GeneralInformation

Hostnames	nc-ph-1842-41.web-hosting.com wellkauf.cc
Domains	web-hosting.com wellkauf.cc
Country	United States
City	Phoenix
Organization	Namecheap, Inc.
ISP	Namecheap, Inc.
ASN	AS22612

Vulnerabilities

Note: the device may not be impacted by all of these issues. The vulnerabilities are implied based on the software and version.

CVE-2023-46118	4.9RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.
CVE-2023-44487	7.5The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2022-31008	7.5RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: `3.10.2`, `3.9.18`, `3.8.32` are available. Users unable to upgrade should disable the Shovel and Federation plugins.
CVE-2021-3618	7.4ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.

OpenPorts

22 80 123 443 4369 5672

450059978 | 2024-04-15T12:40:23.992848

22 / tcp

SSH-2.0-OpenSSH_7.9p1 Debian-10+deb10u2
Key type: ssh-rsa
Key: AAAAB3NzaC1yc2EAAAADAQABAAABAQDRaQZeG0nhBOnmnQR5kFjZuf6qi/YsHkgmk0FEHwXoLusV
zpEseJarRA8qV1tfTH6JEu3sNpdjX3VaGBodFcL1FhkNFcxs67DFkaTumfS/swJSRrubZuOAnOPf
C8kLxHEvHy+Xz0o5sn04Ymatey3aZTe0SxFboBSNKu52qdFUH+1OjtMMogcuODo007IBxUixhZLH
myHXBvmMsM2ELJHHqKHto0j5SXySmKwQ418xMuUJ4nW425CGcgpazyD4NduWVMKOzeYaKn7dXJbx
mcNfTj5VoejrFYbTRgd/ytszwp6S/O+SXOT068dtvP4bvfjODlxS5hyUrf+mWw2vz5pX
Fingerprint: 02:77:6a:96:17:0d:c0:6d:dc:49:ca:56:7b:b5:d1:f9

Kex Algorithms:
	curve25519-sha256
	curve25519-sha256@libssh.org
	ecdh-sha2-nistp256
	ecdh-sha2-nistp384
	ecdh-sha2-nistp521
	diffie-hellman-group-exchange-sha256
	diffie-hellman-group16-sha512
	diffie-hellman-group18-sha512
	diffie-hellman-group14-sha256
	diffie-hellman-group14-sha1

Server Host Key Algorithms:
	rsa-sha2-512
	rsa-sha2-256
	ssh-rsa
	ecdsa-sha2-nistp256
	ssh-ed25519

Encryption Algorithms:
	chacha20-poly1305@openssh.com
	aes128-ctr
	aes192-ctr
	aes256-ctr
	aes128-gcm@openssh.com
	aes256-gcm@openssh.com

MAC Algorithms:
	umac-64-etm@openssh.com
	umac-128-etm@openssh.com
	hmac-sha2-256-etm@openssh.com
	hmac-sha2-512-etm@openssh.com
	hmac-sha1-etm@openssh.com
	umac-64@openssh.com
	umac-128@openssh.com
	hmac-sha2-256
	hmac-sha2-512
	hmac-sha1

Compression Algorithms:
	none
	zlib@openssh.com

-1268334301 | 2024-04-17T11:35:00.221476

80 / tcp

HTTP/1.1 404 Not Found
Server: nginx/1.20.1
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache, private
Date: Wed, 17 Apr 2024 11:34:59 GMT
Link: <http://199.188.207.203/api/docs.jsonld>; rel="http://www.w3.org/ns/hydra/core#apiDocumentation"
X-Debug-Token: 865c1a
X-Debug-Token-Link: http://199.188.207.203/_profiler/865c1a
X-Robots-Tag: noindex

-1317135679 | 2024-04-11T19:06:43.657035

123 / udp

NTP
protocolversion: 3
stratum: 3
leap: 0
precision: -24
rootdelay: 0.0307312011719
rootdisp: 0.0454711914062
refid: 760155598
reftime: 3921849228.66
poll: 3

-1139146516 | 2024-04-22T10:36:57.857800

443 / tcp

HTTP/1.1 404 Not Found
Server: nginx/1.20.1
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache, private
Date: Mon, 22 Apr 2024 10:36:57 GMT
Link: <https://199.188.207.203/api/docs.jsonld>; rel="http://www.w3.org/ns/hydra/core#apiDocumentation"
X-Debug-Token: 4ae621
X-Debug-Token-Link: https://199.188.207.203/_profiler/4ae621
X-Robots-Tag: noindex

