External Attack Surface Management Report

hackthissite.org

Comprehensive analysis of the external attack surface, structured to highlight priority exposure, supporting evidence, and the assets that merit the earliest analyst review.

Discovered Assets
62
Priority Targets
62
Web Exposures
21
Critical / High / Medium
15
Critical6High5Medium4
Nuclei Findings
0
Critical / High Nuclei
0
Critical0High0

1. Executive Summary

The external reconnaissance scope for hackthissite.org identified 62 discovered assets, of which 62 were prioritized for deeper analysis based on exposure, service composition, and observed risk indicators.

Overall exposure is assessed as CRITICAL. The most relevant findings are concentrated in exposed web services, vulnerable internet-facing hosts, and a small set of infrastructure entries requiring analyst review first.

Observed Infrastructure Vulnerabilities

Key vulnerabilities identified via host intelligence across the discovered infrastructure.

CVE ID Score Affected Host Vulnerability Summary Host Risk
CVE-2021-23017 7.7 irc.hackthissite.org A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact. CRITICAL
CVE-2021-23017 7.7 irc-wolf.hackthissite.org A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact. CRITICAL
CVE-2021-23017 7.7 wolf.irc.hackthissite.org A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact. CRITICAL
CVE-2023-44487 7.5 irc.hackthissite.org The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CRITICAL
CVE-2023-44487 7.5 irc-wolf.hackthissite.org The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CRITICAL
CVE-2023-44487 7.5 wolf.irc.hackthissite.org The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CRITICAL
CVE-2021-3618 7.4 irc.hackthissite.org ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer. CRITICAL
CVE-2021-3618 7.4 irc-wolf.hackthissite.org ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer. CRITICAL
CVE-2021-3618 7.4 wolf.irc.hackthissite.org ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer. CRITICAL
CVE-2020-11022 6.9 hackthissite.org In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. CRITICAL
CVE-2020-11023 6.9 hackthissite.org In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. CRITICAL
CVE-2020-11022 6.9 www.hackthissite.org In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. CRITICAL
CVE-2020-11023 6.9 www.hackthissite.org In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. CRITICAL
CVE-2019-11358 6.1 hackthissite.org jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. CRITICAL
CVE-2020-7656 6.1 hackthissite.org jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed. CRITICAL
CVE-2015-9251 6.1 hackthissite.org jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed. CRITICAL
CVE-2012-6708 6.1 hackthissite.org jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common. CRITICAL
CVE-2019-11358 6.1 www.hackthissite.org jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. CRITICAL
CVE-2020-7656 6.1 www.hackthissite.org jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed. CRITICAL
CVE-2015-9251 6.1 www.hackthissite.org jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed. CRITICAL

2. Key Metrics

High-level summary for quick triage and prioritization.

Discovered Assets
62
Priority Targets
62
Web Exposures
21
Critical / High / Medium
15
Critical6High5Medium4
Nuclei Findings
0
Critical / High Nuclei
0
Critical0High0

3. Priority Findings

Automated templates matched against discovered web entrypoints. Findings are ordered by severity to highlight items that deserve immediate validation.

Severity Template Finding Name Matched Target
No nuclei findings recorded for this session.

Nuclei Severity Breakdown

No Nuclei Detections

No templates matched during this session, so the finding breakdown stays neutral.

4. Top Exposed Assets

The most relevant hosts are presented first based on risk score, severity, and exposure characteristics.

Top Exposure Target

hackthissite.org

shodan_dns_current, shodan_dns_history, shodan_host, target
CRITICAL 600
Primary IP137.74.187.100
CityDunkerque
HTTP URLhttps://hackthissite.org
Shodan Hostnameshackthisjogneh42n5o7gbzrewxee3vyu6ex37ukyvdw6jm66npakiyd.onion, hackthissite.org, www.hackthissite.org
Associated Domainshackthisjogneh42n5o7gbzrewxee3vyu6ex37ukyvdw6jm66npakiyd.onion, hackthissite.org
Open Ports
80443
Known Vulnerabilities
CVE-2012-6708CVE-2015-9251CVE-2019-11358CVE-2020-11022CVE-2020-11023CVE-2020-7656
Risk Factors
  • Open ports on 137.74.187.100: [80, 443]
  • Vulnerabilities found on 137.74.187.100
  • Open ports on 137.74.187.101: [80, 443]
  • Vulnerabilities found on 137.74.187.101
  • Open ports on 137.74.187.102: [80, 443]
Sources: shodan_dns_current, shodan_dns_history, shodan_host, target Recorded IPs: 137.74.187.100, 137.74.187.101, 137.74.187.102, 137.74.187.103, 137.74.187.104, 137.74.187.100, 137.74.187.101, 137.74.187.102, 137.74.187.103, 137.74.187.104, 137.74.187.100, 137.74.187.101, 137.74.187.102, 137.74.187.103, 137.74.187.104, 137.74.187.100, 137.74.187.101, 137.74.187.102, 137.74.187.103, 137.74.187.104
Top Exposure Target

