huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,965
hosts
106,472
files
103
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled exposed-secret
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 41.223.30.7 CM · Creolink Communications | exploit exposed-secret malware mozi | PY, JSON, BIN, LOG | 712 | 2026-11-12 |
| 154.62.226.92 Spain · Ultahost, Inc. | exposed-secret | TXT, ENV, JSON, PHP | 19 | 2026-11-12 |
| 217.198.6.226 Russia · JSC "TIMEWEB" | exposed-secret malware exploit webshell | MD, LOG, PE, TXT | 262 | 2026-11-12 |
| 202.162.109.6 Australia · CTG Server Limited | exploit exposed-secret malware mozi | LOG, SH, PY, BIN | 116 | 2026-11-12 |
| 66.203.158.218 Hong Kong · Dimension Network & Communication Limited | exposed-secret | TXT | 1 | 2026-11-12 |
| 143.92.57.247 Hong Kong · CTG Server Limited | exploit exposed-secret malware mozi | LOG, SH, PY, BIN | 116 | 2026-11-12 |
| 5.129.198.149 Russia · JSC "TIMEWEB" | exposed-secret exploit c2 webshell | PY, PHP, LOG, JS | 123 | 2026-11-12 |
| 202.162.109.5 Australia · CTG Server Limited | exploit exposed-secret malware mozi | LOG, PY, SH, BIN | 161 | 2026-11-12 |
| 66.203.158.219 Hong Kong · Dimension Network & Communication Limited | exposed-secret | TXT | 1 | 2026-11-12 |
| 66.203.158.216 Hong Kong · Dimension Network & Communication Limited | exposed-secret | TXT | 1 | 2026-11-12 |
| 66.203.158.215 Hong Kong · Dimension Network & Communication Limited | exposed-secret | TXT | 1 | 2026-11-12 |
| 66.203.158.217 Hong Kong · Dimension Network & Communication Limited | exposed-secret | TXT | 1 | 2026-11-12 |
| 39.105.71.80 China · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret | TXT | 1 | 2026-11-12 |
| 202.95.17.200 Singapore · CTG Server Limited | exposed-secret malware mozi c2 | SH, HTML, JSON, PY | 104 | 2026-11-12 |
| 209.99.184.25 Switzerland · SKN Subnet & Telecom Ltd | malware exposed-secret exploit pe-binary | LOG, PE, ARCHIV, BAT | 96 | 2026-11-12 |
| 209.99.191.184 Switzerland · SKN Subnet & Telecom Ltd | malware mozi exposed-secret exploit | SH, PY, TXT, HTML | 533 | 2026-11-12 |
| 95.40.158.13 China · Amazon.com, Inc. | exposed-secret | TXT, ENV, JSON, PHP | 6 | 2026-11-12 |
| 209.99.184.99 Switzerland · SKN Subnet & Telecom Ltd | malware mozi exposed-secret exploit | SH, TXT, PY, JS | 236 | 2026-11-12 |
| 16.106.22.78 United States | exposed-secret | TXT, JSON, PHP | 8 | 2026-11-12 |
| 95.40.198.195 China · Amazon.com, Inc. | exposed-secret | TXT, JSON, PHP | 8 | 2026-11-12 |
| 23.149.28.46 United States · NetLab Global | exploit malware mozi exposed-secret | PY, SH, LOG, GZ | 1,262 | 2026-11-12 |
| 143.92.56.149 Hong Kong · CTG Server Limited | exposed-secret | TXT | 1 | 2026-11-12 |
| 134.122.169.32 Japan · CTG Server Limited | malware mozi exposed-secret exploit | LOG, PY, SH, TXT | 170 | 2026-11-12 |
| 134.122.169.41 Japan · CTG Server Limited | exposed-secret | TXT, ENV, JSON, PHP | 12 | 2026-11-12 |
| 5.42.107.183 Russia · JSC "TIMEWEB" | exposed-secret exploit malware webshell | LOG, BIN, PEM, PY | 116 | 2026-11-12 |
| 103.12.149.48 Hong Kong · CTG Server Limited | exposed-secret exploit tunnel | TXT, JS, LOG, ENV | 21 | 2026-11-12 |
| 143.92.56.163 Hong Kong · CTG Server Limited | exposed-secret | TXT | 1 | 2026-11-12 |
| 89.223.127.154 Russia · JSC "TIMEWEB" | exposed-secret exploit malware mozi | TXT, HTML, ENV, JSON | 13 | 2026-11-12 |
| 143.92.56.155 Hong Kong · CTG Server Limited | exposed-secret | TXT | 1 | 2026-11-12 |
| 192.252.183.164 United States · CTG Server Limited | exposed-secret | TXT | 1 | 2026-11-12 |
| 119.28.152.20 Hong Kong · Shenzhen Tencent Computer Systems Company Limited | exposed-secret | OVPN, SH | 5 | 2026-11-12 |
| 80.94.92.130 The Netherlands · UNMANAGED LTD | exposed-secret | TXT | 1 | 2026-11-12 |
| 191.96.235.13 United States · Datacamp Limited | exposed-secret exploit malware macho-binary | PY, TXT, SH, MACHO | 27 | 2026-11-12 |
| 199.19.95.66 Canada · Netminders Server Hosting | exposed-secret exploit malware mozi | PY, ELF, OUT, TXT | 57 | 2026-11-12 |
| 199.19.95.67 Canada · Netminders Server Hosting | exposed-secret exploit malware mozi | PY, ELF, OUT, TXT | 57 | 2026-11-12 |
| 199.19.95.68 Canada · Netminders Server Hosting | exposed-secret exploit malware mozi | PY, ELF, OUT, TXT | 57 | 2026-11-12 |
| 163.181.214.145 United States · Zhejiang Taobao Network Co.,Ltd | exposed-secret | TOP | 1 | 2026-11-12 |
| 172.67.176.96 United States · Cloudflare, Inc. | exposed-secret | ASIA | 1 | 2026-11-12 |
| 172.67.168.201 United States · Cloudflare, Inc. | exposed-secret | XYZ | 1 | 2026-11-12 |
| 104.21.54.179 United States · Cloudflare, Inc. | exposed-secret | XYZ | 1 | 2026-11-12 |
| 34.97.138.65 Japan · Google LLC | exposed-secret | COM | 7 | 2026-11-12 |
| 163.181.214.25 United States · Zhejiang Taobao Network Co.,Ltd | exposed-secret | TOP | 1 | 2026-11-12 |
| 163.181.214.6 United States · Zhejiang Taobao Network Co.,Ltd | exposed-secret | WANG | 1 | 2026-11-12 |
| 163.181.214.22 United States · Zhejiang Taobao Network Co.,Ltd | exposed-secret | TOP, TXT | 2 | 2026-11-12 |
| 172.67.177.2 United States · Cloudflare, Inc. | exposed-secret ioc-match | JS, SBS | 2 | 2026-11-12 |
| 104.21.35.154 United States · Cloudflare, Inc. | exposed-secret ioc-match | JS, SBS | 2 | 2026-11-12 |
| 104.21.64.56 United States · Cloudflare, Inc. | exposed-secret | ASIA | 1 | 2026-11-12 |
| 80.76.49.203 United States · 12651980 CANADA INC. | exposed-secret | 1 | 2026-11-12 | |
| 45.63.107.63 United States · The Constant Company, LLC | exposed-secret | TXT, ENV, JSON, PHP | 10 | 2026-11-12 |
| 31.76.94.111 United States · VPSPay Networks LTD | exploit malware exposed-secret mozi | PY, ELF, LOG, SH | 63 | 2026-11-12 |
Page 1 of 60Older →
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free