SSL Certificate

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            03:30:63:d2:34:61:24:3b:a5:1b:7f:c8:f6:df:38:c5:61:4e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Let's Encrypt, CN=R3
        Validity
            Not Before: Jul  8 20:31:05 2021 GMT
            Not After : Oct  6 20:31:04 2021 GMT
        Subject: CN=wellkauf.cc
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:94:a9:ab:b5:b8:c2:03:a1:0a:b7:d2:af:91:da:
                    a1:9e:ff:03:60:74:ac:18:bf:1d:67:8e:d9:ca:e6:
                    35:51:a8:8a:ac:2d:8f:db:4f:d0:a4:5d:bc:e1:42:
                    ce:3f:4f:ae:48:b4:14:f6:ef:9f:0d:66:95:1e:c1:
                    4a:18:d9:44:98:6e:99:b7:73:9d:56:f1:3a:54:d5:
                    9a:92:2e:47:cb:66:6d:ca:8b:bd:0c:5f:a7:7f:cf:
                    34:0c:61:98:aa:8b:e9:3c:81:2d:e0:44:77:eb:ee:
                    5f:a0:e5:2b:8c:f2:8b:11:a2:5d:16:fa:be:06:3c:
                    f4:77:12:17:d0:84:77:21:82:36:74:f2:c4:3a:89:
                    00:3c:76:e8:8a:7a:4f:78:5c:bc:92:44:6b:de:60:
                    c2:a7:dd:06:93:14:21:68:e7:83:ac:e0:f9:db:10:
                    ce:a8:c0:1f:35:bb:0f:42:68:13:c8:88:1b:dd:59:
                    34:15:d4:44:11:9b:36:31:40:f5:b2:7f:e2:65:52:
                    e5:9a:73:a4:b3:bf:80:2d:3d:e2:5a:10:bb:d3:a0:
                    b8:b0:b2:77:2a:96:ee:42:b0:e7:19:16:ed:46:2a:
                    1b:f2:06:4a:2b:b2:80:1f:4a:28:95:6e:89:29:f2:
                    aa:7d:e8:91:57:e3:f4:2c:b9:e0:e7:b9:ed:0f:0d:
                    79:99
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier: 
                DE:6B:CF:DC:BA:A4:85:A4:54:E0:83:A3:D4:66:BB:F5:1A:20:E7:7F
            X509v3 Authority Key Identifier: 
                14:2E:B3:17:B7:58:56:CB:AE:50:09:40:E6:1F:AF:9D:8B:14:C2:C6
            Authority Information Access: 
                OCSP - URI:http://r3.o.lencr.org
                CA Issuers - URI:http://r3.i.lencr.org/
            X509v3 Subject Alternative Name: 
                DNS:wellkauf.cc
            X509v3 Certificate Policies: 
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.44947.1.1.1
                  CPS: http://cps.letsencrypt.org
            CT Precertificate SCTs: 
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : F6:5C:94:2F:D1:77:30:22:14:54:18:08:30:94:56:8E:
                                E3:4D:13:19:33:BF:DF:0C:2F:20:0B:CC:4E:F1:64:E3
                    Timestamp : Jul  8 21:31:05.684 2021 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:45:02:20:3A:B0:6B:13:66:C7:E3:5D:4D:A9:D5:95:
                                28:A2:F4:B9:69:C6:EE:62:19:9F:69:68:B9:09:5F:B8:
                                25:25:BE:3D:02:21:00:A7:18:4A:FC:BD:3E:CE:48:C9:
                                B6:28:3A:9B:AF:A8:80:A6:A9:3D:B0:76:56:67:49:87:
                                6D:FE:6A:44:00:FA:8B
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : 6F:53:76:AC:31:F0:31:19:D8:99:00:A4:51:15:FF:77:
                                15:1C:11:D9:02:C1:00:29:06:8D:B2:08:9A:37:D9:13
                    Timestamp : Jul  8 21:31:05.738 2021 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:46:02:21:00:B5:E6:61:BA:F2:F8:45:C6:91:CA:6F:
                                BB:08:AE:05:AB:C3:6D:F3:1F:B6:AB:21:74:08:2D:F6:
                                83:38:49:18:01:02:21:00:F7:CC:E7:90:48:C2:15:67:
                                87:E0:36:20:E6:BA:6A:2F:CA:D2:05:94:B1:3E:89:87:
                                E8:7C:9A:85:F1:F2:35:DE
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        37:5b:0b:31:2e:a2:a7:89:d8:1f:b6:56:a5:ac:6b:74:31:f5:
        f4:04:63:5a:38:b4:0f:61:8d:44:91:39:d2:8f:5b:97:5c:24:
        d4:11:ee:39:2f:05:29:40:7d:41:32:54:da:86:c3:0e:f7:2f:
        7f:7b:14:7d:ca:45:3a:db:b5:20:95:5e:35:c0:53:cb:d3:43:
        49:8d:c0:f0:8a:8e:89:39:6e:ed:86:20:f0:52:1b:b4:60:fe:
        8f:f3:a4:d5:4e:48:ba:ab:f6:4e:07:25:43:a6:46:97:cc:15:
        7e:80:d0:21:0a:64:76:f3:d1:68:73:01:d6:14:14:75:12:96:
        e5:33:27:29:fb:40:04:35:c7:68:7d:37:5e:18:bb:f5:cf:c2:
        c6:93:d1:4d:d5:96:0e:2d:91:1e:2a:7d:59:b2:c2:8d:86:2f:
        11:fa:d4:f6:cf:7c:8a:59:08:2d:8e:4f:1b:84:15:d1:68:7c:
        44:7f:e4:30:6a:62:5f:aa:93:66:7b:59:fb:a6:ee:1f:2e:8a:
        df:a4:6d:c4:3e:c5:b5:6f:03:5f:cb:f5:67:e4:b1:73:0a:e9:
        7c:d2:4e:90:00:c1:c3:81:0f:af:5c:78:c0:73:ee:3e:29:89:
        68:ce:89:d5:58:fc:95:35:9c:e6:73:9f:8c:b1:9d:f3:72:31:
        7e:ee:71:b0

