Ransomware group sites leaking info via error/404/misc. pages

Just an interesting observation. Not really interesting in and of itself but still revealing more info than they should be. Not a full list of all groups, just some of the ones I randomly looked at today.

hxxp://wkrlpub5k52rjigwxfm6m7ogid55kamgc5azxlq7zjgaopv33tgx2sqd[.]onion/adsfasdf/

>nginx/1.14.0 (Ubuntu)

hxxp://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad[.]onion/uploads/

>Apache/2.4.55 (Ubuntu) Server at kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad[.]onion Port 8080

hxxp://bl4cktorpms2gybrcyt52aakcxt6yn37byb65uama5cimhifcscnqkid[.]onion/0x00/index.html

>LiteSpeed Server at bl4cktorpms2gybrcyt52aakcxt6yn37byb65uama5cimhifcscnqkid[.]onion Port 80

hxxps://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd[.]onion/uploads

>nginx/1.18.0

hxxp://p66slxmtum2ox4jpayco6ai3qfehd5urgrs4oximjzklxcol264driqd[.]onion/asdfasdf

>nginx/1.18.0

hxxp://ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad[.]onion/author/h6g5f4df6g7hhyg/

>WordPress (lol) the admin username is `h6g5f4df6g7hhyg` -> hxxp://ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad[.]onion/wp-admin

>Server: Apache/2.4.38 (Win32) PHP/5.6.40

>X-Powered-By: PHP/5.6.40

hxxp://malas2urovbyyavjzaezkt5ohljvyd5lt7vv7mnsgbf2y4bwlh72doqd[.]onion/robots.txt


>Sitemap: hxxps://ronaldsvilcins[.]com/sitemap.xml HRMMMMMMMMMMMMMMM 🤔

apache error html info list malware misc nginx onion port ransomware ransomware group server ubuntu