www.hackthissite.org

shodan_dns_current, shodan_dns_history, shodan_host, subfinder
CRITICAL 600
Primary IP137.74.187.100
CityDunkerque
HTTP URLhttps://www.hackthissite.org
Shodan Hostnameshackthisjogneh42n5o7gbzrewxee3vyu6ex37ukyvdw6jm66npakiyd.onion, hackthissite.org, www.hackthissite.org
Associated Domainshackthisjogneh42n5o7gbzrewxee3vyu6ex37ukyvdw6jm66npakiyd.onion, hackthissite.org
Open Ports
80443
Known Vulnerabilities
CVE-2012-6708CVE-2015-9251CVE-2019-11358CVE-2020-11022CVE-2020-11023CVE-2020-7656
Risk Factors
  • Open ports on 137.74.187.100: [80, 443]
  • Vulnerabilities found on 137.74.187.100
  • Open ports on 137.74.187.101: [80, 443]
  • Vulnerabilities found on 137.74.187.101
  • Open ports on 137.74.187.102: [80, 443]
Sources: shodan_dns_current, shodan_dns_history, shodan_host, subfinder Recorded IPs: 137.74.187.100, 137.74.187.101, 137.74.187.102, 137.74.187.103, 137.74.187.104, 137.74.187.100, 137.74.187.101, 137.74.187.102, 137.74.187.103, 137.74.187.104, 137.74.187.100, 137.74.187.101, 137.74.187.102, 137.74.187.103, 137.74.187.104, 137.74.187.100, 137.74.187.101, 137.74.187.102, 137.74.187.103, 137.74.187.104
Top Exposure Target

irc.hackthissite.org

shodan_dns_current, shodan_dns_history, shodan_host, subfinder
CRITICAL 216
Primary IP137.74.187.150
CityLelystad, Lille
HTTP URLhttps://irc.hackthissite.org
Shodan Hostnamesirc-v6.hackthissite.org, irc.hackthissite.org, lille.irc-v6.hackthissite.org, lille.irc.hackthissite.org, wolf.irc-v6.hackthissite.org, wolf.irc.hackthissite.org
Associated Domainshackthissite.org
Open Ports
8044366676697700080688080
Known Vulnerabilities
CVE-2021-23017CVE-2021-3618CVE-2023-44487CVE-2025-23419
Risk Factors
  • Open ports on 137.74.187.150: [80, 443, 6667, 6697, 7000, 8068, 8080]
  • Open ports on 185.24.222.13: [80, 443, 6667, 6697, 8068]
  • Vulnerabilities found on 185.24.222.13
  • Open ports on 137.74.187.150: [80, 443, 6667, 6697, 7000, 8068, 8080]
  • Open ports on 185.24.222.13: [80, 443, 6667, 6697, 8068]
Screenshot of irc.hackthissite.org
Screenshot evidence | irc.hackthissite.org
Sources: shodan_dns_current, shodan_dns_history, shodan_host, subfinder Recorded IPs: 137.74.187.150, 185.24.222.13, 2a02:2770:9:0:21a:4aff:fe68:f705, 137.74.187.150, 185.24.222.13, 2a02:2770:9:0:21a:4aff:fe68:f705, 137.74.187.150, 185.24.222.13, 2a02:2770:9:0:21a:4aff:fe68:f705, 137.74.187.150, 185.24.222.13, 2a02:2770:9:0:21a:4aff:fe68:f705
Top Exposure Target