1913291440 | 2024-04-15T21:33:15.419098

4369 / tcp

Erlang Port Mapper Daemon:
  nodes: <empty>

-1686295216 | 2024-04-16T18:12:34.628017

5672 / tcp

AMQP:
  Protocol Version: 0-9
  Product: RabbitMQ
  Product Version: 3.9.2
  Platform: Erlang/OTP 24.0.5
  Capabilities:
    Exchange Exchange Bindings: True
    Connection.blocked: True
    Authentication Failure Close: True
    Direct Reply To: True
    Basic.nack: True
    Per Consumer Qos: True
    Consumer Priorities: True
    Consumer Cancel Notify: True
    Publisher Confirms: True

199.188.207.203

Last Seen: 2024-04-22

Tags:

GeneralInformation

Vulnerabilities

OpenPorts

450059978 | 2024-04-15T12:40:23.992848
22 / tcp

OpenSSH7.9p1 Debian 10+deb10u2

-1268334301 | 2024-04-17T11:35:00.221476
80 / tcp

nginx1.20.1

-1317135679 | 2024-04-11T19:06:43.657035
123 / udp

-1139146516 | 2024-04-22T10:36:57.857800
443 / tcp

nginx1.20.1

1913291440 | 2024-04-15T21:33:15.419098
4369 / tcp

Erlang Port Mapper Daemon

-1686295216 | 2024-04-16T18:12:34.628017
5672 / tcp

RabbitMQ3.9.2

Products

Pricing

Contact Us

199.188.207.203

Last Seen: 2024-04-22

Tags:

GeneralInformation

Vulnerabilities

OpenPorts

450059978 | 2024-04-15T12:40:23.992848 22 / tcp

OpenSSH7.9p1 Debian 10+deb10u2

-1268334301 | 2024-04-17T11:35:00.221476 80 / tcp

nginx1.20.1

-1317135679 | 2024-04-11T19:06:43.657035 123 / udp

-1139146516 | 2024-04-22T10:36:57.857800 443 / tcp

nginx1.20.1

1913291440 | 2024-04-15T21:33:15.419098 4369 / tcp

Erlang Port Mapper Daemon

-1686295216 | 2024-04-16T18:12:34.628017 5672 / tcp

RabbitMQ3.9.2

Products

Pricing

Contact Us

450059978 | 2024-04-15T12:40:23.992848
22 / tcp

-1268334301 | 2024-04-17T11:35:00.221476
80 / tcp

-1317135679 | 2024-04-11T19:06:43.657035
123 / udp

-1139146516 | 2024-04-22T10:36:57.857800
443 / tcp

1913291440 | 2024-04-15T21:33:15.419098
4369 / tcp

-1686295216 | 2024-04-16T18:12:34.628017
5672 / tcp