huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,965
hosts
106,472
files
103
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled webshell
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 41.223.30.7 CM · Creolink Communications | exploit exposed-secret malware mozi | PY, JSON, BIN, LOG | 712 | 2026-11-12 |
| 217.198.6.226 Russia · JSC "TIMEWEB" | exposed-secret malware exploit webshell | MD, LOG, PE, TXT | 262 | 2026-11-12 |
| 202.162.109.6 Australia · CTG Server Limited | exploit exposed-secret malware mozi | LOG, SH, PY, BIN | 116 | 2026-11-12 |
| 143.92.57.247 Hong Kong · CTG Server Limited | exploit exposed-secret malware mozi | LOG, SH, PY, BIN | 116 | 2026-11-12 |
| 5.129.198.149 Russia · JSC "TIMEWEB" | exposed-secret exploit c2 webshell | PY, PHP, LOG, JS | 123 | 2026-11-12 |
| 202.162.109.5 Australia · CTG Server Limited | exploit exposed-secret malware mozi | LOG, PY, SH, BIN | 161 | 2026-11-12 |
| 202.95.17.200 Singapore · CTG Server Limited | exposed-secret malware mozi c2 | SH, HTML, JSON, PY | 104 | 2026-11-12 |
| 209.99.191.184 Switzerland · SKN Subnet & Telecom Ltd | malware mozi exposed-secret exploit | SH, PY, TXT, HTML | 533 | 2026-11-12 |
| 23.149.28.46 United States · NetLab Global | exploit malware mozi exposed-secret | PY, SH, LOG, GZ | 1,262 | 2026-11-12 |
| 5.42.107.183 Russia · JSC "TIMEWEB" | exposed-secret exploit malware webshell | LOG, BIN, PEM, PY | 116 | 2026-11-12 |
| 199.19.95.66 Canada · Netminders Server Hosting | exposed-secret exploit malware mozi | PY, ELF, OUT, TXT | 57 | 2026-11-12 |
| 199.19.95.67 Canada · Netminders Server Hosting | exposed-secret exploit malware mozi | PY, ELF, OUT, TXT | 57 | 2026-11-12 |
| 199.19.95.68 Canada · Netminders Server Hosting | exposed-secret exploit malware mozi | PY, ELF, OUT, TXT | 57 | 2026-11-12 |
| 31.76.94.111 United States · VPSPay Networks LTD | exploit malware exposed-secret mozi | PY, ELF, LOG, SH | 63 | 2026-11-12 |
| 144.91.73.103 France · Contabo GmbH | exposed-secret malware mozi exploit | PY, SH, TXT, PS1 | 563 | 2026-11-12 |
| 13.184.160.159 United States | exposed-secret exploit malware mozi | PY, SH, LOG, GO | 1,029 | 2026-11-12 |
| 168.144.111.89 Singapore · DigitalOcean, LLC | exposed-secret exploit webshell malware | TXT, HTML, PHP, SH | 328 | 2026-11-12 |
| 115.159.204.46 China · Shenzhen Tencent Computer Systems Company Limited | exposed-secret exploit malware gafgyt | PY, LOG, JSON, MD | 167 | 2026-11-12 |
| 206.189.167.156 United States · DigitalOcean, LLC | malware mozi exposed-secret exploit | PY, SH, MD, TXT | 326 | 2026-11-12 |
| 217.160.132.82 Spain · IONOS SE | exposed-secret exploit malware mozi | PY, SH, PHP, TXT | 911 | 2026-11-12 |
| 52.172.140.8 India · Microsoft Corporation | exposed-secret exploit c2 webshell | SH, PY, LOG, SQL | 297 | 2026-11-10 |
| 152.42.162.237 Singapore · DigitalOcean, LLC | exposed-secret exploit malware mozi | PY, TXT, LOG, ELF | 135 | 2026-11-09 |
| 163.52.135.151 unknown network | exposed-secret exploit webshell malware | PY, HTML, TXT, PHP | 611 | 2026-11-09 |
| 168.144.157.73 India · DigitalOcean, LLC | exposed-secret malware mozi exploit | PY, SH, JS, TXT | 633 | 2026-11-09 |
| 147.182.133.56 United States · DigitalOcean, LLC | exposed-secret malware exploit c2 | BIN, TXT, PE, HTML | 237 | 2026-11-09 |
