GeneralInformation

Hostnames	matomo.savethechildren.de
Domains	savethechildren.de
Country	Germany
City	Neustadt am Rübenberge
Organization	Mittwald CM Service GmbH & Co. KG
ISP	Robert Meyer trading as "Mittwald CM Service GmbH & Co. KG"
ASN	AS15817

WebTechnologies

Analytics

Matomo Analytics

Ecommerce

Abicart

JavaScript frameworks

AngularJS

Vulnerabilities

Note: the device may not be impacted by all of these issues. The vulnerabilities are implied based on the software and version.

2025(2)

CVE-2025-26466

5.9A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.

CVE-2025-26465

6.8A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

OpenPorts

21 22 80 443 3306

21 / tcp

584713791 | 2025-03-19T06:26:04.933492

220 FTP-Server
530 Login incorrect.
214-The following commands are recognized (* =>'s unimplemented):
 CWD     XCWD    CDUP    XCUP    SMNT*   QUIT    PORT    PASV    
 EPRT    EPSV    ALLO*   RNFR    RNTO    DELE    MDTM    RMD     
 XRMD    MKD     XMKD    PWD     XPWD    SIZE    SYST    HELP    
 NOOP    FEAT    OPTS    HOST    CLNT    AUTH*   CCC*    CONF*   
 ENC*    MIC*    PBSZ*   PROT*   TYPE    STRU    MODE    RETR    
 STOR    STOU    APPE    REST    ABOR    USER    PASS    ACCT*   
 REIN*   LIST    NLST    STAT    SITE    MLSD    MLST    
214 Direct comments to root@172.21.146.5
211-Features:
 CLNT
 EPRT
 EPSV
 HOST
 LANG en-US*
 MDTM
 MFF modify;UNIX.group;UNIX.mode;
 MFMT
 MLST modify*;perm*;size*;type*;unique*;UNIX.group*;UNIX.groupname*;UNIX.mode*;UNIX.owner*;UNIX.ownername*;
 REST STREAM
 SIZE
 TVFS
 UTF8
211 End

22 / tcp

-1901825278 | 2025-03-23T00:17:59.938995

SSH-2.0-OpenSSH_9.9
Key type: ssh-rsa
Key: AAAAB3NzaC1yc2EAAAABIwAAAQEAlxe0IL/kah6Niulw1IVzxaLySJ9pjzzAR7/MUkpUZLAgE/dK
3ct1Q1ZHErqpluHJi4eZiOD15tAsu4qVBIlAAhzRetUOjYyqFDpCGPfATrBKNu5mXV9H0gbRATgn
57y3jODZi/8Fhg8ElpVvK3xZCTxXm2PzfjuEa9RpnNhN033P6sjfAJ5mUfMJZmPjj/ed9Mf6PlNR
+Kx1MSw0NsVN5n8kffKao6x9ZbfKne8hoKn8eaJ1qzgXE2AiMYN0xvsBY4ANE92ZLA0n8Sy9xg8j
/e12yGdibyy+UFgxXZkWjn5fz3mfJUwBgMJZQAwR5a2EOEyzlyNyP/TBd6wATqL/UQ==
Fingerprint: 6d:77:d0:f4:0c:34:b3:85:cb:2e:a8:47:80:39:46:f0

Kex Algorithms:
	sntrup761x25519-sha512
	sntrup761x25519-sha512@openssh.com
	mlkem768x25519-sha256
	curve25519-sha256
	curve25519-sha256@libssh.org
	ecdh-sha2-nistp256
	ecdh-sha2-nistp384
	ecdh-sha2-nistp521
	diffie-hellman-group-exchange-sha256
	diffie-hellman-group16-sha512
	diffie-hellman-group18-sha512
	diffie-hellman-group14-sha256
	ext-info-s
	kex-strict-s-v00@openssh.com

Server Host Key Algorithms:
	rsa-sha2-512
	rsa-sha2-256
	ssh-rsa
	ssh-ed25519

Encryption Algorithms:
	chacha20-poly1305@openssh.com
	aes128-ctr
	aes192-ctr
	aes256-ctr
	aes128-gcm@openssh.com
	aes256-gcm@openssh.com

MAC Algorithms:
	umac-64-etm@openssh.com
	umac-128-etm@openssh.com
	hmac-sha2-256-etm@openssh.com
	hmac-sha2-512-etm@openssh.com
	hmac-sha1-etm@openssh.com
	umac-64@openssh.com
	umac-128@openssh.com
	hmac-sha2-256
	hmac-sha2-512
	hmac-sha1

