technology software

documentation technical

English

Domain '198.200.54.220:8080' uses an unknown top-level domain without a subdomain. Count 14 characters in '198.200.54.220' split between 0 vowels and zero consonants; it also includes 11 digits. It segments into 4 words: 198, 200, 54, 220. The median word length lands at three characters. No strong language cues emerged from the frequency lists.

后台管理

5d322c34fddd3a1051244c015a6a46acf0d4c047425af57ef31585734850005e

1499a72ba22ab7037f8f23dc9f0a84d8c2c0f8e83b641bef56d90d4831a9a696

f33a2d78362bde001670e3a29b01fd0dc16a7f9194d042a775af89270ab38b74

11e82953f9a1018a12e8843795c7e69112ec18628a15357de12aac7342230a5b

dafc2088fb1e331cba988f488815373e0c29ebf2b202b11cda5527daf66debf1

9c17cab6ab49fda358227f1e1015fa8f2417614e37ce3d4756edf8269ad3c97c

b768d3bfbc80fcf42cdec946777feafe587133fd496ca75db9a0b2dc64f320c2

7d876707e753974b80e455561e82dff0e7f7a0fa408c584003ead9ea337f75bf

e9f2925331e26ca5b93a2289d00640113768fe8d394ae8e315f7b2ce5c288815

090d977d3bf7e695615aa246dbd27c9b9f4e9875fbcebc7cf4432fd0d5b0f454

df66b929dbb1bef6f8ab9303a388a9818aa1e521e5963486b0e8988cbcd99b63

f120d81c79b8069bbc362f9bf186f8724980a1c21afb3460f781e94e6db06bd1

b13eb82cc3f89f4e67d12a81915a09633f05f0bb97053ec8e4a47fb95c1ef0cb

7ab5d4ac7ff5bdf04ab66fb07b80d2b442a61193d4e78da031d8cf6d3d8e85df

fcad1b949bc99bc4e9434805bfcda6c1b8ab2f1a170a8160bc9bd694abf74ce6

6c08931cac28b6ac8f494ccdbab245ed7ef4938d16ae948ea1ebf13fd9c0be18

07efa71fc52faebf372d1632d15292379c7e72cdb7e06d4f36327f97ba2f71e6

0ceeea9b74883fb9f3b90c4582cce84cb9899ff4ce23507c91ccf0559d21efce

436373d8b1ca423e17e0a77260344ead243a51af7723200925eebd4594ba0dcf

81b7ad513e3ebcf0b8c6bb88e9a6d0ea04e26f42f4e46a8c97a6735ecdbabbf3

f3ada5984eba57cef4baacff4b551a073c5fc1519c39bd0837bfe94b13be5a26

c150bcea88198dd219a5434f5529222f48c8b119fe68bfd56d6fc2b01de3abba

95135c65602e25a2c0c803cfe8d342e260ff6ae1c2d52e7258f926d90f6eece1

e04d1738f8920c8c95b43bf6d5e95b04343325789df5c42bc4fc0cd5b66bd024

171d06c6f769cbda3b02f5e8fbb1e83761cfdd38ea3c35e6bfdf30c51639bd1c

c199e3a4b2ba191d65d5b4f71e4a997522a88d9fd2e5879edbefa87524ab6434

c9506197caf809a075b6dee1da0d36fb19da7158ffe8a88e7b0c96c5d8623c99

705dd35080added9582ff190573a5a4183d6c5f30bf561fd6cb687f9d10734b1

4fe9b84121e4ddd6f1040469dfa1982ae602d506498ca1c95b1188c3367d203d

411bffc2a2dd7b06363549d7e9029789f10c18b3219444475ef7b834258f7739

0c1201ffc90c4ea6046754efe27c6d3d17ab74df6680d7395dfa4e5eb3c661dc

bcaf520a6a7f0e17b4859398391cd8280c70042650f09c75a44d541e929720c0

bc57e42d87fca646facd00240d3dddbf6e562e00f213d07080af77b3c6ef21c8

8645a804ca7d5184cd72f6f71932ad86a0303745d81e3b67356019c822177c56

cd91e255071e4a078eb6435525b05b1eb84d794b227f5f6136895481c6e10d25

323bac53f364f9248f08c10c8daaeac91e848b5d413135b5b6c78d8dd255ef4c

546309ca657ecd831ffb89ed1f2bca1127225bdffa2da87258c4c90ffdd443bc

069b58bb65d96b5a652ce834cccd1d5839c9cc564768bf16c2ab6f9736481480

1d69fd3e23aaccf300b653d0592c96b3582d8a8d930bad087c93f8123e048896

4c544795da6c95ef0f4a1f5dd99ead2009566f7e2fa02cdfeb4c00720aeac405

ffaab1473f05dec4f9a04f066d7aa4509c39c4c73419c82d2399bd238a4cfe6c

1405d5a3ca29ee1328a976531859df03a45c7b40a5ce4f05c407fc1e7f79a0b6

7f2257c021010e2947f49b19ade67478296bcf9cb121923dcb239a507103d172

9733f1a20383b66797873577865abfefa4bb4566022806987ec81fdf01c39efa

8f1b9d7b409b9140f27ada81381c3796a965d1b46080b3ad51f2e3e409c75e2f

144cb1e963f20bb5154cbea774c6f8ab82afa043969093222a67c73e77756c06

65d2bc9f522bcf942509ccb1e7e065fd2e4bf65bed1580af0fd6302150dd646f

02cfc5421f003da6ef9dca5f9d033afc3529a0e25486c04817ec761b3b3dd5a8

4265f0268480ac9444c24a28837751ed926640ac0440c0300edbda91d2b9f18d

38e9b75100200c143edbb4475b7aad532e1a542412bc06d6cf84e0633672ba1b

7e49da68588e250dbb8bba190d2caa8ab3787cc0284bda1d8b2f805c4df742c9

434af2c1b8dc47e18793ef9baf7bc20887a0dc01ee5c017d02b06615509263c3

f393580899eba925d227e36f01c25882b4c8e069be9fbf4bf4ebcd400e4f94e1

f1b0bdcac5811be721b258d248ac9173be196b0a081d9dca870bd8416b0fb4af

47616640720d91f24fdd67742284810dddbc280b08ba843164d15b110b572b37

dea307defee983142e6356f0a344c3eef9ae36bf693c4c361137ee8c0b98e790

72dd10efd11bf20872d67473466d3d5231d4def30c0a90aea039249366a2dae3

