LeakIX - Host rtm.ced.sa

Domain rtm.ced.sa

Saudi Arabia

ORACLE-BMC-31898

Software information

nginx nginx

tcp/443 tcp/80

MacOS file listing through .DS_Store file

.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).

They store information about the files within a folder, including display options of folders, such as icon positions and view settings.

It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.

IP: 158.101.254.28
Domain: rtm.ced.sa
Port: 443
URL: https://rtm.ced.sa

First seen 2025-09-29 09:15
Last seen 2026-01-31 08:34
Open for 123 days
- Severity: low
  Fingerprint: 5f32cf5d6962f09c11d3744d11d3744de4bc1031c9b65fa25bc03e14c8b25335
```
Found 12 files trough .DS_Store spidering:

/favicon.ico
/index.php
/logo-dark.ico
/logo-dark.png
/logo-dark.svg
/logo.png
/logo.svg
/robots.txt
/storage
/styles
/Unconfirmed 104206.crdownload
/uploads
```
  Found on 2026-01-31 08:34
Create report
MacOS file listing through .DS_Store file

.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).

They store information about the files within a folder, including display options of folders, such as icon positions and view settings.

It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.

IP: 158.101.254.28
Domain: mail.rtm.ced.sa
Port: 80
URL: http://mail.rtm.ced.sa

First seen 2025-09-29 09:15
Last seen 2026-02-08 22:58
Open for 132 days
- Severity: low
  Fingerprint: 5f32cf5d6962f09c11d3744d11d3744de4bc1031c9b65fa25bc03e14c8b25335
```
Found 12 files trough .DS_Store spidering:

/favicon.ico
/index.php
/logo-dark.ico
/logo-dark.png
/logo-dark.svg
/logo.png
/logo.svg
/robots.txt
/storage
/styles
/Unconfirmed 104206.crdownload
/uploads
```
  Found on 2026-02-08 22:58
Create report
MacOS file listing through .DS_Store file

.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).

They store information about the files within a folder, including display options of folders, such as icon positions and view settings.

It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.

IP: 158.101.254.28
Domain: mail.rtm.ced.sa
Port: 443
URL: https://mail.rtm.ced.sa

First seen 2025-09-29 09:15
Last seen 2026-01-31 08:34
Open for 123 days
- Severity: low
  Fingerprint: 5f32cf5d6962f09c11d3744d11d3744de4bc1031c9b65fa25bc03e14c8b25335
```
Found 12 files trough .DS_Store spidering:

/favicon.ico
/index.php
/logo-dark.ico
/logo-dark.png
/logo-dark.svg
/logo.png
/logo.svg
/robots.txt
/storage
/styles
/Unconfirmed 104206.crdownload
/uploads
```
  Found on 2026-01-31 08:34
Create report
MacOS file listing through .DS_Store file

.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).

They store information about the files within a folder, including display options of folders, such as icon positions and view settings.

It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.

IP: 158.101.254.28
Domain: www.rtm.ced.sa
Port: 443
URL: https://www.rtm.ced.sa

First seen 2025-09-29 09:15
Last seen 2026-01-31 08:34
Open for 123 days
- Severity: low
  Fingerprint: 5f32cf5d6962f09c11d3744d11d3744de4bc1031c9b65fa25bc03e14c8b25335
```
Found 12 files trough .DS_Store spidering:

/favicon.ico
/index.php
/logo-dark.ico
/logo-dark.png
/logo-dark.svg
/logo.png
/logo.svg
/robots.txt
/storage
/styles
/Unconfirmed 104206.crdownload
/uploads
```
  Found on 2026-01-31 08:34
Create report
MacOS file listing through .DS_Store file

.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).

They store information about the files within a folder, including display options of folders, such as icon positions and view settings.

It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.

IP: 158.101.254.28
Domain: rtm.ced.sa
Port: 80
URL: http://rtm.ced.sa

First seen 2025-09-29 09:15
Last seen 2026-02-09 20:52
Open for 133 days
- Severity: low
  Fingerprint: 5f32cf5d6962f09c11d3744d11d3744de4bc1031c9b65fa25bc03e14c8b25335
```
Found 12 files trough .DS_Store spidering:

/favicon.ico
/index.php
/logo-dark.ico
/logo-dark.png
/logo-dark.svg
/logo.png
/logo.svg
/robots.txt
/storage
/styles
/Unconfirmed 104206.crdownload
/uploads
```
  Found on 2026-02-09 20:52
Create report
MacOS file listing through .DS_Store file

.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).

They store information about the files within a folder, including display options of folders, such as icon positions and view settings.

