Live findsCVE IntelResearchConsoleStart free
huntback / loot

Loot index

When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.

5,965
hosts
106,472
files
103
new hosts in 24h

What this page answers

What do attackers keep on their own servers?

SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host

How we collect it →

All hostsexposed-secret 2996malware 1224exploit 1134mozi 921c2 314webshell 282ioc-match 88coinminer 66gafgyt 56tsunami 41mirai 38sliver 31meterpreter 16havoc 15

Hosts labelled mozi

HostLabelsFile typesFilesLast seen
45.194.88.27
Pakistan · Prime Networks
malware mozi elf-binary12026-11-12
41.223.30.7
CM · Creolink Communications
exploit exposed-secret malware moziPY, JSON, BIN, LOG7122026-11-12
217.198.6.226
Russia · JSC "TIMEWEB"
exposed-secret malware exploit webshellMD, LOG, PE, TXT2622026-11-12
202.162.109.6
Australia · CTG Server Limited
exploit exposed-secret malware moziLOG, SH, PY, BIN1162026-11-12
143.92.57.247
Hong Kong · CTG Server Limited
exploit exposed-secret malware moziLOG, SH, PY, BIN1162026-11-12
202.162.109.5
Australia · CTG Server Limited
exploit exposed-secret malware moziLOG, PY, SH, BIN1612026-11-12
202.95.17.200
Singapore · CTG Server Limited
exposed-secret malware mozi c2SH, HTML, JSON, PY1042026-11-12
209.99.191.184
Switzerland · SKN Subnet & Telecom Ltd
malware mozi exposed-secret exploitSH, PY, TXT, HTML5332026-11-12
209.99.184.99
Switzerland · SKN Subnet & Telecom Ltd
malware mozi exposed-secret exploitSH, TXT, PY, JS2362026-11-12
23.149.28.46
United States · NetLab Global
exploit malware mozi exposed-secretPY, SH, LOG, GZ1,2622026-11-12
134.122.169.32
Japan · CTG Server Limited
malware mozi exposed-secret exploitLOG, PY, SH, TXT1702026-11-12
89.223.127.154
Russia · JSC "TIMEWEB"
exposed-secret exploit malware moziTXT, HTML, ENV, JSON132026-11-12
199.19.95.66
Canada · Netminders Server Hosting
exposed-secret exploit malware moziPY, ELF, OUT, TXT572026-11-12
199.19.95.67
Canada · Netminders Server Hosting
exposed-secret exploit malware moziPY, ELF, OUT, TXT572026-11-12
199.19.95.68
Canada · Netminders Server Hosting
exposed-secret exploit malware moziPY, ELF, OUT, TXT572026-11-12
31.76.94.111
United States · VPSPay Networks LTD
exploit malware exposed-secret moziPY, ELF, LOG, SH632026-11-12
43.245.227.44
The Netherlands · HOSTKEY B.V.
malware moziPY, PYC, ZIP142026-11-12
144.91.73.103
France · Contabo GmbH
exposed-secret malware mozi exploitPY, SH, TXT, PS15632026-11-12
51.83.237.43
Poland · OVH SAS
malware mozi exposed-secretTXT, ENV, JSON, PHP182026-11-12
159.69.101.222
Germany · Hetzner Online GmbH
malware mozi exposed-secretTXT, ENV, JSON, PHP92026-11-12
51.75.146.212
Germany · OVH SAS
malware mozi exposed-secretTXT, ENV, JSON, PHP182026-11-12
116.202.28.215
Germany · Hetzner Online GmbH
malware mozi exposed-secretTXT, ENV, JSON, PHP182026-11-12
172.104.185.244
Singapore · Akamai Technologies, Inc.
exposed-secret malware moziTXT12026-11-12
174.138.48.6
United States · DigitalOcean, LLC
malware mozi exposed-secretTXT, ENV, JSON, PHP92026-11-12
159.69.76.99
Germany · Hetzner Online GmbH
malware mozi exposed-secretTXT, ENV, JSON, PHP92026-11-12
45.56.120.49
United States · Akamai Technologies, Inc.
malware mozi exposed-secretTXT, ENV, JSON, PHP92026-11-12
91.134.102.116
France · OVH SAS
malware mozi exposed-secretTXT, ENV, JSON, PHP92026-11-12
13.184.160.159
United States
exposed-secret exploit malware moziPY, SH, LOG, GO1,0292026-11-12
168.144.111.89
Singapore · DigitalOcean, LLC
exposed-secret exploit webshell malwareTXT, HTML, PHP, SH3282026-11-12
112.225.228.141
China · CHINA UNICOM China169 Backbone
malware mozi elf-binaryA12026-11-12
115.159.204.46
China · Shenzhen Tencent Computer Systems Company Limited
exposed-secret exploit malware gafgytPY, LOG, JSON, MD1672026-11-12
141.0.143.61
Norway · Svorka AS
malware mozi elf-binaryA12026-11-12
104.21.73.144
United States · Cloudflare, Inc.
malware moziCOM, PS122026-11-12
172.67.145.149
United States · Cloudflare, Inc.
malware moziCOM, PS122026-11-12
206.189.167.156
United States · DigitalOcean, LLC
malware mozi exposed-secret exploitPY, SH, MD, TXT3262026-11-12
217.160.132.82
Spain · IONOS SE
exposed-secret exploit malware moziPY, SH, PHP, TXT9112026-11-12
193.180.209.78
Denmark · Webdock.io ApS
malware exploit c2 moziSH, PE, ZIP, GO322026-11-11
201.159.91.2
Brazil · Abenet Provedora de Acesso a Internet LTDA
malware mozi elf-binaryA12026-11-11
199.91.221.237
United States · BL Networks
c2 exposed-secret exploit malwareJS22026-11-11
149.28.139.214
Singapore · The Constant Company, LLC
malware mozi exposed-secretTXT, ENV, JSON, PHP182026-11-11
51.83.108.104
France · OVH SAS
malware mozi exposed-secretTXT, ENV, JSON, PHP182026-11-11
176.9.125.11
Germany · Hetzner Online GmbH
malware mozi exposed-secretTXT, ENV, JSON, PHP182026-11-11
185.34.144.137
United States · CNServer LLC
malware mozi exposed-secret elf-binaryELF, MACHO, BAT, JAR2692026-11-11
47.22.166.163
United States · Cablevision Systems Corp.
malware mozi elf-binaryA12026-11-11
23.88.104.213
Germany · Hetzner Online GmbH
exposed-secret malware moziTXT22026-11-11
45.63.71.130
United States · The Constant Company, LLC
malware mozi exposed-secretTXT, ENV, JSON, PHP362026-11-11
45.77.179.49
Japan · The Constant Company, LLC
malware mozi exposed-secretTXT, ENV, JSON, PHP92026-11-11
46.224.139.234
Germany · Hetzner Online GmbH
malware mozi exposed-secretTXT42026-11-10
46.225.33.61
Germany · Hetzner Online GmbH
malware mozi exposed-secretTXT, ENV, JSON, PHP182026-11-10
185.199.108.133
United States · Fastly, Inc.
exploit ioc-match malware moziBAT, DBF, HTA, PS152026-11-10
Page 1 of 19Older →
Open the files, hashes and zips

Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.

Start hunting free