Live findsCVE IntelResearchConsoleStart free
huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

5,965
hosts
106,472
files
103
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 2996malware 1224exploit 1134mozi 921c2 314webshell 282ioc-match 88coinminer 66gafgyt 56tsunami 41mirai 38sliver 31meterpreter 16havoc 15

Hosts labelled exploit

HostLabelsFile typesFilesLast seen
41.223.30.7
CM · Creolink Communications
exploit exposed-secret malware moziPY, JSON, BIN, LOG7122026-11-12
217.198.6.226
Russia · JSC "TIMEWEB"
exposed-secret malware exploit webshellMD, LOG, PE, TXT2622026-11-12
202.162.109.6
Australia · CTG Server Limited
exploit exposed-secret malware moziLOG, SH, PY, BIN1162026-11-12
143.92.57.247
Hong Kong · CTG Server Limited
exploit exposed-secret malware moziLOG, SH, PY, BIN1162026-11-12
5.129.198.149
Russia · JSC "TIMEWEB"
exposed-secret exploit c2 webshellPY, PHP, LOG, JS1232026-11-12
202.162.109.5
Australia · CTG Server Limited
exploit exposed-secret malware moziLOG, PY, SH, BIN1612026-11-12
202.95.17.200
Singapore · CTG Server Limited
exposed-secret malware mozi c2SH, HTML, JSON, PY1042026-11-12
209.99.184.25
Switzerland · SKN Subnet & Telecom Ltd
malware exposed-secret exploit pe-binaryLOG, PE, ARCHIV, BAT962026-11-12
209.99.191.184
Switzerland · SKN Subnet & Telecom Ltd
malware mozi exposed-secret exploitSH, PY, TXT, HTML5332026-11-12
209.99.184.99
Switzerland · SKN Subnet & Telecom Ltd
malware mozi exposed-secret exploitSH, TXT, PY, JS2362026-11-12
23.149.28.46
United States · NetLab Global
exploit malware mozi exposed-secretPY, SH, LOG, GZ1,2622026-11-12
134.122.169.32
Japan · CTG Server Limited
malware mozi exposed-secret exploitLOG, PY, SH, TXT1702026-11-12
5.42.107.183
Russia · JSC "TIMEWEB"
exposed-secret exploit malware webshellLOG, BIN, PEM, PY1162026-11-12
103.12.149.48
Hong Kong · CTG Server Limited
exposed-secret exploit tunnelTXT, JS, LOG, ENV212026-11-12
89.223.127.154
Russia · JSC "TIMEWEB"
exposed-secret exploit malware moziTXT, HTML, ENV, JSON132026-11-12
191.96.235.13
United States · Datacamp Limited
exposed-secret exploit malware macho-binaryPY, TXT, SH, MACHO272026-11-12
199.19.95.66
Canada · Netminders Server Hosting
exposed-secret exploit malware moziPY, ELF, OUT, TXT572026-11-12
199.19.95.67
Canada · Netminders Server Hosting
exposed-secret exploit malware moziPY, ELF, OUT, TXT572026-11-12
199.19.95.68
Canada · Netminders Server Hosting
exposed-secret exploit malware moziPY, ELF, OUT, TXT572026-11-12
31.76.94.111
United States · VPSPay Networks LTD
exploit malware exposed-secret moziPY, ELF, LOG, SH632026-11-12
144.91.73.196
France · Contabo GmbH
exposed-secret exploitTXT, PHP, ENV, JSON522026-11-12
67.219.98.34
Australia · The Constant Company, LLC
exposed-secret exploitTXT, ENV, JSON122026-11-12
216.238.101.165
Brazil · The Constant Company, LLC
exposed-secret exploitTXT, ENV, JSON122026-11-12
142.93.14.200
United States · DigitalOcean, LLC
exposed-secret exploitTXT, ENV, JSON62026-11-12
128.199.193.92
Singapore · DigitalOcean, LLC
exposed-secret exploitTXT, ENV, JSON62026-11-12
51.81.220.78
United States · OVH SAS
exposed-secret exploitTXT, ENV, JSON62026-11-12
143.110.148.161
United States · DigitalOcean, LLC
exposed-secret exploitTXT, ENV, JSON62026-11-12
144.91.73.103
France · Contabo GmbH
exposed-secret malware mozi exploitPY, SH, TXT, PS15632026-11-12
45.32.114.54
Singapore · The Constant Company, LLC
exposed-secret exploitENV, TXT, JSON, PHP102026-11-12
13.184.160.159
United States
exposed-secret exploit malware moziPY, SH, LOG, GO1,0292026-11-12
168.144.111.89
Singapore · DigitalOcean, LLC
exposed-secret exploit webshell malwareTXT, HTML, PHP, SH3282026-11-12
8.210.103.219
Hong Kong · Alibaba (US) Technology Co., Ltd.
exposed-secret exploitTXT22026-11-12
20.26.156.215
United Kingdom · Microsoft Corporation
exposed-secret exploit malware pe-binaryTXT, BAT, PE, TOML332026-11-12
115.159.204.46
China · Shenzhen Tencent Computer Systems Company Limited
exposed-secret exploit malware gafgytPY, LOG, JSON, MD1672026-11-12
104.21.6.116
United States · Cloudflare, Inc.
exploitCOM, TXT22026-11-12
172.67.134.197
United States · Cloudflare, Inc.
exploitCOM, TXT22026-11-12
206.189.167.156
United States · DigitalOcean, LLC
malware mozi exposed-secret exploitPY, SH, MD, TXT3262026-11-12
217.160.132.82
Spain · IONOS SE
exposed-secret exploit malware moziPY, SH, PHP, TXT9112026-11-12
51.210.38.62
France · OVH SAS
exploit exposed-secretTXT, ENV, JSON, PHP92026-11-12
216.198.79.1
United States · Amazon.com, Inc.
exploit exposed-secret tunnelJS, ONLINE, CHAT, COM132026-11-11
57.129.50.100
Germany · OVH SAS
exploitDB, GPG22026-11-11
178.62.250.64
The Netherlands · DigitalOcean, LLC
exposed-secret exploitTXT22026-11-11
193.180.209.78
Denmark · Webdock.io ApS
malware exploit c2 moziSH, PE, ZIP, GO322026-11-11
107.161.23.11
United States · InMotion Hosting, Inc.
exploitRAR22026-11-11
104.21.63.49
United States · Cloudflare, Inc.
exploitCC12026-11-11
172.67.150.8
United States · Cloudflare, Inc.
exploitCC12026-11-11
172.67.169.242
United States · Cloudflare, Inc.
exploitCC12026-11-11
104.21.79.235
United States · Cloudflare, Inc.
exploitCC12026-11-11
172.67.137.39
United States · Cloudflare, Inc.
exploitCC12026-11-11
104.21.7.181
United States · Cloudflare, Inc.
exploitCC12026-11-11
Page 1 of 23Older →
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free