IP Address
IPv4
209.161.6.221
Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.
Run a live full scan of 209.161.6.221
On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.
ASN
AS10587
Click for details
Country
US
United States
Reverse DNS
209-161-6-221.quios.net
PTR
Open Ports
1
Last scan
Autonomous System
Geolocation
Reverse DNS
Last seen
2026-07-19 12:07:19
Network
Prefix
RPKI
—
Open Ports
| Port | Proto | Service | Server | Last seen |
|---|---|---|---|---|
| 443 | tcp | https | Apache/1.3.42 (Unix) PHP/4.4.9 mod_perl/1.32-dev mod_ssl/2.8.31 OpenSSL/0.9.8zb | 2026-07-19 12:05:55.000 |
TLS Certificates
Port 443
35cdf2ecc355…
Subject: *.ewingz.com
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.ewingz.com, ewingz.com
Valid 2025-12-03 00:00:00 → 2026-08-13 23:59:59
Known Vulnerabilities
Published CVEs matched to the software versions fingerprinted on this host. Matching is by product and version against the NVD dictionary — presence of a CVE does not confirm the host is exploitable (patches or backports may apply).
| CVE | Software | CVSS | Severity | Summary |
|---|---|---|---|---|
| CVE-2008-5557 | PHP 4.4.9 | 10.0 | HIGH | Heap-based buffer overflow in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring extension in PHP 4.3.0 through 5.2.6 allows context-dependent atta... |
| CVE-2009-4143 | PHP 4.4.9 | 10.0 | HIGH | PHP before 5.2.12 does not properly handle session data, which has unspecified impact and attack vectors related to (1) interrupt corruption of the SESSION supe... |
| CVE-2011-3268 | PHP 4.4.9 | 10.0 | HIGH | Buffer overflow in the crypt function in PHP before 5.3.7 allows context-dependent attackers to have an unspecified impact via a long salt argument, a different... |
| CVE-2012-2376 | PHP 4.4.9 | 10.0 | HIGH | Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execute arbitrary code via crafted arguments t... |
| CVE-2012-2688 | PHP 4.4.9 | 10.0 | HIGH | Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and re... |
| CVE-2013-5697 | Apache 1.3.42 | 7.5 | HIGH | SQL injection vulnerability in mod_accounting.c in the mod_accounting module 0.5 and earlier for Apache allows remote attackers to execute arbitrary SQL command... |
| CVE-2009-3291 | PHP 4.4.9 | 7.5 | HIGH | The php_openssl_apply_verification_policy function in PHP before 5.2.11 does not properly perform certificate validation, which has unknown impact and attack ve... |
| CVE-2009-3292 | PHP 4.4.9 | 7.5 | HIGH | Unspecified vulnerability in PHP before 5.2.11, and 5.3.x before 5.3.1, has unknown impact and attack vectors related to "missing sanity checks around exif proc... |
| CVE-2009-3293 | PHP 4.4.9 | 7.5 | HIGH | Unspecified vulnerability in the imagecolortransparent function in PHP before 5.2.11 has unknown impact and attack vectors related to an incorrect "sanity check... |
| CVE-2009-4018 | PHP 4.4.9 | 7.5 | HIGH | The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safe_mode_allowed_env_vars and (2) safe_... |
| CVE-2011-1092 | PHP 4.4.9 | 7.5 | HIGH | Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (crash) and possibly read sensitive me... |
| CVE-2011-1148 | PHP 4.4.9 | 7.5 | HIGH | Use-after-free vulnerability in the substr_replace function in PHP 5.3.6 and earlier allows context-dependent attackers to cause a denial of service (memory cor... |
| CVE-2011-1153 | PHP 4.4.9 | 7.5 | HIGH | Multiple format string vulnerabilities in phar_object.c in the phar extension in PHP 5.3.5 and earlier allow context-dependent attackers to obtain sensitive inf... |
| CVE-2012-2311 | PHP 4.4.9 | 7.5 | HIGH | sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that cont... |
| CVE-2013-1635 | PHP 4.4.9 | 7.5 | HIGH | ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir d... |
| CVE-2014-9427 | PHP 4.4.9 | 7.5 | HIGH | sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not p... |
| CVE-2009-3558 | PHP 4.4.9 | 6.8 | MEDIUM | The posix_mkfifo function in ext/posix/posix.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass open_basedir restriction... |
| CVE-2009-5016 | PHP 4.4.9 | 6.8 | MEDIUM | Integer overflow in the xml_utf8_decode function in ext/xml/xml.c in PHP before 5.2.11 makes it easier for remote attackers to bypass cross-site scripting (XSS)... |
| CVE-2010-4697 | PHP 4.4.9 | 6.8 | MEDIUM | Use-after-free vulnerability in the Zend engine in PHP before 5.2.15 and 5.3.x before 5.3.4 might allow context-dependent attackers to cause a denial of service... |
| CVE-2015-7774 | PHP 4.4.9 | 6.5 | MEDIUM | PC-EGG pWebManager before 3.3.10, and before 2.2.2 for PHP 4.x, allows remote authenticated users to execute arbitrary OS commands by leveraging the editor role... |
| CVE-2008-7068 | PHP 4.4.9 | 6.4 | MEDIUM | The dba_replace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service (file truncation) via a key with the NULL byte. N... |
| CVE-2009-2626 | PHP 4.4.9 | 6.4 | MEDIUM | The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive informatio... |
