-11-11
151.101.63.10
United States · Fastly, Inc.
exploit c2TXT, HTML, PDF42026-11-11
172.65.90.26
United States · Cloudflare, Inc.
c2 exploitTXT22026-11-11
172.65.90.25
United States · Cloudflare, Inc.
c2 exploitTXT22026-11-11
172.65.90.24
United States · Cloudflare, Inc.
c2 exploitTXT22026-11-11
172.65.90.27
United States · Cloudflare, Inc.
c2 exploitTXT22026-11-11
172.67.203.21
United States · Cloudflare, Inc.
c2COM12026-11-10
104.21.77.11
United States · Cloudflare, Inc.
c2COM12026-11-10
172.67.177.134
United States · Cloudflare, Inc.
c2COM12026-11-10
104.21.37.67
United States · Cloudflare, Inc.
c2 exploitCOM12026-11-10
52.172.140.8
India · Microsoft Corporation
exposed-secret exploit c2 webshellSH, PY, LOG, SQL2972026-11-10
77.239.124.167
The Netherlands · Alfahost LLC
c2 exploit ioc-match tunnelTXT22026-11-10
163.52.135.151
unknown network
exposed-secret exploit webshell malwarePY, HTML, TXT, PHP6112026-11-09
121.36.206.152
China · Huawei Cloud Service data center
malware coinminer exposed-secret c2ELF, TXT, LOG, PY242026-11-09
168.144.157.73
India · DigitalOcean, LLC
exposed-secret malware mozi exploitPY, SH, JS, TXT6332026-11-09
147.182.133.56
United States · DigitalOcean, LLC
exposed-secret malware exploit c2BIN, TXT, PE, HTML2372026-11-09
178.62.235.52
The Netherlands · DigitalOcean, LLC
exposed-secret exploit malware moziPY, LOG, HTML, TXT2092026-11-09
8.138.12.59
Singapore · Hangzhou Alibaba Advertising Co.,Ltd.
exposed-secret exploit malware moziPY, JS, LOG, SH992026-11-09
47.84.30.150
United States · Alibaba (US) Technology Co., Ltd.
malware c2 exploit exposed-secretELF, C, GZ, PY842026-11-09
130.94.95.155
Indonesia · NTT America, Inc.
exposed-secret malware mozi c2PY, HTML, LOG, JSON3162026-11-09
146.19.213.192
Russia · ALEXHOST SRL
malware exposed-secret mozi exploitPY, SH, LOG, TXT1,2702026-11-09
172.67.202.28
United States · Cloudflare, Inc.
exposed-secret c2COM, CYOU22026-11-08
104.21.60.230
United States · Cloudflare, Inc.
exposed-secret c2COM, CYOU22026-11-08
172.67.150.136
United States · Cloudflare, Inc.
c2HTML12026-11-08
104.21.11.224
United States · Cloudflare, Inc.
c2HTML12026-11-08
104.21.10.19
United States · Cloudflare, Inc.
c2 malware sliver tunnelTXT12026-11-08
172.67.162.31
United States · Cloudflare, Inc.
c2 malware sliver tunnelTXT12026-11-08
104.21.56.29
United States · Cloudflare, Inc.
c2 exploit tunnelCSV12026-11-08
172.67.176.26
United States · Cloudflare, Inc.
c2 exploit tunnelCSV12026-11-08
64.176.34.176
Japan · The Constant Company, LLC
malware c2 mozi webshellPY, SH, TXT, ELF262026-11-08
124.198.131.63
United States · 1337 Services GmbH
exposed-secret malware exploit moziPY, SH, PE, RAR2172026-11-08
179.43.171.203
Panama · Private Layer INC
exposed-secret exploit malware moziLOG, PY, JSON, TXT762026-11-08
Page 1 of 7Older →
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free