It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.

IP: 158.101.254.28
Domain: www.rtm.ced.sa
Port: 80
URL: http://www.rtm.ced.sa

First seen 2025-09-29 09:15
Last seen 2026-02-09 20:52
Open for 133 days
- Severity: low
  Fingerprint: 5f32cf5d6962f09c11d3744d11d3744de4bc1031c9b65fa25bc03e14c8b25335
```
Found 12 files trough .DS_Store spidering:

/favicon.ico
/index.php
/logo-dark.ico
/logo-dark.png
/logo-dark.svg
/logo.png
/logo.svg
/robots.txt
/storage
/styles
/Unconfirmed 104206.crdownload
/uploads
```
  Found on 2026-02-09 20:52
Create report

Open service 158.101.254.28:80 · www.rtm.ced.sa

2026-01-23 14:22

HTTP/1.1 302 Found
Server: nginx
Date: Fri, 23 Jan 2026 14:22:41 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Cache-Control: private, must-revalidate
pragma: no-cache
expires: -1
Set-Cookie: XSRF-TOKEN=eyJpdiI6IkR5VnNBR3l3QVAwenB4UlE0VEtaT1E9PSIsInZhbHVlIjoiKzNZb0lNTS85WFhvcThXR2FRNlRad29peE9rSDZMbW9lNS9LZ0hvNEdkNWNJKzVwQzJMdk9YSEs0eGZOVWtOTTdRNll2eUo5YjBzSE9qTTdpNkRvNjRrTEF0YkhQeXhCZ2UxUTlwZXI3bUwzQTJ1bXcxUkZDcFNRMnlEVlNNNHgiLCJtYWMiOiJiMzA5MTAzNjA0OWY4NzMyOTU5ZTBiOTQ5NWJkYjQzNjUzNjRlYzkxZjE3YmJiYzNhYWZkM2U5NjdlMTFlN2FhIiwidGFnIjoiIn0%3D; expires=Fri, 23 Jan 2026 16:22:41 GMT; Max-Age=7200; path=/; samesite=lax
Set-Cookie: rtm_session=eyJpdiI6IkI2WVoxOGFpMFdHZWRGL1JzNEtnWmc9PSIsInZhbHVlIjoiY25Pa3ZXaVlzc2ZYaUYxUEFwSjFaQjFmS3MyakZSYkhwWW5DRFFTc3dXYUIvbk5GSjFKNVBPMDQ2VmVzVWpkQXVYNFdDOEFzd0JPODlnb2M2SVlMYklEaGtHaisyOVRRbG9hSjhva1BVZHRxcUF3T2hGeldZcjlzSXo2cEJLM2QiLCJtYWMiOiJlYTIxNjMxYTQ0NWFkNDZiMjZmOWRlZmM4NDFiYzk5NjljNjI3NTNmM2Y2YTNhZWJlYzQ3OThiNGIwNmVjMjYzIiwidGFnIjoiIn0%3D; expires=Fri, 23 Jan 2026 16:22:41 GMT; Max-Age=7200; path=/; httponly; samesite=lax
Location: http://www.rtm.ced.sa/admin

Page title: Redirecting to http://www.rtm.ced.sa/admin

<!DOCTYPE html>
<html>
    <head>
        <meta charset="UTF-8" />
        <meta http-equiv="refresh" content="0;url='http://www.rtm.ced.sa/admin'" />

        <title>Redirecting to http://www.rtm.ced.sa/admin</title>
    </head>
    <body>
        Redirecting to <a href="http://www.rtm.ced.sa/admin">http://www.rtm.ced.sa/admin</a>.
    </body>
</html>