| 104.248.53.161 United States · DigitalOcean, LLC | exploit exposed-secret webshell tunnel | PY, LOG, SH, HTML | 374 | 2026-11-09 |
| 8.138.12.59 Singapore · Hangzhou Alibaba Advertising Co.,Ltd. | exposed-secret exploit malware mozi | PY, JS, LOG, SH | 99 | 2026-11-09 |
| 130.94.95.155 Indonesia · NTT America, Inc. | exposed-secret malware mozi c2 | PY, HTML, LOG, JSON | 316 | 2026-11-09 |
| 146.19.213.192 Russia · ALEXHOST SRL | malware exposed-secret mozi exploit | PY, SH, LOG, TXT | 1,270 | 2026-11-09 |
| 173.231.222.210 United States · InMotion Hosting, Inc. | exposed-secret malware mozi exploit | GZ, SQL, PHP | 28 | 2026-11-08 |
| 64.176.34.176 Japan · The Constant Company, LLC | malware c2 mozi webshell | PY, SH, TXT, ELF | 26 | 2026-11-08 |
| 124.198.131.63 United States · 1337 Services GmbH | exposed-secret malware exploit mozi | PY, SH, PE, RAR | 217 | 2026-11-08 |
| 179.43.171.203 Panama · Private Layer INC | exposed-secret exploit malware mozi | LOG, PY, JSON, TXT | 76 | 2026-11-08 |
| 179.43.171.202 Panama · Private Layer INC | exposed-secret exploit malware mozi | LOG, PY, JSON, TXT | 76 | 2026-11-08 |
| 130.94.44.130 Singapore · NTT America, Inc. | exposed-secret exploit webshell malware | TXT, PS1, PY, TOML | 98 | 2026-11-07 |
| 143.244.38.134 United Kingdom · Datacamp Limited | exploit webshell | PHP, PS1, XYZ | 3 | 2026-11-07 |
| 193.99.144.85 Germany · Plus.line AG | exploit webshell exposed-secret | HTML, TXT | 3 | 2026-11-07 |
| 38.60.91.186 United States · FASTNET DATA INC | exposed-secret malware mozi exploit | SH, PY, LOG, TXT | 1,039 | 2026-11-07 |
| 195.26.246.148 United States · Contabo Inc. | exposed-secret webshell exploit tunnel | TXT, SAMPLE, PY, TGZ | 54 | 2026-11-07 |
| 192.236.152.232 United States · HostPapa | exploit exposed-secret malware mozi | PY, TXT, SH, LOG | 241 | 2026-11-07 |
| 3.84.186.180 United States · Amazon.com, Inc. | exposed-secret malware mozi exploit | PY, HTML, JS, TXT | 829 | 2026-11-07 |
| 3.128.117.168 United States · Amazon.com, Inc. | exposed-secret exploit malware mozi | PHP, JS, BIN, DB | 256 | 2026-11-07 |
| 64.23.240.211 United States · DigitalOcean, LLC | malware exploit coinminer exposed-secret | PY, LOG, TXT, SH | 386 | 2026-11-07 |
| 13.215.184.109 Singapore · Amazon.com, Inc. | exposed-secret malware exploit mozi | JSON, TXT, SH, PY | 136 | 2026-11-07 |
| 3.26.94.147 Australia · Amazon.com, Inc. | c2 exploit malware exposed-secret | PY, TOC, PE, MD | 67 | 2026-11-07 |
| 13.63.179.207 Sweden · Amazon.com, Inc. | exposed-secret malware mozi c2 | TXT, APK, GITIGN, KEYSTO | 39 | 2026-11-07 |
| 89.36.231.178 France · ROCKHOSTER PRIVATE LIMITED | malware coinminer exploit c2 | XML, SH, BAT, JAR | 281 | 2026-11-07 |
| 47.99.157.12 China · Hangzhou Alibaba Advertising Co.,Ltd. | exploit exposed-secret malware webshell | PY, SH, PHP, C | 14 | 2026-11-06 |
| 110.42.215.163 China · Shenzhen Tencent Computer Systems Company Limited | exploit exposed-secret malware mozi | GO, LOG, PY, PS1 | 317 | 2026-11-06 |
| 185.28.119.18 United Kingdom · BlueVPS OU | exploit exposed-secret webshell malware | MD, PY, SH, LOG | 160 | 2026-11-05 |
Page 1 of 6Older →
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free