huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,965
hosts
106,472
files
103
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled coinminer
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 41.223.30.7 CM · Creolink Communications | exploit exposed-secret malware mozi | PY, JSON, BIN, LOG | 712 | 2026-11-12 |
| 209.99.191.184 Switzerland · SKN Subnet & Telecom Ltd | malware mozi exposed-secret exploit | SH, PY, TXT, HTML | 533 | 2026-11-12 |
| 209.99.184.99 Switzerland · SKN Subnet & Telecom Ltd | malware mozi exposed-secret exploit | SH, TXT, PY, JS | 236 | 2026-11-12 |
| 157.20.241.16 India · JOY SERVICES | coinminer malware tunnel | BIN, SH | 2 | 2026-11-12 |
| 31.76.94.111 United States · VPSPay Networks LTD | exploit malware exposed-secret mozi | PY, ELF, LOG, SH | 63 | 2026-11-12 |
| 13.184.160.159 United States | exposed-secret exploit malware mozi | PY, SH, LOG, GO | 1,029 | 2026-11-12 |
| 163.52.135.151 unknown network | exposed-secret exploit webshell malware | PY, HTML, TXT, PHP | 611 | 2026-11-09 |
| 121.36.206.152 China · Huawei Cloud Service data center | malware coinminer exposed-secret c2 | ELF, TXT, LOG, PY | 24 | 2026-11-09 |
| 146.19.213.192 Russia · ALEXHOST SRL | malware exposed-secret mozi exploit | PY, SH, LOG, TXT | 1,270 | 2026-11-09 |
| 64.23.240.211 United States · DigitalOcean, LLC | malware exploit coinminer exposed-secret | PY, LOG, TXT, SH | 386 | 2026-11-07 |
| 154.29.75.185 United States · Tier.Net Technologies LLC | malware coinminer pe-binary tunnel | PE, PS1, SH, ELF | 13 | 2026-11-07 |
| 89.36.231.178 France · ROCKHOSTER PRIVATE LIMITED | malware coinminer exploit c2 | XML, SH, BAT, JAR | 281 | 2026-11-07 |
| 178.83.45.33 Germany · OVH SAS | coinminer exposed-secret malware tunnel | LOG, SH | 2 | 2026-11-05 |
| 43.164.138.101 South Korea · Shenzhen Tencent Computer Systems Company Limited | malware coinminer elf-binary | SH, GZ, ELF, CONF | 159 | 2026-11-05 |
| 43.161.243.73 Hong Kong · Shenzhen Tencent Computer Systems Company Limited | exploit malware exposed-secret mozi | LOG, PY, MACHO, SH | 417 | 2026-11-05 |
| 64.93.12.85 United States · GTT Communications Inc. | c2 coinminer exposed-secret malware | LOG, TXT | 2 | 2026-11-05 |
| 168.144.251.199 United States | exploit exposed-secret webshell malware | PHP, HTML, LOG, PY | 146 | 2026-11-05 |
| 38.60.227.210 United States · Kaopu Cloud HK Limited | exposed-secret malware mozi c2 | PY, TXT, SH, PS1 | 1,000 | 2026-11-04 |
| 64.177.47.135 United States | malware exposed-secret exploit c2 | PE, PY, MD, TXT | 97 | 2026-11-04 |
| 198.44.116.69 United States · HostPapa | exposed-secret malware mozi exploit | PY, SH, JSON, LOG | 733 | 2026-11-03 |
| 198.46.252.28 United States · HostPapa | exposed-secret exploit malware mozi | GO, TXT, SH, GZ | 89 | 2026-11-03 |
| 194.233.67.247 Singapore · Contabo Asia Private Limited | exploit exposed-secret malware mozi | TXT, PHP, HTML, PY | 354 | 2026-11-02 |
| 173.212.244.40 France · Contabo GmbH | exposed-secret exploit webshell c2 | PY, HTML, MD, PHP | 523 | 2026-11-02 |
| 27.131.106.133 Australia · Micron21 Datacentre Pty Ltd | exposed-secret exploit coinminer malware | SAMPLE, TXT, GZ, PY | 29 | 2026-11-02 |