lille.irc.hackthissite.org

shodan_dns_current, shodan_dns_history, shodan_host, subfinder
CRITICAL 188
Primary IP137.74.187.150
CityLille
HTTP URLhttps://lille.irc.hackthissite.org
Shodan Hostnamesirc-v6.hackthissite.org, irc.hackthissite.org, lille.irc-v6.hackthissite.org, lille.irc.hackthissite.org
Associated Domainshackthissite.org
Open Ports
8044366676697700080688080
Known Vulnerabilities
No CVEs recorded for this host.
Risk Factors
  • Open ports on 137.74.187.150: [80, 443, 6667, 6697, 7000, 8068, 8080]
  • Open ports on 137.74.187.151: [80, 443, 6667, 6697, 7000, 8068, 8080]
  • Open ports on 137.74.187.152: [80, 443, 6667, 6697, 7000, 8068, 8080]
  • Open ports on 137.74.187.150: [80, 443, 6667, 6697, 7000, 8068, 8080]
  • Open ports on 137.74.187.151: [80, 443, 6667, 6697, 7000, 8068, 8080]
Screenshot of lille.irc.hackthissite.org
Screenshot evidence | lille.irc.hackthissite.org
Sources: shodan_dns_current, shodan_dns_history, shodan_host, subfinder Recorded IPs: 137.74.187.150, 137.74.187.151, 137.74.187.152, 2001:41d0:8:ccd8:0:1:bad:1dea, 2001:41d0:8:ccd8:0:a:bad:1dea, 2001:41d0:8:ccd8::bad:1dea, 137.74.187.150, 137.74.187.151, 137.74.187.152, 2001:41d0:8:ccd8:0:1:bad:1dea, 2001:41d0:8:ccd8:0:a:bad:1dea, 2001:41d0:8:ccd8::bad:1dea, 137.74.187.150, 137.74.187.151, 137.74.187.152, 2001:41d0:8:ccd8:0:1:bad:1dea, 2001:41d0:8:ccd8:0:a:bad:1dea, 2001:41d0:8:ccd8::bad:1dea, 137.74.187.150, 137.74.187.151, 137.74.187.152, 2001:41d0:8:ccd8:0:1:bad:1dea, 2001:41d0:8:ccd8:0:a:bad:1dea, 2001:41d0:8:ccd8::bad:1dea
Top Exposure Target

irc-wolf.hackthissite.org

shodan_dns_current, shodan_dns_history, subfinder
CRITICAL 160
Primary IP185.24.222.13
CityLelystad
HTTP URLhttps://irc-wolf.hackthissite.org
Shodan Hostnamesirc-v6.hackthissite.org, irc.hackthissite.org, wolf.irc-v6.hackthissite.org, wolf.irc.hackthissite.org
Associated Domainshackthissite.org
Open Ports
80443666766978068
Known Vulnerabilities
CVE-2021-23017CVE-2021-3618CVE-2023-44487CVE-2025-23419
Risk Factors
  • Open ports on 185.24.222.13: [80, 443, 6667, 6697, 8068]
  • Vulnerabilities found on 185.24.222.13
  • Open ports on 185.24.222.13: [80, 443, 6667, 6697, 8068]
  • Vulnerabilities found on 185.24.222.13
  • Open ports on 185.24.222.13: [80, 443, 6667, 6697, 8068]
Screenshot of irc-wolf.hackthissite.org
Screenshot evidence | irc-wolf.hackthissite.org
Sources: shodan_dns_current, shodan_dns_history, subfinder Recorded IPs: 185.24.222.13, 2a02:2770:9:0:21a:4aff:fe68:f705, 185.24.222.13, 2a02:2770:9:0:21a:4aff:fe68:f705, 185.24.222.13, 2a02:2770:9:0:21a:4aff:fe68:f705, 185.24.222.13, 2a02:2770:9:0:21a:4aff:fe68:f705
Top Exposure Target

