GeneralInformation

Hostnames	auth7.shop d41024.acod.regrucolo.ru
Domains	auth7.shop regrucolo.ru
Country	Russian Federation
City	Moscow
Organization	Domain names registrar REG.RU, Ltd
ISP	"Domain names registrar REG.RU", Ltd
ASN	AS49352

Vulnerabilities

Note: the device may not be impacted by all of these issues. The vulnerabilities are implied based on the software and version.

CVE-2023-44487	The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2021-3618	5.8ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.
CVE-2021-23017	6.8A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.

OpenPorts

80 111 443 5001 5432 8728 8779 8791 8800 8806 8807 8814 8816 8818 8821 8824 8828 8833 8834 9000 9090

589765266 | 2024-05-15T06:42:17.599908

80 / tcp

HTTP/1.1 301 Moved Permanently
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 15 May 2024 06:42:17 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://chpr.pw

-1345205424 | 2024-05-13T20:21:04.456475

111 / tcp

Portmap
Program	Version	Protocol	Port
portmapper	4	tcp	111
portmapper	3	tcp	111
portmapper	2	tcp	111
portmapper	4	udp	111
portmapper	3	udp	111
portmapper	2	udp	111

-1345205424 | 2024-05-16T05:21:02.213270

111 / udp

Portmap
Program	Version	Protocol	Port
portmapper	4	tcp	111
portmapper	3	tcp	111
portmapper	2	tcp	111
portmapper	4	udp	111
portmapper	3	udp	111
portmapper	2	udp	111

-1027761948 | 2024-05-13T07:13:47.108634

443 / tcp

HTTP/1.1 302 Found
Server: nginx/1.18.0 (Ubuntu)
Date: Mon, 13 May 2024 07:13:45 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 80
Connection: keep-alive
X-Powered-By: Express
Location: https://cs7.market
Vary: Accept