| CVE-2011-2202 | PHP 4.4.9 | 6.4 | MEDIUM | The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows... |
| CVE-2017-3735 | OpenSSL 0.9.8zb | 5.3 | N/A | While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of... |
| CVE-2007-6750 | Apache 1.3.42 | 5.0 | MEDIUM | The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris,... |
| CVE-2011-3368 | Apache 1.3.42 | 5.0 | MEDIUM | The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) R... |
| CVE-2006-7243 | PHP 4.4.9 | 5.0 | MEDIUM | PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe... |
| CVE-2009-3557 | PHP 4.4.9 | 5.0 | MEDIUM | The tempnam function in ext/standard/file.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass safe_mode restrictions, and... |
| CVE-2010-4409 | PHP 4.4.9 | 5.0 | MEDIUM | Integer overflow in the NumberFormatter::getSymbol (aka numfmt_get_symbol) function in PHP 5.3.3 and earlier allows context-dependent attackers to cause a denia... |
| CVE-2010-4699 | PHP 4.4.9 | 5.0 | MEDIUM | The iconv_mime_decode_headers function in the Iconv extension in PHP before 5.3.4 does not properly handle encodings that are unrecognized by the iconv and mbst... |
| CVE-2011-0752 | PHP 4.4.9 | 5.0 | MEDIUM | The extract function in PHP before 5.2.15 does not prevent use of the EXTR_OVERWRITE parameter to overwrite (1) the GLOBALS superglobal array and (2) the this v... |
| CVE-2011-0755 | PHP 4.4.9 | 5.0 | MEDIUM | Integer overflow in the mt_rand function in PHP before 5.3.4 might make it easier for context-dependent attackers to predict the return values by leveraging a s... |
| CVE-2011-1466 | PHP 4.4.9 | 5.0 | MEDIUM | Integer overflow in the SdnToJulian function in the Calendar extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (appl... |
| CVE-2011-1467 | PHP 4.4.9 | 5.0 | MEDIUM | Unspecified vulnerability in the NumberFormatter::setSymbol (aka numfmt_set_symbol) function in the Intl extension in PHP before 5.3.6 allows context-dependent... |
| CVE-2011-3182 | PHP 4.4.9 | 5.0 | MEDIUM | PHP before 5.3.7 does not properly check the return values of the malloc, calloc, and realloc library functions, which allows context-dependent attackers to cau... |
| CVE-2011-3267 | PHP 4.4.9 | 5.0 | MEDIUM | PHP before 5.3.7 does not properly implement the error_log function, which allows context-dependent attackers to cause a denial of service (application crash) v... |
| CVE-2012-2336 | PHP 4.4.9 | 5.0 | MEDIUM | sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack... |
| CVE-2012-3365 | PHP 4.4.9 | 5.0 | MEDIUM | The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the open_basedir protection mechanism via unspecified vectors. |
| CVE-2013-1643 | PHP 4.4.9 | 5.0 | MEDIUM | The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external ent... |
| CVE-2013-2110 | PHP 4.4.9 | 5.0 | MEDIUM | Heap-based buffer overflow in the php_quot_print_encode function in ext/standard/quot_print.c in PHP before 5.3.26 and 5.4.x before 5.4.16 allows remote attacke... |
Tech Stack
Detected via Wappalyzer-style rules on the HTTP response body, headers, scripts and meta tags.
Origin / IP-Leak
USP
When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.
No origin-leak candidates for this IP
When this IP serves a TLS cert for a domain that fronts behind a CDN, that domain surfaces here as an origin-leak candidate with a confidence score.
Multi-Vantage Check
Reachability accrued passively from real user-triggered checks across our 65+ probe nodes. Run a live check to add fresh data.
ICMP responsive
This IP replied to our global ICMP sweep — last confirmed 2026-07-31.
No accumulated reachability data yet
Reachability accrues from real user-triggered checks. Trigger a Ping or HTTP check from our 65+ probe nodes to contribute the first data point.
Web Pages
| Port | Page title | Status | Flags |
|---|---|---|---|
| 443 | Quios provide wireless solutions including premium SMS | 200 |
Threat Intelligence
No threat-intel matches
This IP doesn't appear in any of the feeds we mirror (Tor exits, FireHOL Level 1-3, Spamhaus DROP/EDROP, URLhaus, OpenPhish). Absence here doesn't prove the IP is clean — it just means none of our public-feed sources flag it.
Co-Hosted Domains
No DNS-confirmed domains yet
We cross-reference body-cited domains against our DNS resolver records. Confirmations appear here once both sides have data for the same name.
External References
Domains the body links to whose DNS does NOT resolve to this IP — usually CDN assets, embeds, or third-party services. Boilerplate (Google Fonts, jsDelivr, w3.org…) is already filtered.
www.quios.com
href · ×3
x3.extreme-dm.com
href · ×2
www.statcounter.com
href · ×2
c16.statcounter.com
href · ×1
History
First observed
2026-07-19 12:05
Last observed
2026-07-19 12:05
Scan observations
2
The full change-log (ASN moves, cert rotations, port-state diffs) accumulates as our archives grow.