Found 2026-01-23 by HttpPlugin

Create report

Open service 158.101.254.28:80 · rtm.ced.sa

2026-01-23 12:58

HTTP/1.1 302 Found
Server: nginx
Date: Fri, 23 Jan 2026 12:58:02 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Cache-Control: private, must-revalidate
pragma: no-cache
expires: -1
Set-Cookie: XSRF-TOKEN=eyJpdiI6InBEUnlSWTF6d3kwTUhDNVFLS3I3akE9PSIsInZhbHVlIjoiNmVTZG9pMHhCQnF2UDY0UTltVGM1UGZIWmFjaDkxQUsrazgxc1JHa0V0aGk4N2ZuTkJiQ0w3K1RpTTFKVTdHd0N2OVlYYUxLVGs1eWlNL3oxRk5VempKNnZ0QlMzQXlSQmhqUlhaMzZRQWtOQTVpcm9wYmxxbFBjZmNOQmRkcVkiLCJtYWMiOiI3MGIxNTI5Zjc3ZGEwMzhkZGRjYmJhMDQ1YjEwMWVmNGIyYzk5MmUwODI0N2M3NTczMGM4YjM5MmRjMGUyZjU0IiwidGFnIjoiIn0%3D; expires=Fri, 23 Jan 2026 14:58:02 GMT; Max-Age=7200; path=/; samesite=lax
Set-Cookie: rtm_session=eyJpdiI6ImJwS0YvWENLYlZIbTdhYlpRUVV1VFE9PSIsInZhbHVlIjoidjVZSDJzSGlZTUJXSk9EZFJOUkJHS1Rzeks2MWdrS2hQMmhidzdwTW8vNHhOQUFBZm95Q2xxZ01BSTFNcUxrQlJ2eDRCRVBuTEJXTXR2UThiM09rMUZ2WmJ5ckxWWjVIUTkzMjh3dWxrYXMxZStMWUhrazJoZXlYUGw0YktObzAiLCJtYWMiOiI3ODE3NTM1ZmYxNmExYjMwOTFmNGIyNWQzYWU3MTY0ZDBhMzU3MzAxMDAyZjEyYjI1NzQxM2VhM2IwNTYzYjAwIiwidGFnIjoiIn0%3D; expires=Fri, 23 Jan 2026 14:58:02 GMT; Max-Age=7200; path=/; httponly; samesite=lax
Location: http://rtm.ced.sa/admin

Page title: Redirecting to http://rtm.ced.sa/admin

<!DOCTYPE html>
<html>
    <head>
        <meta charset="UTF-8" />
        <meta http-equiv="refresh" content="0;url='http://rtm.ced.sa/admin'" />

        <title>Redirecting to http://rtm.ced.sa/admin</title>
    </head>
    <body>
        Redirecting to <a href="http://rtm.ced.sa/admin">http://rtm.ced.sa/admin</a>.
    </body>
</html>

Found 2026-01-23 by HttpPlugin

Create report

Open service 158.101.254.28:443 · rtm.ced.sa

2026-01-23 02:26

HTTP/1.1 302 Found
Server: nginx
Date: Fri, 23 Jan 2026 02:26:53 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Cache-Control: private, must-revalidate
pragma: no-cache
expires: -1
Set-Cookie: XSRF-TOKEN=eyJpdiI6IlljSFQvb2x1clUwYlRCMExQYzEwaEE9PSIsInZhbHVlIjoiaVBpaGVHdjU0QllPRlpWK09JdGpkbHRIeTJlS1dnLzdpRlUyV0tmTmJtd09mS0JXaGhERTFlSEVIbEFhdURSOFNreEFDNHVyMVhRNmpabk1yQWRYNk0rMmhMdTBteFFkY2tSNjNncm9TWVJ6anN3T2xnd0xsSFdGMVBpWjlOZy8iLCJtYWMiOiI1OWFiNDgzMjNjZmYwNzE5N2VjYjNhNGU4N2JiMTVkZDdmYmY2ZDk1NjY1NmEyNzk5ZDM3MTMxNzc4NjdhZjNjIiwidGFnIjoiIn0%3D; expires=Fri, 23 Jan 2026 04:26:52 GMT; Max-Age=7199; path=/; secure; samesite=lax
Set-Cookie: rtm_session=eyJpdiI6ImNRSDZUYWZmeG9vTEc1RllYditZUlE9PSIsInZhbHVlIjoib3U1czNnMjJUZlVub2hDMzAyZFd2V1did3JKR0t0SlVETWhBSXMyb05uZWtSTldkR3ZHemloR1Y4V0ZQVU9KTEpuTUdBNEtjSlBObml0S0FONUZXeUpzYzE4WnJ1ZlVGdG5yZzFhNm52TTdsTEI2VE41NEpaZmtCYWU4RTJaa1EiLCJtYWMiOiJiODMwZDQ3OTVlN2QxYzM4NGQxZWY5ZmFhN2Q3MTEwOTk3NDVmYzY1Y2QwNzljYmJiOTQ5NDljODZmYTllN2VhIiwidGFnIjoiIn0%3D; expires=Fri, 23 Jan 2026 04:26:52 GMT; Max-Age=7199; path=/; secure; httponly; samesite=lax
Location: https://rtm.ced.sa/admin

Page title: Redirecting to https://rtm.ced.sa/admin

<!DOCTYPE html>
<html>
    <head>
        <meta charset="UTF-8" />
        <meta http-equiv="refresh" content="0;url='https://rtm.ced.sa/admin'" />