SSL Certificate

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            03:44:fa:4f:e5:83:26:af:4b:1c:c9:52:9d:e6:5a:e3:2c:80
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Let's Encrypt, CN=R3
        Validity
            Not Before: Mar 29 23:22:57 2024 GMT
            Not After : Jun 27 23:22:56 2024 GMT
        Subject: CN=auth7.shop
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:e8:1d:c1:c5:00:fd:ea:42:ce:e4:40:10:5e:b6:
                    6e:87:a3:e6:83:e3:ca:98:20:3e:d8:35:de:7d:61:
                    4f:f0:4f:ab:32:36:70:d4:03:28:c8:74:1a:19:5b:
                    94:49:ab:3d:8c:2c:08:bc:52:6f:71:ca:e8:42:d4:
                    ac:f6:2b:c7:77:33:c2:f4:e7:e7:66:9b:87:a5:45:
                    a7:c3:c1:92:eb:4a:aa:07:e0:e5:45:f1:c3:51:f6:
                    97:61:62:4e:57:e4:7e:79:78:0d:2c:f2:73:fa:e1:
                    a2:f2:9f:15:00:f3:71:ab:13:d1:ba:ad:1f:d1:01:
                    30:80:72:22:4d:7b:80:49:93:32:f4:8a:a7:11:13:
                    dd:0f:e1:67:b4:68:ce:eb:ad:67:08:47:40:70:e2:
                    e7:4a:64:08:62:d8:5a:83:5d:6d:21:04:6b:bd:6b:
                    70:4f:31:ca:44:13:25:b8:1f:09:bd:10:dd:5d:54:
                    7d:34:25:fa:b5:06:9d:a8:b1:c0:83:ec:11:7f:8a:
                    ec:f6:ab:59:f9:33:f4:40:2e:a2:38:e6:fd:c8:6d:
                    29:7d:4d:6f:30:d5:21:ed:33:e3:ba:ca:86:b3:7f:
                    ec:de:1b:6b:03:9b:77:52:ae:35:23:78:aa:73:92:
                    11:7f:17:ef:57:33:f0:b6:ce:dd:d5:a2:66:8d:1a:
                    04:07
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier: 
                A5:94:8B:04:AB:37:34:F2:EC:6B:20:E7:76:CC:C2:B4:E6:56:C6:A8
            X509v3 Authority Key Identifier: 
                14:2E:B3:17:B7:58:56:CB:AE:50:09:40:E6:1F:AF:9D:8B:14:C2:C6
            Authority Information Access: 
                OCSP - URI:http://r3.o.lencr.org
                CA Issuers - URI:http://r3.i.lencr.org/
            X509v3 Subject Alternative Name: 
                DNS:auth7.shop
            X509v3 Certificate Policies: 
                Policy: 2.23.140.1.2.1
            CT Precertificate SCTs: 
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : 48:B0:E3:6B:DA:A6:47:34:0F:E5:6A:02:FA:9D:30:EB:
                                1C:52:01:CB:56:DD:2C:81:D9:BB:BF:AB:39:D8:84:73
                    Timestamp : Mar 30 00:22:57.368 2024 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:46:02:21:00:C8:29:F4:BE:FD:B9:D4:27:E0:D0:52:
                                88:CF:9F:61:86:82:7B:DC:AD:AE:4D:7D:69:B8:15:21:
                                21:5F:7C:45:FD:02:21:00:E3:B9:39:31:82:A5:30:F5:
                                E6:1F:B1:FA:98:AA:4B:00:76:40:5D:A5:EF:03:25:18:
                                1D:39:96:FC:0B:01:27:24
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : A2:E2:BF:D6:1E:DE:2F:2F:07:A0:D6:4E:6D:37:A7:DC:
                                65:43:B0:C6:B5:2E:A2:DA:B7:8A:F8:9A:6D:F5:17:D8
                    Timestamp : Mar 30 00:22:57.385 2024 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:45:02:20:06:10:55:E6:87:90:2E:B2:18:92:EF:0C:
                                44:FD:50:54:F5:FD:16:44:54:F8:8B:F1:C4:6D:BA:66:
                                51:06:CE:82:02:21:00:BF:63:7A:07:95:5B:69:54:B9:
                                9E:63:E3:69:D2:F7:E6:FC:D6:3C:BF:E2:28:63:89:5A:
                                18:CA:6A:44:52:66:25
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        01:5d:9f:a3:f1:3c:36:39:f7:03:c4:66:29:42:8c:53:69:79:
        27:c8:4c:85:4d:14:0d:8c:a2:c7:b8:94:34:35:3d:1b:03:3f:
        f2:d5:cf:80:77:1a:97:21:7b:8f:d6:0a:4f:96:7c:5d:38:56:
        53:66:36:5d:d0:1f:ca:7b:47:03:b0:1b:f5:fc:d3:b2:27:75:
        48:3e:d1:2c:51:cd:87:9c:e1:46:ed:3a:66:12:2d:e3:ab:49:
        b0:09:d9:1c:af:4f:51:dd:6f:05:b1:eb:5c:02:04:f0:5d:55:
        ef:d2:4b:f0:66:68:82:53:b2:2a:d3:94:54:a8:3b:b9:f2:4a:
        42:a0:53:4c:11:6b:9c:bd:13:0b:64:62:ec:a0:90:d9:ce:a0:
        7a:d0:4e:33:56:41:21:0a:54:93:f1:40:8b:23:0e:27:67:71:
        88:79:a6:f7:f0:c1:62:96:bf:10:03:ff:01:ce:7c:d4:5e:e1:
        a5:81:d7:08:34:1b:88:79:30:0f:87:c0:80:3a:29:89:aa:08:
        de:f9:a3:84:6f:c1:ad:7a:3e:2c:da:58:d0:d0:a5:23:a1:84:
        8d:2e:29:2a:7d:bf:5d:ab:d2:81:61:18:c2:cc:9d:8b:17:ea:
        63:7e:c6:5e:a9:02:24:1a:9d:af:b9:a0:88:a3:ed:d3:a7:81:
        94:f0:6b:ae

-544721793 | 2024-05-08T14:59:58.022650

5001 / tcp

HTTP/1.1 403 Forbidden
X-Powered-By: Express
Access-Control-Allow-Origin: *
Content-Type: application/json; charset=utf-8
Content-Length: 44
ETag: W/"2c-uD7tryR8krXf2Ygygv0kQthGpzk"
Date: Wed, 08 May 2024 14:59:57 GMT
Connection: keep-alive
Keep-Alive: timeout=5