wolf.irc.hackthissite.org

shodan_dns_current, shodan_dns_history, shodan_host, subfinder
CRITICAL 160
Primary IP185.24.222.13
CityLelystad
HTTP URLhttps://wolf.irc.hackthissite.org
Shodan Hostnamesirc-v6.hackthissite.org, irc.hackthissite.org, wolf.irc-v6.hackthissite.org, wolf.irc.hackthissite.org
Associated Domainshackthissite.org
Open Ports
80443666766978068
Known Vulnerabilities
CVE-2021-23017CVE-2021-3618CVE-2023-44487CVE-2025-23419
Risk Factors
  • Open ports on 185.24.222.13: [80, 443, 6667, 6697, 8068]
  • Vulnerabilities found on 185.24.222.13
  • Open ports on 185.24.222.13: [80, 443, 6667, 6697, 8068]
  • Vulnerabilities found on 185.24.222.13
  • Open ports on 185.24.222.13: [80, 443, 6667, 6697, 8068]
Screenshot of wolf.irc.hackthissite.org
Screenshot evidence | wolf.irc.hackthissite.org
Sources: shodan_dns_current, shodan_dns_history, shodan_host, subfinder Recorded IPs: 185.24.222.13, 2a02:2770:9:0:21a:4aff:fe68:f705, 185.24.222.13, 2a02:2770:9:0:21a:4aff:fe68:f705, 185.24.222.13, 2a02:2770:9:0:21a:4aff:fe68:f705, 185.24.222.13, 2a02:2770:9:0:21a:4aff:fe68:f705

Additional Priority Assets

Top Exposure Target

ctf.hackthissite.org

shodan_dns_current, shodan_dns_history, subfinder
HIGH 60
Primary IPn/a
Cityn/a
HTTP URLhttps://ctf.hackthissite.org
Shodan Hostnamesn/a
Associated Domainsn/a
Open Ports
No port data recorded.
Known Vulnerabilities
No CVEs recorded for this host.
Risk Factors
  • Web service reachable (200)
  • Provider-linked CNAME: hackthissite.github.io, hackthissite.github.io, hackthissite.github.io, hackthissite.github.io
  • Dangling CNAME (Potential Takeover)
Screenshot of ctf.hackthissite.org
Screenshot evidence | ctf.hackthissite.org
Sources: shodan_dns_current, shodan_dns_history, subfinder Recorded IPs: none
Top Exposure Target

h5ai.hackthissite.org

shodan_dns_current, shodan_dns_history, subfinder
HIGH 60
Primary IPn/a
Cityn/a
HTTP URLhttps://h5ai.hackthissite.org
Shodan Hostnamesn/a
Associated Domainsn/a
Open Ports
No port data recorded.
Known Vulnerabilities
No CVEs recorded for this host.
Risk Factors
  • Web service reachable (200)
  • Provider-linked CNAME: hackthissite.github.io, hackthissite.github.io, hackthissite.github.io, hackthissite.github.io
  • Dangling CNAME (Potential Takeover)
Screenshot of h5ai.hackthissite.org
Screenshot evidence | h5ai.hackthissite.org
Sources: shodan_dns_current, shodan_dns_history, subfinder Recorded IPs: none
Top Exposure Target

legal.hackthissite.org

shodan_dns_current, shodan_dns_history, shodan_host, subfinder
HIGH 52
Primary IP137.74.187.137
CityDunkerque
HTTP URLhttps://legal.hackthissite.org
Shodan Hostnameshackthissite.org, legal.hackthissite.org
Associated Domainshackthissite.org
Open Ports
80443
Known Vulnerabilities
No CVEs recorded for this host.
Risk Factors
  • Open ports on 137.74.187.137: [80, 443]
  • Open ports on 137.74.187.138: [80, 443]
  • Open ports on 137.74.187.137: [80, 443]
  • Open ports on 137.74.187.138: [80, 443]
  • Open ports on 137.74.187.137: [80, 443]
Screenshot of legal.hackthissite.org
Screenshot evidence | legal.hackthissite.org
Sources: shodan_dns_current, shodan_dns_history, shodan_host, subfinder Recorded IPs: 137.74.187.137, 137.74.187.138, 2001:41d0:8:ccd8:137:74:187:137, 2001:41d0:8:ccd8:137:74:187:138, 137.74.187.137, 137.74.187.138, 2001:41d0:8:ccd8:137:74:187:137, 2001:41d0:8:ccd8:137:74:187:138, 137.74.187.137, 137.74.187.138, 2001:41d0:8:ccd8:137:74:187:137, 2001:41d0:8:ccd8:137:74:187:138, 137.74.187.137, 137.74.187.138, 2001:41d0:8:ccd8:137:74:187:137, 2001:41d0:8:ccd8:137:74:187:138
Top Exposure Target