Compression Algorithms:
	none
	zlib@openssh.com

Vulnerabilities

80 / tcp

690978746 | 2025-03-18T12:44:36.362192

Hashes

hash

1107903806

http.dom_hash

1787233344

http.html_hash

690978746

http.server_hash

869690771

http.title_hash

1936686324

157.97.32.104

HTTP/1.1 200 OK
Date: Tue, 18 Mar 2025 12:44:36 GMT
Server: Apache
Accept-Ranges: bytes
Transfer-Encoding: chunked

443 / tcp

-352914504 | 2025-03-26T07:17:13.213194

Hashes

hash

56050260

http.dom_hash

-1496595935

http.favicon.hash

-1655011180

http.html_hash

-352914504

http.server_hash

869690771

http.title_hash

1538412401

HTTP/1.1 200 OK
Date: Wed, 26 Mar 2025 07:11:29 GMT
Server: Apache
X-Matomo-Request-Id: 91521
Cache-Control: no-store, must-revalidate
X-Frame-Options: sameorigin
Referrer-Policy: same-origin
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' 'unsafe-inline' 'unsafe-eval' data:;
Set-Cookie: MATOMO_SESSID=7te0hb77mhg1a26e237bfqnvkg; path=/; secure; HttpOnly; SameSite=Lax
Vary: User-Agent,Accept-Encoding
Upgrade: h2,h2c
Connection: Upgrade
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8

SSL Certificate

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            03:db:9a:75:2b:48:b1:29:ae:9e:83:45:1b:e3:5a:9f:51:1d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Let's Encrypt, CN=R11
        Validity
            Not Before: Feb 26 22:54:37 2025 GMT
            Not After : May 27 22:54:36 2025 GMT
        Subject: CN=matomo.savethechildren.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:c2:e7:df:d3:b4:48:51:e0:72:e5:27:6a:65:1d:
                    c5:97:e1:4d:c0:ea:ea:06:55:46:ad:59:71:a5:4f:
                    ae:b3:cd:70:67:a0:d0:a4:4f:36:b9:1d:e8:69:6f:
                    9f:c5:b9:78:87:83:7f:dc:db:1a:3a:15:d6:db:f1:
                    fc:e1:00:cd:16:09:ac:2b:65:e1:d9:e8:a6:88:95:
                    02:a0:55:ff:22:ae:95:5b:8c:17:3d:dc:69:fc:49:
                    fc:f2:82:8b:33:84:8e:e8:68:8e:67:6f:aa:d2:60:
                    27:58:ae:2c:e9:60:43:85:25:65:bb:73:43:9e:cc:
                    1a:91:8b:8c:0a:57:4d:c0:7c:a9:68:14:94:94:56:
                    08:98:b9:d6:28:ec:fc:d9:8f:27:c8:a1:9b:49:d2:
                    79:c2:00:72:32:a3:a7:ac:eb:e8:05:43:c0:3d:70:
                    a7:cf:eb:be:03:d9:e3:ed:a2:d5:23:bc:03:67:ee:
                    be:47:9a:86:5f:32:6f:98:87:0c:75:6d:24:ec:f7:
                    c7:47:fb:90:09:3f:e1:21:be:de:59:d8:81:bf:f4:
                    22:1e:dc:37:d3:db:17:be:0f:d0:f8:71:fb:c2:06:
                    7b:8e:fc:b6:87:90:58:ac:df:75:04:c9:7e:a4:fd:
                    1d:65:fb:ec:89:b3:53:04:a5:40:1c:34:92:9d:67:
                    2f:5d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier: 
                A6:48:B4:EE:22:13:86:ED:0D:C7:95:F4:0A:4D:9B:87:74:88:2A:4B
            X509v3 Authority Key Identifier: 
                C5:CF:46:A4:EA:F4:C3:C0:7A:6C:95:C4:2D:B0:5E:92:2F:26:E3:B9
            Authority Information Access: 
                OCSP - URI:http://r11.o.lencr.org
                CA Issuers - URI:http://r11.i.lencr.org/
            X509v3 Subject Alternative Name: 
                DNS:matomo.savethechildren.de
            X509v3 Certificate Policies: 
                Policy: 2.23.140.1.2.1
            CT Precertificate SCTs: 
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : A2:E3:0A:E4:45:EF:BD:AD:9B:7E:38:ED:47:67:77:53:
                                D7:82:5B:84:94:D7:2B:5E:1B:2C:C4:B9:50:A4:47:E7
                    Timestamp : Feb 26 23:53:07.095 2025 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:45:02:21:00:F5:60:54:67:88:EF:31:71:43:58:C3:
                                77:97:AC:DD:D4:8C:FB:2F:EA:0B:D5:34:E9:9C:12:A9:
                                26:F0:64:7B:D3:02:20:64:8D:BA:6F:9A:A5:91:CA:12:
                                EF:DA:5E:1E:8F:93:D4:12:9C:B5:14:3C:FE:D4:BA:10:
                                82:BC:EC:72:97:5E:43
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : E0:92:B3:FC:0C:1D:C8:E7:68:36:1F:DE:61:B9:96:4D:
                                0A:52:78:19:8A:72:D6:72:C4:B0:4D:A5:6D:6F:54:04
                    Timestamp : Feb 26 23:53:07.217 2025 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:46:02:21:00:B2:5F:62:92:94:AB:76:4B:23:EC:0D:
                                61:EC:7F:FB:F2:4F:86:52:27:3D:E5:E7:0E:A3:B7:0E:
                                1A:E6:F0:A4:4B:02:21:00:E6:17:F9:74:83:AC:F0:44:
                                E2:FB:CC:25:86:4E:A4:A6:96:AC:17:70:98:EC:DD:CA:
                                88:09:33:3A:E5:33:1B:80
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        0a:b2:18:a0:4e:2c:b6:8a:59:e1:ee:bd:c6:3f:87:ea:3f:c7:
        ff:62:c2:98:4a:f8:c0:56:fb:89:a5:d0:7d:d9:a1:1e:1e:a4:
        13:71:bd:f7:01:f5:92:3b:3c:82:84:49:aa:13:e4:a6:ac:48:
        9d:8e:10:bf:c9:3e:ef:52:e4:f2:f9:1b:63:ad:b8:f8:e4:ea:
        a5:4c:9b:90:4e:29:dd:5a:53:bd:a6:8c:91:aa:35:90:26:60:
        9f:9f:86:ee:d3:ed:43:9c:b7:dc:34:43:2e:77:cb:93:30:86:
        3b:b2:0f:3e:dd:96:b8:ac:ca:85:ec:9d:91:5f:46:f8:d6:3b:
        8d:44:ed:0d:67:c9:e7:34:26:a2:7d:69:5b:ef:3c:1e:56:52:
        0b:cf:b2:bf:f0:37:5b:bb:e8:cc:86:4d:8e:08:8d:12:03:83:
        aa:8c:80:19:24:97:65:1d:bf:df:87:59:9f:96:66:f1:05:af:
        97:c5:44:60:b7:f0:7e:19:44:f7:30:20:bc:ca:b5:7f:74:23:
        63:f1:10:9a:46:f1:4a:49:a1:c5:f2:be:45:5b:d2:f4:ea:47:
        9b:5a:16:7c:bc:a4:30:27:9e:da:a5:52:a0:b0:e4:da:63:61:
        52:2c:bc:f1:4b:eb:1f:bc:36:d3:8e:dd:75:05:2a:35:f5:ac:
        ea:ac:59:cc