{"error":"No chpr token or token incorrect"}

-726790289 | 2024-05-09T21:15:35.238480

5432 / tcp

PostgreSQL
fe_sendauth: no password supplied

SSL Certificate

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6f:8b:c0:28:aa:bc:e1:33:68:35:4f:0a:5a:5a:10:63:87:1f:67:7c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=d41024.acod.regrucolo.ru
        Validity
            Not Before: Feb  5 13:16:16 2022 GMT
            Not After : Feb  3 13:16:16 2032 GMT
        Subject: CN=d41024.acod.regrucolo.ru
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:bb:3e:ec:cc:0f:51:81:d4:88:85:6a:9a:e6:39:
                    d3:03:89:56:05:ea:43:2d:8c:5e:b6:0b:0f:bd:e1:
                    d9:4e:94:8a:42:ab:ad:f1:5b:a0:03:fe:5f:bb:d8:
                    c7:19:40:80:b8:5c:1c:45:b5:23:41:55:cc:17:50:
                    97:6e:b1:2d:82:de:f5:33:67:e2:aa:d1:75:dc:be:
                    0c:77:a8:90:82:a1:15:fd:ea:68:fd:cd:b7:cd:62:
                    fd:6b:87:8d:08:b0:30:48:94:f2:b3:0d:93:3c:b4:
                    c9:22:74:76:3d:66:1a:bb:a2:87:8e:6d:eb:a2:66:
                    85:98:e7:50:ee:8f:7a:a5:75:37:ca:35:01:06:65:
                    53:82:1c:60:88:fb:f0:f8:23:9f:0c:87:d0:f8:6b:
                    ca:ea:80:b2:b2:f7:b1:ba:6c:70:2e:cb:51:85:df:
                    f7:33:2c:0e:52:a2:d7:2f:ab:96:98:f6:e2:cb:99:
                    22:62:24:52:cf:da:24:57:24:b0:3d:0b:e7:71:54:
                    0c:89:c6:7c:63:86:15:25:a1:75:81:20:16:92:55:
                    33:7d:91:1c:3b:eb:69:12:12:dd:8c:4d:cd:a8:a5:
                    5a:db:56:d1:db:06:1b:bc:18:69:42:c8:d2:04:ea:
                    78:c7:5e:5d:d4:3e:73:24:5c:17:96:c0:bc:ca:7c:
                    40:11
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Subject Alternative Name: 
                DNS:d41024.acod.regrucolo.ru
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        98:65:53:27:1a:4f:6b:94:94:ad:a8:c6:7b:a9:da:47:14:83:
        a4:b2:03:33:5f:ff:f8:05:0d:67:73:17:fb:e4:ab:7d:1c:d0:
        7d:31:61:ed:75:80:36:7a:66:8d:52:3f:73:24:fb:5e:fa:cd:
        85:49:ea:1f:f2:8c:62:1a:1f:e6:db:6a:7b:57:d8:b2:b2:e5:
        28:d1:ab:22:10:4e:67:6e:ac:09:3e:bd:b5:19:71:4f:c4:07:
        0f:29:1d:2b:9c:87:61:5c:60:c2:47:18:ae:f5:67:16:dd:6e:
        4c:36:26:24:0c:56:86:31:0d:13:df:77:f5:91:f5:bc:ce:2e:
        86:b5:9d:a4:39:e8:7f:bf:aa:0b:49:36:52:c3:c9:0d:c0:95:
        bc:14:9e:58:50:2a:f3:88:fb:48:89:bd:fb:99:83:93:84:ac:
        4f:4a:b0:cd:ff:58:7f:70:d6:0c:32:5d:ab:1d:d2:01:36:c8:
        b2:83:df:7b:f2:50:7c:ef:59:f2:27:67:5d:43:30:91:a3:04:
        41:ed:66:ef:0e:ba:7a:30:79:54:cd:6e:6e:6a:60:a0:71:ef:
        08:08:5d:bd:14:fc:4c:c4:56:c8:17:50:2d:ae:0b:52:c1:8b:
        59:67:ad:6b:da:0b:da:b1:56:5f:2e:40:9c:6a:bd:97:eb:5f:
        06:30:02:21

