GeneralInformation

Country	China
City	Beijing
Organization	China Netcom Group Beijing Corporation
ISP	China Unicom Beijing Province Network
ASN	AS4808
Operating System	Windows Server 2008 R2 Standard

Vulnerabilities

Note: the device may not be impacted by all of these issues. The vulnerabilities are implied based on the software and version.

CVE-2019-0708	10.0A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.
CVE-2010-3972	10.0Heap-based buffer overflow in the TELNET_STREAM_CONTEXT::OnSendData function in ftpsvc.dll in Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) 7.0, and IIS 7.5, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted FTP command, aka "IIS FTP Service Heap Buffer Overrun Vulnerability." NOTE: some of these details are obtained from third party information.
CVE-2010-2730	9.3Buffer overflow in Microsoft Internet Information Services (IIS) 7.5, when FastCGI is enabled, allows remote attackers to execute arbitrary code via crafted headers in a request, aka "Request Header Buffer Overflow Vulnerability."
CVE-2010-1899	4.3Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services (IIS) 5.1, 6.0, 7.0, and 7.5 allows remote attackers to cause a denial of service (daemon outage) via a crafted request, related to asp.dll, aka "IIS Repeated Parameter Request Denial of Service Vulnerability."

OpenPorts

80 81 91 3389 4523 6000 9091

-119375469 | 2024-05-21T11:24:08.002671

80 / tcp

HTTP/1.1 200 OK
Content-Type: text/html
Last-Modified: Wed, 21 Mar 2018 10:17:30 GMT
Accept-Ranges: bytes
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Tue, 21 May 2024 11:24:09 GMT
Content-Length: 689

1793385155 | 2024-05-10T17:21:24.358243

81 / tcp

HTTP/1.0 200 Ok
Server: Gnway Web Server
Date: Sat, 11 May 2024 01:21:26 GMT
Content-Type: text/html
Content-Length: 4629

1793385155 | 2024-05-22T17:03:24.949443

91 / tcp

HTTP/1.0 200 Ok
Server: Gnway Web Server
Date: Thu, 23 May 2024 01:03:28 GMT
Content-Type: text/html
Content-Length: 4629

911126196 | 2024-05-25T15:23:56.341113

3389 / tcp

Remote Desktop Protocol
\x03\x00\x00\x13\x0e\xd0\x00\x00\x124\x00\x03\x00\x08\x00\x02\x00\x00\x00
Remote Desktop Protocol NTLM Info:
  OS: Windows 7/Windows Server 2008 R2
  OS Build: 6.1.7601
  Target Name: TS100E5
  NetBIOS Domain Name: TS100E5
  NetBIOS Computer Name: TS100E5
  DNS Domain Name: TS100E5
  FQDN: TS100E5