92fce83efb950bfab4e5dba59bb815a5e1423ee94ec599ad4569a7bad777144e

3669560dd0acf700b38492ae1cebbc475fa5c360187fad3956d4ff2196fd5c35

5db1d1be66c5339a5b261d84a5fcc41ebd9c8411a7b302f94a6d55d622334d3a

b15f0e76131719934681d32c950dd50bced0258d460477364a1ecb4346949261

3945ee854995c61e218644c5ad849459a24637efda4722f824b7749d7df7310b

ede720ab56f9c813532c99a3f9fd154bd19d77f3c1a0205f7b6ef1139e1691c4

be966d2ca94263223b3b8bad2907d3d0436378a31118996e1ce2cd4c02ec73c7

DOMPurify allows tampering by prototype pollution

DOMPurify allows Cross-site Scripting (XSS)

When USE_PROFILES is enabled, DOMPurify rebuilds ALLOWED_ATTR as a plain array whose properties are looked up by name, making it susceptible to prototype pollution. If Array.prototype has been polluted with an event handler attribute name (e.g. onclick), DOMPurify will allow that event handler to survive sanitization, resulting in DOM-based XSS.

DOMPurify's ADD_ATTR predicate function mechanism (via EXTRA_ELEMENT_HANDLING.attributeCheck) short-circuits URI validation when the predicate returns true. This allows unsafe protocols such as javascript: to survive sanitization in href and similar attributes, enabling DOM-based XSS when such links are activated.

DOMPurify is vulnerable to mutation-XSS (mXSS) when sanitized HTML is embedded into special raw-text wrapper elements such as xmp, script, iframe, noembed, noframes, or noscript before being assigned via innerHTML. Attacker-controlled sequences like </xmp> inside attribute values close the raw-text context during the second parse, causing the sanitized output to mutate into executable markup.

DOMPurify has a logic inconsistency where FORBID_TAGS is not checked when a function-based ADD_TAGS (tagCheck) returns true. Due to short-circuit evaluation, the FORBID_TAGS check is never evaluated, allowing explicitly forbidden elements to pass through sanitization when EXTRA_ELEMENT_HANDLING.tagCheck is configured.

DOMPurify has an asymmetric security inconsistency where FORBID_TAGS does not win over a function-based ADD_TAGS predicate, while FORBID_ATTR correctly wins over ADD_ATTR. When ADD_TAGS is provided as a function that returns true, explicitly forbidden tags such as iframe and form pass through sanitization with their attributes intact.

DOMPurify's SAFE_FOR_TEMPLATES feature fails to strip Mustache/template expressions when RETURN_DOM or RETURN_DOM_FRAGMENT is used. The final string-scrubbing pass that removes expressions like {{...}} is skipped in DOM-return mode, and split text nodes (e.g. from removed intermediate tags) can rejoin to form a complete expression that template-evaluating frameworks like Vue 2 will execute.

DOMPurify versions 3.0.1 through 3.3.3 are vulnerable to an XSS bypass via prototype pollution. When no CUSTOM_ELEMENT_HANDLING is specified, the fallback plain object inherits from Object.prototype; if an attacker has polluted Object.prototype.tagNameCheck and Object.prototype.attributeNameCheck with permissive regexes, DOMPurify allows arbitrary custom elements with event handler attributes through sanitization.

DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`

DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects

DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes

DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)

DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)

4ed913f5ffd0817b8c0df7e6e4c535efb1e6c1eb7b8069f53af12b9e90109eef

198b00a25fd7e633fbe95a736f3401e308b20a54ba9f75537fa8c861092d68bf

d5773718215a5102823dcf0be71426eea2c95d96ed323f6c8de9f015e95c3bdc

viewport

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

PEG TECH INC

PT-82-6


        
        if (typeof ELK === 'undefined' && typeof elk !== 'undefined') {
            window.ELK = elk;
        }
    

Marked

DesRedTeam

regular

⚠️ High Risk - http://198.200.54.220:8080/

Requests	IP Address	Location	AS Autonomous System
99	198.200.54.220	San Jose, California, United States	AS54600PEG TECH INC
99	1	-	-

Security Scan Report: 198.200.54.220

Summary

AI Security Verdict

High Risk

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies1

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History