| 8.220.87.150 Singapore · Alibaba (US) Technology Co., Ltd. | coinminer malware elf-binary tunnel | ELF, SH | 2 | 2026-10-31 |
| 64.177.33.68 United States | coinminer malware elf-binary | ELF | 1 | 2026-10-30 |
| 103.252.72.150 Vietnam · VIETNAM POSTS AND TELECOMMUNICATIONS GROUP | coinminer malware elf-binary tunnel | LOG, ELF, GZ, PY | 6 | 2026-10-28 |
| 157.180.71.22 Finland · Hetzner Online GmbH | exposed-secret malware coinminer tunnel | SH, SQL, TXT, ELF | 28 | 2026-10-28 |
| 54.215.75.164 United States · Amazon.com, Inc. | coinminer exploit exposed-secret malware | ZIP | 1 | 2026-10-28 |
| 52.9.172.225 United States · Amazon.com, Inc. | coinminer exploit exposed-secret malware | ZIP | 1 | 2026-10-28 |
| 23.19.231.52 United States · Leaseweb USA, Inc. | malware mozi exposed-secret exploit | PY, GZ, JS, SH | 577 | 2026-10-27 |
| 191.217.250.227 United States | malware c2 coinminer exploit | PHP, GZ, BIN, SH | 33 | 2026-10-27 |
| 51.81.244.207 United States · OVH SAS | exploit malware coinminer exposed-secret | LOG, PY, SH, ELF | 31 | 2026-10-27 |
| 89.108.76.200 Russia · "Domain names registrar REG.RU", Ltd | coinminer malware exploit tunnel | JSON, PY, BIN, TXT | 9 | 2026-10-26 |
| 45.115.26.30 Vietnam · Contrust Solutions S.R.L. | exposed-secret exploit malware mozi | LOG, PY, SH, TXT | 1,395 | 2026-10-26 |
| 45.151.122.34 France · Contabo GmbH | malware coinminer exposed-secret exploit | ELF, PY, SH, CMD | 109 | 2026-10-25 |
| 156.245.146.226 Seychelles · Zillion Network Inc. | exposed-secret malware mozi exploit | SH, HTML, PY, TXT | 561 | 2026-10-25 |
| 2.26.229.254 Germany · PLAY2GO INTERNATIONAL LIMITED | malware adaptix coinminer c2 | PS1, PE, CMD, BAT | 43 | 2026-10-24 |
| 39.109.100.126 Hong Kong | exposed-secret malware mozi exploit | PY, TXT, LOG, SH | 440 | 2026-10-24 |
| 103.214.172.114 Hong Kong · Cloudie Limited | exposed-secret malware mozi exploit | PY, TXT, LOG, SH | 440 | 2026-10-24 |
| 204.168.225.59 Finland · Hetzner Online GmbH | exposed-secret malware mozi exploit | PEM, TXT, PY, SH | 487 | 2026-10-24 |
| 104.160.169.204 United States · Sharktech | exposed-secret exploit malware tsunami | SH, LOG, TXT, PY | 170 | 2026-10-24 |
| 195.201.83.167 Germany · Hetzner Online GmbH | exposed-secret exploit malware mozi | SH, PY, SCIENC, JSON | 400 | 2026-10-21 |
| 85.215.219.126 Germany · IONOS SE | coinminer malware tunnel | GZ, PY, JS, TGZ | 12 | 2026-10-21 |
| 185.232.170.43 Bulgaria · FIRST SERVER LIMITED | malware coinminer elf-binary | SH, GZ, ELF, JSON | 12 | 2026-10-21 |
| 79.142.194.35 Ukraine · Infomir LLC | coinminer malware | GZ | 1 | 2026-10-21 |
| 8.217.24.92 Hong Kong · Alibaba (US) Technology Co., Ltd. | exposed-secret malware mozi webshell | PY, HTM, SH, JS | 649 | 2026-10-21 |
| 5.39.254.211 United Kingdom · Baxet Group Inc. | malware exposed-secret coinminer elf-binary | SH, ELF, LOG, TGZ | 9 | 2026-10-21 |
| 177.4.12.11 Hong Kong · Hong Kong Communications International Co., Limited | exploit malware coinminer exposed-secret | PY, YAML, TXT, ZIP | 25 | 2026-10-19 |
| 185.157.161.93 Sweden · Obehosting AB | exploit c2 exposed-secret webshell | PY, SH, JS, JSON | 503 | 2026-10-19 |
Page 1 of 2Older →
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free