3306 / tcp

-1382895858 | 2025-03-23T22:52:23.356049

MySQL:
  Error Message: Host '224.101.234.60' is not allowed to connect to this MySQL server
  Error Code: 1130

157.97.32.104

Last Seen: 2025-03-26

Tags:

GeneralInformation

WebTechnologies

Vulnerabilities

OpenPorts

21 / tcp

584713791 | 2025-03-19T06:26:04.933492

22 / tcp

-1901825278 | 2025-03-23T00:17:59.938995

OpenSSH9.9

80 / tcp

690978746 | 2025-03-18T12:44:36.362192

Hashes

Apache httpd

443 / tcp

-352914504 | 2025-03-26T07:17:13.213194

Hashes

Apache httpd

3306 / tcp

-1382895858 | 2025-03-23T22:52:23.356049

MySQL

Products

Pricing

Contact Us

157.97.32.104

Last Seen: 2025-03-26

Tags:

GeneralInformation

WebTechnologies

Vulnerabilities All ports Port 22 Latest CVSS

OpenPorts

21 / tcp 584713791 | 2025-03-19T06:26:04.933492

22 / tcp -1901825278 | 2025-03-23T00:17:59.938995

OpenSSH9.9

80 / tcp 690978746 | 2025-03-18T12:44:36.362192

Hashes

Apache httpd

443 / tcp -352914504 | 2025-03-26T07:17:13.213194

Hashes

Apache httpd

3306 / tcp -1382895858 | 2025-03-23T22:52:23.356049

MySQL

Products

Pricing

Contact Us

Vulnerabilities

21 / tcp

584713791 | 2025-03-19T06:26:04.933492

22 / tcp

-1901825278 | 2025-03-23T00:17:59.938995

80 / tcp

690978746 | 2025-03-18T12:44:36.362192

443 / tcp

-352914504 | 2025-03-26T07:17:13.213194

3306 / tcp

-1382895858 | 2025-03-23T22:52:23.356049