mirror.hackthissite.org

shodan_dns_current, shodan_dns_history, shodan_host, subfinder
HIGH 52
Primary IP137.74.187.133
CityDunkerque
HTTP URLhttps://mirror.hackthissite.org
Shodan Hostnameshackthissite.org, mirror.hackthissite.org
Associated Domainshackthissite.org
Open Ports
80443
Known Vulnerabilities
No CVEs recorded for this host.
Risk Factors
  • Open ports on 137.74.187.133: [80, 443]
  • Open ports on 137.74.187.134: [80, 443]
  • Open ports on 137.74.187.133: [80, 443]
  • Open ports on 137.74.187.134: [80, 443]
  • Open ports on 137.74.187.133: [80, 443]
Screenshot of mirror.hackthissite.org
Screenshot evidence | mirror.hackthissite.org
Sources: shodan_dns_current, shodan_dns_history, shodan_host, subfinder Recorded IPs: 137.74.187.133, 137.74.187.134, 2001:41d0:8:ccd8:137:74:187:133, 2001:41d0:8:ccd8:137:74:187:134, 137.74.187.133, 137.74.187.134, 2001:41d0:8:ccd8:137:74:187:133, 2001:41d0:8:ccd8:137:74:187:134, 137.74.187.133, 137.74.187.134, 2001:41d0:8:ccd8:137:74:187:133, 2001:41d0:8:ccd8:137:74:187:134, 137.74.187.133, 137.74.187.134, 2001:41d0:8:ccd8:137:74:187:133, 2001:41d0:8:ccd8:137:74:187:134
Top Exposure Target

stats.hackthissite.org

shodan_dns_current, shodan_dns_history, shodan_host, subfinder
HIGH 52
Primary IP137.74.187.135
CityDunkerque
HTTP URLhttps://stats.hackthissite.org
Shodan Hostnameshackthissite.org, stats.hackthissite.org
Associated Domainshackthissite.org
Open Ports
80443
Known Vulnerabilities
No CVEs recorded for this host.
Risk Factors
  • Open ports on 137.74.187.135: [80, 443]
  • Open ports on 137.74.187.136: [80, 443]
  • Open ports on 137.74.187.135: [80, 443]
  • Open ports on 137.74.187.136: [80, 443]
  • Open ports on 137.74.187.135: [80, 443]
Screenshot of stats.hackthissite.org
Screenshot evidence | stats.hackthissite.org
Sources: shodan_dns_current, shodan_dns_history, shodan_host, subfinder Recorded IPs: 137.74.187.135, 137.74.187.136, 2001:41d0:8:ccd8:137:74:187:135, 2001:41d0:8:ccd8:137:74:187:136, 137.74.187.135, 137.74.187.136, 2001:41d0:8:ccd8:137:74:187:135, 2001:41d0:8:ccd8:137:74:187:136, 137.74.187.135, 137.74.187.136, 2001:41d0:8:ccd8:137:74:187:135, 2001:41d0:8:ccd8:137:74:187:136, 137.74.187.135, 137.74.187.136, 2001:41d0:8:ccd8:137:74:187:135, 2001:41d0:8:ccd8:137:74:187:136
Top Exposure Target

www.irc.hackthissite.org

shodan_dns_current, shodan_dns_history, shodan_host, subfinder
MEDIUM 36
Primary IP137.74.187.153
CityDunkerque
HTTP URLhttps://www.irc.hackthissite.org
Shodan Hostnameswww.irc.hackthissite.org
Associated Domainshackthissite.org
Open Ports
80443
Known Vulnerabilities
No CVEs recorded for this host.
Risk Factors
  • Open ports on 137.74.187.153: [80, 443]
  • Open ports on 137.74.187.153: [80, 443]
  • Open ports on 137.74.187.153: [80, 443]
  • Open ports on 137.74.187.153: [80, 443]
  • Web service reachable (200)
Screenshot of www.irc.hackthissite.org
Screenshot evidence | www.irc.hackthissite.org
Sources: shodan_dns_current, shodan_dns_history, shodan_host, subfinder Recorded IPs: 137.74.187.153, 137.74.187.153, 137.74.187.153, 137.74.187.153

5. Supporting Intelligence

Edge metadata, takeover candidates, and DNS observations used to support triage and deeper validation.

