Live findsCVE IntelResearchConsoleStart free
huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

5,965
hosts
106,472
files
103
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 2996malware 1224exploit 1134mozi 921c2 314webshell 282ioc-match 88coinminer 66gafgyt 56tsunami 41mirai 38sliver 31meterpreter 16havoc 15

Hosts labelled malware

HostLabelsFile typesFilesLast seen
5.39.10.254
France · OVH SAS
malware elf-binaryELF12026-11-12
209.99.190.93
Switzerland · SKN Subnet & Telecom Ltd
malware ioc-match pe-binaryPE32026-11-12
45.194.88.27
Pakistan · Prime Networks
malware mozi elf-binary12026-11-12
41.223.30.7
CM · Creolink Communications
exploit exposed-secret malware moziPY, JSON, BIN, LOG7122026-11-12
217.198.6.226
Russia · JSC "TIMEWEB"
exposed-secret malware exploit webshellMD, LOG, PE, TXT2622026-11-12
202.162.109.6
Australia · CTG Server Limited
exploit exposed-secret malware moziLOG, SH, PY, BIN1162026-11-12
143.92.57.247
Hong Kong · CTG Server Limited
exploit exposed-secret malware moziLOG, SH, PY, BIN1162026-11-12
5.129.198.149
Russia · JSC "TIMEWEB"
exposed-secret exploit c2 webshellPY, PHP, LOG, JS1232026-11-12
202.162.109.5
Australia · CTG Server Limited
exploit exposed-secret malware moziLOG, PY, SH, BIN1612026-11-12
202.95.17.200
Singapore · CTG Server Limited
exposed-secret malware mozi c2SH, HTML, JSON, PY1042026-11-12
209.99.184.25
Switzerland · SKN Subnet & Telecom Ltd
malware exposed-secret exploit pe-binaryLOG, PE, ARCHIV, BAT962026-11-12
209.99.191.184
Switzerland · SKN Subnet & Telecom Ltd
malware mozi exposed-secret exploitSH, PY, TXT, HTML5332026-11-12
209.99.184.99
Switzerland · SKN Subnet & Telecom Ltd
malware mozi exposed-secret exploitSH, TXT, PY, JS2362026-11-12
23.149.28.46
United States · NetLab Global
exploit malware mozi exposed-secretPY, SH, LOG, GZ1,2622026-11-12
134.122.169.32
Japan · CTG Server Limited
malware mozi exposed-secret exploitLOG, PY, SH, TXT1702026-11-12
5.42.107.183
Russia · JSC "TIMEWEB"
exposed-secret exploit malware webshellLOG, BIN, PEM, PY1162026-11-12
89.223.127.154
Russia · JSC "TIMEWEB"
exposed-secret exploit malware moziTXT, HTML, ENV, JSON132026-11-12
191.96.235.13
United States · Datacamp Limited
exposed-secret exploit malware macho-binaryPY, TXT, SH, MACHO272026-11-12
204.141.236.157
United States · NTT America, Inc.
malware elf-binaryELF, SH142026-11-12
199.19.95.66
Canada · Netminders Server Hosting
exposed-secret exploit malware moziPY, ELF, OUT, TXT572026-11-12
199.19.95.67
Canada · Netminders Server Hosting
exposed-secret exploit malware moziPY, ELF, OUT, TXT572026-11-12
199.19.95.68
Canada · Netminders Server Hosting
exposed-secret exploit malware moziPY, ELF, OUT, TXT572026-11-12
157.20.241.16
India · JOY SERVICES
coinminer malware tunnelBIN, SH22026-11-12
31.76.94.111
United States · VPSPay Networks LTD
exploit malware exposed-secret moziPY, ELF, LOG, SH632026-11-12
43.245.227.44
The Netherlands · HOSTKEY B.V.
malware moziPY, PYC, ZIP142026-11-12
144.91.73.103
France · Contabo GmbH
exposed-secret malware mozi exploitPY, SH, TXT, PS15632026-11-12
51.83.237.43
Poland · OVH SAS
malware mozi exposed-secretTXT, ENV, JSON, PHP182026-11-12
159.69.101.222
Germany · Hetzner Online GmbH
malware mozi exposed-secretTXT, ENV, JSON, PHP92026-11-12
51.75.146.212
Germany · OVH SAS
malware mozi exposed-secretTXT, ENV, JSON, PHP182026-11-12
116.202.28.215
Germany · Hetzner Online GmbH
malware mozi exposed-secretTXT, ENV, JSON, PHP182026-11-12
172.104.185.244
Singapore · Akamai Technologies, Inc.
exposed-secret malware moziTXT12026-11-12
174.138.48.6
United States · DigitalOcean, LLC
malware mozi exposed-secretTXT, ENV, JSON, PHP92026-11-12
159.69.76.99
Germany · Hetzner Online GmbH
malware mozi exposed-secretTXT, ENV, JSON, PHP92026-11-12
45.56.120.49
United States · Akamai Technologies, Inc.
malware mozi exposed-secretTXT, ENV, JSON, PHP92026-11-12
91.134.102.116
France · OVH SAS
malware mozi exposed-secretTXT, ENV, JSON, PHP92026-11-12
13.184.160.159
United States
exposed-secret exploit malware moziPY, SH, LOG, GO1,0292026-11-12
168.144.111.89
Singapore · DigitalOcean, LLC
exposed-secret exploit webshell malwareTXT, HTML, PHP, SH3282026-11-12
112.225.228.141
China · CHINA UNICOM China169 Backbone
malware mozi elf-binaryA12026-11-12
20.26.156.215
United Kingdom · Microsoft Corporation
exposed-secret exploit malware pe-binaryTXT, BAT, PE, TOML332026-11-12
115.159.204.46
China · Shenzhen Tencent Computer Systems Company Limited
exposed-secret exploit malware gafgytPY, LOG, JSON, MD1672026-11-12
141.0.143.61
Norway · Svorka AS
malware mozi elf-binaryA12026-11-12
104.21.73.144
United States · Cloudflare, Inc.
malware moziCOM, PS122026-11-12
172.67.145.149
United States · Cloudflare, Inc.
malware moziCOM, PS122026-11-12
206.189.167.156
United States · DigitalOcean, LLC
malware mozi exposed-secret exploitPY, SH, MD, TXT3262026-11-12
217.160.132.82
Spain · IONOS SE
exposed-secret exploit malware moziPY, SH, PHP, TXT9112026-11-12
196.251.121.142
Seychelles · AS219443
malware elf-binaryELF42026-11-11
193.180.209.78
Denmark · Webdock.io ApS
malware exploit c2 moziSH, PE, ZIP, GO322026-11-11
201.159.91.2
Brazil · Abenet Provedora de Acesso a Internet LTDA
malware mozi elf-binaryA12026-11-11
196.251.107.48
Seychelles · FEMO IT SOLUTIONS LIMITED
malware pe-binaryPE32026-11-11
199.91.221.237
United States · BL Networks
c2 exposed-secret exploit malwareJS22026-11-11
Page 1 of 25Older →
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free