        <title>Redirecting to https://rtm.ced.sa/admin</title>
    </head>
    <body>
        Redirecting to <a href="https://rtm.ced.sa/admin">https://rtm.ced.sa/admin</a>.
    </body>
</html>

Found 2026-01-23 by HttpPlugin

Create report

Open service 158.101.254.28:80 · rtm.ced.sa

2026-01-10 01:57

HTTP/1.1 302 Found
Server: nginx
Date: Sat, 10 Jan 2026 01:57:48 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Cache-Control: private, must-revalidate
pragma: no-cache
expires: -1
Set-Cookie: XSRF-TOKEN=eyJpdiI6InV5K3MwZmJtbEo4UlhLZ0NzVm11K2c9PSIsInZhbHVlIjoiYVdyeGZRTlUwbklvRVpWYVVlZ3NFKzI1RXFkcVlPSjVGdW5QVzcvZjZEOWRMdVZMeDU1bGNzMlZIV2J2YUFMY3NhSmJ6ZXNGbGtuZmFtdDNlRHViUGV0YkdObjVQUC9FNml5VHlVQmZ3SUxwY2thbFg5TnFGVy95WXF0K2p4Yi8iLCJtYWMiOiI5NmRhYzcxZjI0MDMwY2ExOGU0ODU4Y2I4ODYyZjdmNWE3MmViNmQ2MThjMmJkYTRlOTAzYTVmYTQ0ZDM5MzExIiwidGFnIjoiIn0%3D; expires=Sat, 10 Jan 2026 03:57:48 GMT; Max-Age=7200; path=/; samesite=lax
Set-Cookie: rtm_session=eyJpdiI6Ikg3ZnFrTEhPZUJON2dqdUlVMklRRWc9PSIsInZhbHVlIjoiQUxDbzh1QThZQzRkM1lRaXV6WmJqa2FSSXJUdDBCUzJlaVBZWVlPWnhsVzVVbmxVVlFoZGplcS80dy9ZRjJiUmtnZTZhZVZPeW5mOUlFODNoa2NPTjk5K3FjbkxvVEw0TVJJR28zWHBQVzRzdjlPWmRRR2dsRFpvYjhRdkl1NSsiLCJtYWMiOiJhODVkZmY0M2VhNWFjNTM1YmIwYzVjMDQ2YzQ4ZmY3YjdjNGJlYTkzZWM1YjAwNjcyNzJjZjc0NTdjZTA0MjU2IiwidGFnIjoiIn0%3D; expires=Sat, 10 Jan 2026 03:57:48 GMT; Max-Age=7200; path=/; httponly; samesite=lax
Location: http://rtm.ced.sa/admin

Page title: Redirecting to http://rtm.ced.sa/admin

<!DOCTYPE html>
<html>
    <head>
        <meta charset="UTF-8" />
        <meta http-equiv="refresh" content="0;url='http://rtm.ced.sa/admin'" />

        <title>Redirecting to http://rtm.ced.sa/admin</title>
    </head>
    <body>
        Redirecting to <a href="http://rtm.ced.sa/admin">http://rtm.ced.sa/admin</a>.
    </body>
</html>

Found 2026-01-10 by HttpPlugin

Create report

autodiscover.rtm.ced.sacpanel.rtm.ced.sacpcalendars.rtm.ced.sacpcontacts.rtm.ced.samail.rtm.ced.sartm.ced.sawebdisk.rtm.ced.sawebmail.rtm.ced.sawww.rtm.ced.sa

Fingerprint:

742a98108e8e81e0c8903efd89ddfde35c82d055afbf4303dc6fa8947195eacc

CN:

webdisk.rtm.ced.sa

Key:

RSA-2048

Issuer:

R12

Not before:

2025-11-29 08:16

Not after:

2026-02-27 08:16

Domain summary

www.rtm.ced.sa 2 rtm.ced.sa 4 mail.rtm.ced.sa 2

3 recorded

IP summary

158.101.254.28 5

1 recorded

Domain rtm.ced.sa

Saudi Arabia

Software information

MacOS file listing through .DS_Store file

MacOS file listing through .DS_Store file

MacOS file listing through .DS_Store file

MacOS file listing through .DS_Store file

MacOS file listing through .DS_Store file

MacOS file listing through .DS_Store file

Create report

Create report

Create report

Create report

autodiscover.rtm.ced.sacpanel.rtm.ced.sacpcalendars.rtm.ced.sacpcontacts.rtm.ced.samail.rtm.ced.sartm.ced.sawebdisk.rtm.ced.sawebmail.rtm.ced.sawww.rtm.ced.sa

Domain summary

IP summary