Cloudflare Intelligence

Target Host Server TLS Security Tech Stack Edge IP
No Cloudflare intelligence available.
Cloudflare API credentials were not provided during this session. Refer to the collection documentation to enable enriched edge metadata.

DNS / Takeover Intelligence

Takeover Target

ctf.hackthissite.org

No reason recorded

Takeover Target

h5ai.hackthissite.org

No reason recorded

No TXT Signals

No interesting DNS evidence collected.

6. Infrastructure Inventory

Condensed view of discovered IP infrastructure and network groupings.

IP Address Network Hostnames Ports Products Organization
137.74.187.100 137.74.187.0/24 hackthissite.org, hackthisjogneh42n5o7gbzrewxee3vyu6ex37ukyvdw6jm66npakiyd.onion, www.hackthissite.org 80, 443 none Staff HackThisSite
137.74.187.101 137.74.187.0/24 hackthissite.org, hackthisjogneh42n5o7gbzrewxee3vyu6ex37ukyvdw6jm66npakiyd.onion, www.hackthissite.org 80, 443 none Staff HackThisSite
137.74.187.102 137.74.187.0/24 hackthissite.org, hackthisjogneh42n5o7gbzrewxee3vyu6ex37ukyvdw6jm66npakiyd.onion, www.hackthissite.org 80, 443 none Staff HackThisSite
137.74.187.103 137.74.187.0/24 hackthissite.org, hackthisjogneh42n5o7gbzrewxee3vyu6ex37ukyvdw6jm66npakiyd.onion, www.hackthissite.org 80, 443 none Staff HackThisSite
137.74.187.133 137.74.187.0/24 hackthissite.org, mirror.hackthissite.org 80, 443 none Staff HackThisSite
137.74.187.104 137.74.187.0/24 hackthissite.org, hackthisjogneh42n5o7gbzrewxee3vyu6ex37ukyvdw6jm66npakiyd.onion, www.hackthissite.org 80, 443 none Staff HackThisSite
137.74.187.134 137.74.187.0/24 hackthissite.org, mirror.hackthissite.org 80, 443 none Staff HackThisSite
137.74.187.135 137.74.187.0/24 hackthissite.org, stats.hackthissite.org 80, 443 none Staff HackThisSite
137.74.187.136 137.74.187.0/24 hackthissite.org, stats.hackthissite.org 80, 443 none Staff HackThisSite
137.74.187.137 137.74.187.0/24 hackthissite.org, legal.hackthissite.org 80, 443 none Staff HackThisSite
137.74.187.138 137.74.187.0/24 hackthissite.org, legal.hackthissite.org 80, 443 none Staff HackThisSite
137.74.187.150 137.74.187.0/24 lille.irc.hackthissite.org, irc.hackthissite.org, lille.irc-v6.hackthissite.org 80, 443, 6667, 6697, 7000, 8068, 8080 none Staff HackThisSite
137.74.187.152 137.74.187.0/24 irc-v6.hackthissite.org, lille.irc.hackthissite.org, irc.hackthissite.org, lille.irc-v6.hackthissite.org 80, 443, 6667, 6697, 7000, 8068, 8080 none Staff HackThisSite
137.74.187.151 137.74.187.0/24 irc-v6.hackthissite.org, lille.irc.hackthissite.org, irc.hackthissite.org, lille.irc-v6.hackthissite.org 80, 443, 6667, 6697, 7000, 8068, 8080 none Staff HackThisSite
137.74.187.153 137.74.187.0/24 www.irc.hackthissite.org 80, 443 none Staff HackThisSite
198.148.81.145 198.148.81.0/24 customer.sharktech.net 80, 8800 none PRIVACY-PROTECTED
185.24.222.13 185.24.222.0/24 irc-v6.hackthissite.org, wolf.irc-v6.hackthissite.org, wolf.irc.hackthissite.org, irc.hackthissite.org 80, 443, 6667, 6697, 8068 nginx Tilaa
198.148.81.146 198.148.81.0/24 customer.sharktech.net 80, 8800 none PRIVACY-PROTECTED
198.148.81.147 198.148.81.0/24 customer.sharktech.net 80, 8800 none PRIVACY-PROTECTED