1312877338 | 2024-05-15T01:55:46.366388

8728 / tcp

HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=utf-8
Server: ProxyChain
Connection: close
Content-Length: 15

Invalid request

699281023 | 2024-04-30T10:10:46.776574

8779 / tcp

HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=utf-8
Server: ProxyChain
Connection: close
Content-Length: 68

699281023 | 2024-05-09T17:53:56.637019

8791 / tcp

HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=utf-8
Server: ProxyChain
Connection: close
Content-Length: 68

699281023 | 2024-05-13T23:50:06.794997

8800 / tcp

HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=utf-8
Server: ProxyChain
Connection: close
Content-Length: 68

699281023 | 2024-05-12T10:49:46.044489

8806 / tcp

HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=utf-8
Server: ProxyChain
Connection: close
Content-Length: 68

699281023 | 2024-04-29T17:22:27.613663

8807 / tcp

HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=utf-8
Server: ProxyChain
Connection: close
Content-Length: 68

699281023 | 2024-05-04T05:53:11.305120

8814 / tcp

HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=utf-8
Server: ProxyChain
Connection: close
Content-Length: 68

699281023 | 2024-05-15T12:45:16.004658

8816 / tcp

HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=utf-8
Server: ProxyChain
Connection: close
Content-Length: 68

699281023 | 2024-05-14T17:21:55.769390

8818 / tcp

HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=utf-8
Server: ProxyChain
Connection: close
Content-Length: 68

699281023 | 2024-05-02T00:16:26.953333

8821 / tcp

HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=utf-8
Server: ProxyChain
Connection: close
Content-Length: 68

699281023 | 2024-04-30T07:35:36.293225

8824 / tcp

HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=utf-8
Server: ProxyChain
Connection: close
Content-Length: 68

699281023 | 2024-04-20T03:37:52.939065

8828 / tcp

HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=utf-8
Server: ProxyChain
Connection: close
Content-Length: 68

699281023 | 2024-04-22T11:27:09.695258

8833 / tcp

HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=utf-8
Server: ProxyChain
Connection: close
Content-Length: 68

1741232280 | 2024-05-14T12:29:26.790807

8834 / tcp

HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=utf-8
Server: ProxyChain
Connection: close
Content-Length: 68

Hey, good try, but I'm a HTTP proxy, not your ordinary web server :)

-698893584 | 2024-05-10T17:43:44.832154

9000 / tcp

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Fri, 10 May 2024 17:43:44 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://weblate.chpr.pw/
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
Cross-Origin-Opener-Policy: same-origin

1086874567 | 2024-05-11T17:31:48.318519

9090 / tcp

HTTP/1.1 401 Unauthorized
Content-Type: text/plain; charset=utf-8
Www-Authenticate: Basic
X-Content-Type-Options: nosniff
Date: Sat, 11 May 2024 17:31:48 GMT
Content-Length: 13

176.99.4.126

Last Seen: 2024-05-16

Tags:

GeneralInformation

Vulnerabilities

OpenPorts

589765266 | 2024-05-15T06:42:17.599908
80 / tcp

nginx1.18.0

-1345205424 | 2024-05-13T20:21:04.456475
111 / tcp

-1345205424 | 2024-05-16T05:21:02.213270
111 / udp

-1027761948 | 2024-05-13T07:13:47.108634
443 / tcp

nginx1.18.0

-544721793 | 2024-05-08T14:59:58.022650
5001 / tcp

-726790289 | 2024-05-09T21:15:35.238480
5432 / tcp

PostgreSQL12.14 - 12.18

1312877338 | 2024-05-15T01:55:46.366388
8728 / tcp

699281023 | 2024-04-30T10:10:46.776574
8779 / tcp

699281023 | 2024-05-09T17:53:56.637019
8791 / tcp

699281023 | 2024-05-13T23:50:06.794997
8800 / tcp

699281023 | 2024-05-12T10:49:46.044489
8806 / tcp

699281023 | 2024-04-29T17:22:27.613663
8807 / tcp

699281023 | 2024-05-04T05:53:11.305120
8814 / tcp

699281023 | 2024-05-15T12:45:16.004658
8816 / tcp

699281023 | 2024-05-14T17:21:55.769390
8818 / tcp

699281023 | 2024-05-02T00:16:26.953333
8821 / tcp

699281023 | 2024-04-30T07:35:36.293225
8824 / tcp

699281023 | 2024-04-20T03:37:52.939065
8828 / tcp

699281023 | 2024-04-22T11:27:09.695258
8833 / tcp

1741232280 | 2024-05-14T12:29:26.790807
8834 / tcp

-698893584 | 2024-05-10T17:43:44.832154
9000 / tcp

nginx

1086874567 | 2024-05-11T17:31:48.318519
9090 / tcp

Products

Pricing

Contact Us

176.99.4.126

Last Seen: 2024-05-16

Tags:

GeneralInformation

Vulnerabilities

OpenPorts

589765266 | 2024-05-15T06:42:17.599908 80 / tcp

nginx1.18.0

-1345205424 | 2024-05-13T20:21:04.456475 111 / tcp

-1345205424 | 2024-05-16T05:21:02.213270 111 / udp

-1027761948 | 2024-05-13T07:13:47.108634 443 / tcp

nginx1.18.0

-544721793 | 2024-05-08T14:59:58.022650 5001 / tcp

-726790289 | 2024-05-09T21:15:35.238480 5432 / tcp

PostgreSQL12.14 - 12.18

1312877338 | 2024-05-15T01:55:46.366388 8728 / tcp

699281023 | 2024-04-30T10:10:46.776574 8779 / tcp

699281023 | 2024-05-09T17:53:56.637019 8791 / tcp

699281023 | 2024-05-13T23:50:06.794997 8800 / tcp

699281023 | 2024-05-12T10:49:46.044489 8806 / tcp

699281023 | 2024-04-29T17:22:27.613663 8807 / tcp

699281023 | 2024-05-04T05:53:11.305120 8814 / tcp

699281023 | 2024-05-15T12:45:16.004658 8816 / tcp

699281023 | 2024-05-14T17:21:55.769390 8818 / tcp

699281023 | 2024-05-02T00:16:26.953333 8821 / tcp

699281023 | 2024-04-30T07:35:36.293225 8824 / tcp

699281023 | 2024-04-20T03:37:52.939065 8828 / tcp

699281023 | 2024-04-22T11:27:09.695258 8833 / tcp

1741232280 | 2024-05-14T12:29:26.790807 8834 / tcp

-698893584 | 2024-05-10T17:43:44.832154 9000 / tcp

nginx

1086874567 | 2024-05-11T17:31:48.318519 9090 / tcp

Products

Pricing

Contact Us

589765266 | 2024-05-15T06:42:17.599908
80 / tcp

-1345205424 | 2024-05-13T20:21:04.456475
111 / tcp

-1345205424 | 2024-05-16T05:21:02.213270
111 / udp

-1027761948 | 2024-05-13T07:13:47.108634
443 / tcp

-544721793 | 2024-05-08T14:59:58.022650
5001 / tcp

-726790289 | 2024-05-09T21:15:35.238480
5432 / tcp

1312877338 | 2024-05-15T01:55:46.366388
8728 / tcp

699281023 | 2024-04-30T10:10:46.776574
8779 / tcp

699281023 | 2024-05-09T17:53:56.637019
8791 / tcp

699281023 | 2024-05-13T23:50:06.794997
8800 / tcp

699281023 | 2024-05-12T10:49:46.044489
8806 / tcp

699281023 | 2024-04-29T17:22:27.613663
8807 / tcp

699281023 | 2024-05-04T05:53:11.305120
8814 / tcp

699281023 | 2024-05-15T12:45:16.004658
8816 / tcp

699281023 | 2024-05-14T17:21:55.769390
8818 / tcp

699281023 | 2024-05-02T00:16:26.953333
8821 / tcp

699281023 | 2024-04-30T07:35:36.293225
8824 / tcp

699281023 | 2024-04-20T03:37:52.939065
8828 / tcp

699281023 | 2024-04-22T11:27:09.695258
8833 / tcp

1741232280 | 2024-05-14T12:29:26.790807
8834 / tcp

-698893584 | 2024-05-10T17:43:44.832154
9000 / tcp

1086874567 | 2024-05-11T17:31:48.318519
9090 / tcp