LeakIX - Host 63.134.146.46

Host 63.134.146.46

United States

1-JOINK

Software information

Apache Apache

tcp/8080

Exposed GoAnywhere MFT administration interface

Exposed GoAnywhere MFT are subject to an unfixed 0day RCE and should be considered unsafe when made public.

IP: 63.134.146.46
Port: 8000
URL: http://63.134.146.46:8000

First seen 2022-11-25 05:32
Last seen 2024-01-06 22:46
Open for 407 days

Severity: critical
Fingerprint: b1a07937af044f4619de6baab5894bf3b5894bf3b5894bf3b5894bf3b5894bf3
```
Found vulnerable GoAnywhere MFT:
Affected by CVE-2023-0669
```
Found on 2024-01-06 22:46

Fingerprint: b1a07937a2043ad77ce9e52b4e075f217aecd68c7a120d1be748c09b5e168227

Server: Apache-Coyote/1.1
Set-Cookie: RSESSIONID=A4E0FBACD0F4C7ACEA3A8D20390F5D9D; Path=/; HttpOnly
Location: /goanywhere
Content-Type: text/html;charset=UTF-8
Content-Length: 0
Date: Sun, 18 Dec 2022 13:01:55 GMT
Connection: close

Found on 2022-12-18 13:01

Fingerprint: b1a07937a2043ad77ce9e52b35ebb49486d1a19b2830214e7c4d0e84a1672466

Server: Apache-Coyote/1.1
Set-Cookie: RSESSIONID=5F2189EA5B0899A80B0751F37F3F88D4; Path=/; HttpOnly
Location: /goanywhere
Content-Type: text/html;charset=UTF-8
Content-Length: 0
Date: Fri, 09 Dec 2022 06:40:21 GMT
Connection: close

Found on 2022-12-09 06:40

Fingerprint: b1a07937a2043ad77ce9e52b0398df65cef0e9784e8fa527f6b53e4fd6b1a5e3

Server: Apache-Coyote/1.1
Set-Cookie: RSESSIONID=3453A615E8A895F3CE08FEF5C8BD8E6C; Path=/; HttpOnly
Location: /goanywhere
Content-Type: text/html;charset=UTF-8
Content-Length: 0
Date: Tue, 29 Nov 2022 00:44:43 GMT
Connection: close

Found on 2022-11-29 00:44

Fingerprint: b1a07937a2043ad77ce9e52b04af8be51cd22ef8fff055a7285477cf09034a63

Server: Apache-Coyote/1.1
Set-Cookie: RSESSIONID=E610878C98267BACCEE8E794B7517288; Path=/; HttpOnly
Location: /goanywhere
Content-Type: text/html;charset=UTF-8
Content-Length: 0
Date: Fri, 25 Nov 2022 05:32:06 GMT
Connection: close

Found on 2022-11-25 05:32

Create report

Exposed GoAnywhere MFT administration interface

Exposed GoAnywhere MFT are subject to an unfixed 0day RCE and should be considered unsafe when made public.

IP: 63.134.146.46
Port: 8001
URL: https://63.134.146.46:8001

First seen 2022-12-11 06:34
Last seen 2024-01-06 22:27
Open for 391 days

Severity: critical
Fingerprint: b1a07937af044f4619de6baab5894bf3b5894bf3b5894bf3b5894bf3b5894bf3
```
Found vulnerable GoAnywhere MFT:
Affected by CVE-2023-0669
```
Found on 2024-01-06 22:27

Fingerprint: b1a07937b9045eb39aa85ab5375b781107ca6b0e8e8dda9def171838e12db4f0

HTTP/1.1 302 Found
Server: Apache-Coyote/1.1
Set-Cookie: RSESSIONID=C0BD971FA9252D8B52D74633EAF78EB0; Path=/; Secure; HttpOnly
Location: /goanywhere
Content-Type: text/html;charset=UTF-8
Content-Length: 0
Date: Fri, 03 Feb 2023 06:39:55 GMT
Connection: close

Found on 2023-02-03 06:39

Fingerprint: b1a07937a2043ad77ce9e52bc6cd1b1e206828add813b1e8f96d2596f5b08f20

Server: Apache-Coyote/1.1
Set-Cookie: RSESSIONID=921CE4C88AFFB52DA527FFA89F73A246; Path=/; Secure; HttpOnly
Location: /goanywhere
Content-Type: text/html;charset=UTF-8
Content-Length: 0
Date: Wed, 14 Dec 2022 15:19:32 GMT
Connection: close

Found on 2022-12-14 15:19

Fingerprint: b1a07937a2043ad77ce9e52bc5d3f9bd373800902f91132ff41c148771e50ffb

Server: Apache-Coyote/1.1
Set-Cookie: RSESSIONID=BBD5B44BAF21597E48E0329937A7D6A0; Path=/; Secure; HttpOnly
Location: /goanywhere
Content-Type: text/html;charset=UTF-8
Content-Length: 0
Date: Sun, 11 Dec 2022 06:34:37 GMT
Connection: close

Found on 2022-12-11 06:34

Create report

Open service 63.134.146.46:22

2024-12-17 19:55
Found 2024-12-17 by SSHOpenPlugin
Create report

Open service 63.134.146.46:8080

2024-12-17 18:40

HTTP/1.1 403 Forbidden
Date: Tue, 17 Dec 2024 18:40:12 GMT
Server: Apache
Access-Control-Allow-Origin: puimobile://localhost
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Max-Age: 1000
Access-Control-Allow-Headers: X-Requested-With, Content-Type, Origin, Authorization, Accept
Content-Length: 224
Connection: close
Content-Type: text/html; charset=UTF-8

Page title: 403 Forbidden

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>403 Forbidden</TITLE>
</HEAD><BODY>
<H1>Forbidden</H1>
Forbidden - by rule.
<P>You do not have permission to access /
on this server.</P>
</body></html>

Found 2024-12-17 by HttpPlugin

Create report

Domain summary

No record