Executive summary
VULONE identified a live, unauthenticated file server on an IONOS-hosted address in Germany that appears to be staging data from several unrelated European companies in one attacker-controlled workspace. The clearest technical thread is the operator's repeated use of PentestCode, an offensive-security automation project, alongside target selection, credential and access material, and post-compromise notes.
The server exposes a Python SimpleHTTP directory on port 9003. A normal HTTP request returns an index of files and directories without authentication. The exposed material described in the collection includes production data-warehouse exports, account-checking tools, credential inventories, internal infrastructure maps, Kerberos ticket caches, penetration-test reports and operator notes.
The evidence package names or references Skywind, Adevinta and mobile.de, Via-Mobilis, TrucksNL, TruckScout24, SuperHosting.BG, Landwirt, Technikboerse and Traktorpool. These organizations have been reported through the relevant notification channels. The names identify reported associations in the exposed collection and do not mean that every organization experienced the same confirmed intrusion.
The host also appears to contain the operator's own working material. That includes prompts and shell history referencing PentestCode, residential proxy use, target selection and post-compromise pivoting.
The PentestCode connection
PentestCode is an open-source, multi-agent AI penetration-testing system designed to run from a terminal. Its repository describes a lead agent that coordinates specialist agents for reconnaissance, scanning, enumeration, web testing, identity and post-exploitation work. It keeps a persistent engagement state containing hosts, services, vulnerabilities, credentials, access and attack paths, and can generate structured findings and reports.
The exposed host does not prove that PentestCode alone carried out every action in the collection. It does show PentestCode prompts, shell-history references and related operator material in the same workspace as organization-linked data and post-compromise notes. That makes the framework an important lead for understanding how the targets were selected, grouped and worked through.
A live open directory
The primary host is an IONOS address in Germany. We are withholding the address from this public draft until the affected organizations have been notified. At the time of verification, port 9003 returned HTTP 200 and identified itself as SimpleHTTP/0.6 Python/3.14.4.
The service does not present an authentication challenge. Its directory index exposes names that map directly to organizations, internal projects and post-compromise tooling. The server therefore discloses both the existence of the collection and enough structure to understand how it was organized.
The listing should be treated as a live incident surface. Directory names can change, files can be removed and the operator may lock the index after publication. The timestamps in this article refer to the collection record and should not be interpreted as a guarantee of continued availability.
The organization mappings are retained in a restricted evidence package with the notification record for each named organization. The public article names the reported associations while keeping credentials, personal data and access material private.
Figure 1. The root directory exposes operator workspace artifacts and collection directories. The public copy does not open or reproduce the files themselves.
What the collection appears to contain
The available evidence points to a multi-victim staging directory rather than a single breach.
Skywind
The loot_dwh material is labelled with Skywind-related corporate infrastructure and contains names consistent with a production data warehouse. The collection summary identifies exports for player, merchant and jackpot tables, along with an inventory of Windows and Active Directory systems.
The most serious item described in the evidence is a large player table export. Other files are reported to contain merchant and staff information, partner tokens and Kerberos cache files associated with an administrator account and a production SQL service principal.
The presence of a filename alone would not prove that the data is genuine. In this case, the evidence package records table names, file sizes, headers and representative content obtained through unauthenticated requests. The public article does not reproduce rows, credentials or ticket material.
Figure 2. A redacted organization-labelled directory lists production-style warehouse exports, including player, merchant, payment and jackpot tables. No records are shown.
Adevinta and mobile.de
One directory contains Adevinta and mobile.de material, consolidated breach reports, organization-specific reports and a subdirectory labelled MOBILE-API. The collection summary describes an account-checking tool, credential combinations and a VALID output file.
That combination is important because it indicates an operational workflow for testing account access, rather than a static historical dump. The article does not claim that every listed credential remains valid, and it does not publish any account data.
Via-Mobilis, TrucksNL and related vehicle marketplaces
The Via-Mobilis and related vehicle-marketplace material describes a compromise chain involving a leaked automation token, an Ansible control plane and access to multiple hosts. The reported contents include seller and manager tables, API keys, SSH keys, environment files, database extracts and an inventory of internal services.
The same material references several related marketplace domains. It also describes webshell pivoting and access to production databases. Those statements are attributed to the operator's own notes unless independently corroborated by a separate artifact.
Figure 3. A redacted vehicle-marketplace directory contains separate report, database, credential, environment and evidence areas. The article does not open those areas.
Additional reported organizations
Additional directories and reports reference SuperHosting.BG, Landwirt, Technikboerse and Traktorpool, along with other organizations in hosting, agriculture, remote-access, classifieds and gambling sectors.
These references require different confidence levels. A named report or target list is evidence of operator interest. It is not, by itself, proof that the organization was compromised. The final victim table should therefore distinguish between readable data, internal reports, operator claims and simple target references.
The operator's working environment
The collection summary identifies a root shell-history file containing commands and prompts for PentestCode, installed from its public GitHub repository. The history reportedly references target selection, residential proxy pools, campaign prompts and post-compromise pivoting.
This is unusually valuable context because it links the staging material to an operator workflow. It may reveal how the data was collected, how targets were grouped and which actions were automated.
It should still be handled carefully. Shell history can be copied, edited or planted. The strongest public claim is that the host contains operator material that uses the PentestCode name and references the listed targets. Attribution to a specific person, criminal group or ransomware brand is not established by the host alone.
A second staging lead
The investigation also recorded a second host associated with servicestream[.]io and port 8099. An earlier capture reportedly showed a loot directory containing harvest folders named for banks, casinos, KYC platforms and other services. During the later check, the listing returned an access-denied response. We are withholding the address from the public draft until notification.
Figure 4. Earlier evidence from a separate staging host. We treat it as a watch item, not confirmed shared infrastructure.
The second host should remain a related watch item, not a confirmed part of the same operation. A shared directory naming style and timing are useful leads, but the relationship requires a shared key, certificate, code artifact or other discriminating evidence.
Timeline
The collected material describes the following sequence:
| Period | Observation |
|---|---|
| 16–23 September | Vehicle-marketplace compromise material is consolidated |
| 27 September | A large user-database export appears in the staging set |
| 30 September–5 October | Classifieds-marketplace reports and account-checking material appear |
| 5 October | Shodan first records an open directory on an earlier port |
| 20–21 October | iGaming Active Directory and data-warehouse material appears |
| 22 October | A TrucksNL proof-of-concept service is observed on port 8080 |
| 24 October | Shodan indexes the port 9003 directory |
| 30 October | Operator shell history is last modified in the evidence package |
| 1 November | VULONE confirms the open directory during a dedicated hunt |
These dates combine passive scan history, file metadata and collection timestamps. They should not be presented as proof that each file was created on the day shown without the underlying raw records.
Research and analysis by VULONE. Questions, corrections or additional evidence: vulone.com.