4 Windows Server-2008rz
Standard

SSL Certificate

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            20:63:c2:2b:54:8d:9a:89:47:f9:8e:0e:42:99:71:a3
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN=TS100E5
        Validity
            Not Before: Feb 21 18:22:22 2024 GMT
            Not After : Aug 22 18:22:22 2024 GMT
        Subject: CN=TS100E5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:8c:3e:d0:4d:61:bb:59:93:cb:06:ea:86:df:9c:
                    cf:8f:d9:46:58:7d:a4:c3:7f:03:3a:e9:4c:21:ff:
                    be:b3:c6:0d:6b:00:1c:c6:1c:6e:02:2d:38:48:05:
                    40:e7:bf:10:e2:e5:90:47:86:63:9b:85:9b:08:63:
                    00:15:6d:4e:ab:64:15:7c:0f:bf:10:8d:47:32:20:
                    5c:56:2a:3c:01:41:4c:5c:12:c5:b1:e6:07:a3:34:
                    ee:dd:14:e5:d1:f6:53:16:92:ae:f7:a6:fb:79:86:
                    1f:bf:ff:7b:bf:4c:65:2a:fe:32:dc:a7:c4:a9:d6:
                    81:a3:95:da:47:ac:60:f4:b7:cd:1f:df:34:97:96:
                    36:9f:91:5c:86:d6:f5:51:9e:e9:35:19:13:d2:16:
                    c5:0d:69:15:e6:95:f6:e0:32:cc:1d:3b:7a:76:1f:
                    9e:f9:66:e6:81:fc:d7:62:11:2d:ca:35:80:a1:fd:
                    e9:9b:21:1e:f8:1a:91:57:84:01:2f:e3:0c:2a:5b:
                    5c:0a:be:96:ed:25:8c:e3:ee:9d:0e:69:d6:f4:51:
                    01:bf:a7:ab:ab:83:01:7a:77:72:83:41:a4:88:8c:
                    1b:d2:83:e1:77:43:ad:b8:03:43:2f:77:87:d9:26:
                    fe:6e:cc:74:6f:bf:bc:60:f9:15:4e:0d:dd:46:46:
                    cd:fb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication
            X509v3 Key Usage: 
                Key Encipherment, Data Encipherment
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        70:63:d4:f8:62:f3:7d:1e:35:96:e8:79:08:ad:1e:7e:d8:c4:
        2d:72:45:4d:e0:f2:45:65:82:6e:3b:4e:4f:b9:03:ef:32:10:
        8e:ea:8d:d3:ce:9e:3c:ee:cd:fe:79:b7:03:ec:2b:c9:d7:2d:
        10:8e:6c:5a:5c:84:09:07:a8:18:f7:79:11:23:17:07:48:79:
        40:a6:d9:1a:e6:6f:11:56:45:c1:a7:19:cd:4e:eb:88:3c:22:
        30:72:aa:9d:26:5c:48:90:fd:9e:c6:44:86:0e:e5:63:5d:d4:
        21:ee:e1:6a:8c:81:30:8f:de:7a:32:a2:19:4f:aa:a8:df:b4:
        ef:cd:e8:03:7b:bd:1c:35:0e:76:ce:a2:ce:52:97:53:a4:cd:
        e9:12:35:a1:03:5d:2a:a3:d1:1d:b2:b3:27:07:a7:96:25:9c:
        d7:42:e0:68:62:2a:02:c1:d4:1d:a7:c5:02:1a:55:5a:68:19:
        0c:47:59:68:e4:1f:8f:66:32:5d:0f:e8:ba:7c:6a:82:05:17:
        c3:d4:20:75:4e:ce:99:0e:66:46:1d:1c:74:a2:42:ed:1a:c5:
        ed:03:f9:7e:32:c0:85:f6:35:66:b4:39:14:09:ac:ce:71:32:
        e8:d8:72:b4:16:5e:20:ea:5f:52:2f:93:06:bb:ff:80:ce:24:
        38:4c:56:c7

1489525118 | 2024-05-23T11:51:07.846266

4523 / tcp

HTTP/1.1 404 Not Found
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Thu, 23 May 2024 11:51:13 GMT
Connection: close
Content-Length: 315

919989267 | 2024-05-24T04:33:47.047702

9091 / tcp

HTTP/1.1 400 Bad Request
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Fri, 24 May 2024 04:33:53 GMT
Connection: close
Content-Length: 334

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>Bad Request</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
<BODY><h2>Bad Request - Invalid Hostname</h2>
<hr><p>HTTP Error 400. The request hostname is invalid.</p>
</BODY></HTML>

61.50.137.213

Last Seen: 2024-05-25

Tags:

GeneralInformation

Vulnerabilities

OpenPorts

-119375469 | 2024-05-21T11:24:08.002671
80 / tcp

Microsoft IIS httpd7.5

1793385155 | 2024-05-10T17:21:24.358243
81 / tcp

1793385155 | 2024-05-22T17:03:24.949443
91 / tcp

911126196 | 2024-05-25T15:23:56.341113
3389 / tcp

Remote Desktop Protocol

1489525118 | 2024-05-23T11:51:07.846266
4523 / tcp

919989267 | 2024-05-24T04:33:47.047702
9091 / tcp

Products

Pricing

Contact Us

61.50.137.213

Last Seen: 2024-05-25

Tags:

GeneralInformation

Vulnerabilities

OpenPorts

-119375469 | 2024-05-21T11:24:08.002671 80 / tcp

Microsoft IIS httpd7.5

1793385155 | 2024-05-10T17:21:24.358243 81 / tcp

1793385155 | 2024-05-22T17:03:24.949443 91 / tcp

911126196 | 2024-05-25T15:23:56.341113 3389 / tcp

Remote Desktop Protocol

1489525118 | 2024-05-23T11:51:07.846266 4523 / tcp

919989267 | 2024-05-24T04:33:47.047702 9091 / tcp

Products

Pricing

Contact Us

-119375469 | 2024-05-21T11:24:08.002671
80 / tcp

1793385155 | 2024-05-10T17:21:24.358243
81 / tcp

1793385155 | 2024-05-22T17:03:24.949443
91 / tcp

911126196 | 2024-05-25T15:23:56.341113
3389 / tcp

1489525118 | 2024-05-23T11:51:07.846266
4523 / tcp

919989267 | 2024-05-24T04:33:47.047702
9091 / tcp