IP Address
IPv4
43.229.116.91
Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.
Run a live full scan of 43.229.116.91
On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.
ASN
AS133929
TWOWIN NETWORK
Country
HK
Hong Kong
Reverse DNS
static-ip-91-116-229-43.TWOWINCOLIMITED-HK.COM
PTR
Open Ports
3
Last scan
Autonomous System
Geolocation
Reverse DNS
Last seen
2026-07-23 10:11:49
Network
Prefix
RPKI
—
Open Ports
| Port | Proto | Service | Server | Last seen |
|---|---|---|---|---|
| 443 | tcp | https | Apache/2.2.22 (Unix) mod_ssl/2.2.22 OpenSSL/1.0.2k-fips DAV/2 PHP/5.2.17 | 2026-05-25 21:34:18.000 |
| 2222 | tcp | ssh-alt | — | 2026-07-23 10:10:43.000 |
| 8080 | tcp | http-proxy | Apache/2.2.22 (Unix) mod_ssl/2.2.22 OpenSSL/1.0.2k-fips DAV/2 PHP/5.2.17 | 2026-07-16 01:26:39.000 |
TLS Certificates
Port 443
0867956e0095…
Subject: www.decca.com.hk
Issuer: EDP Dept.
SANs: www.decca.com.hk
Valid 2005-09-08 04:07:37 → 2015-09-06 04:07:37
Known Vulnerabilities
Published CVEs matched to the software versions fingerprinted on this host. Matching is by product and version against the NVD dictionary — presence of a CVE does not confirm the host is exploitable (patches or backports may apply).
| CVE | Software | CVSS | Severity | Summary |
|---|---|---|---|---|
| CVE-2012-2376 | PHP 5.2.17 | 10.0 | HIGH | Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execute arbitrary code via crafted arguments t... |
| CVE-2012-2688 | PHP 5.2.17 | 10.0 | HIGH | Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and re... |
| CVE-2017-3169 | Apache 2.2.22 | 9.8 | N/A | In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() d... |
| CVE-2011-1092 | PHP 5.2.17 | 7.5 | HIGH | Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (crash) and possibly read sensitive me... |
| CVE-2012-2311 | PHP 5.2.17 | 7.5 | HIGH | sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that cont... |
| CVE-2013-1635 | PHP 5.2.17 | 7.5 | HIGH | ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir d... |
| CVE-2014-9427 | PHP 5.2.17 | 7.5 | HIGH | sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not p... |
| CVE-2016-7478 | PHP 5.2.17 | 7.5 | N/A | Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a craf... |
| CVE-2011-4718 | PHP 5.2.17 | 6.8 | MEDIUM | Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID. |
| CVE-2012-0057 | PHP 5.2.17 | 6.4 | MEDIUM | PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the lib... |
| CVE-2016-4975 | Apache 2.2.22 | 6.1 | N/A | Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32... |
| CVE-2012-1172 | PHP 5.2.17 | 5.8 | MEDIUM | The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes... |
| CVE-2013-5704 | Apache 2.2.22 | 5.0 | MEDIUM | The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer po... |
| CVE-2006-7243 | PHP 5.2.17 | 5.0 | MEDIUM | PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe... |
| CVE-2010-4699 | PHP 5.2.17 | 5.0 | MEDIUM | The iconv_mime_decode_headers function in the Iconv extension in PHP before 5.3.4 does not properly handle encodings that are unrecognized by the iconv and mbst... |
| CVE-2011-0755 | PHP 5.2.17 | 5.0 | MEDIUM | Integer overflow in the mt_rand function in PHP before 5.3.4 might make it easier for context-dependent attackers to predict the return values by leveraging a s... |
| CVE-2011-1466 | PHP 5.2.17 | 5.0 | MEDIUM | Integer overflow in the SdnToJulian function in the Calendar extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (appl... |
| CVE-2011-1467 | PHP 5.2.17 | 5.0 | MEDIUM | Unspecified vulnerability in the NumberFormatter::setSymbol (aka numfmt_set_symbol) function in the Intl extension in PHP before 5.3.6 allows context-dependent... |
| CVE-2011-4885 | PHP 5.2.17 | 5.0 | MEDIUM | PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers... |
| CVE-2012-0788 | PHP 5.2.17 | 5.0 | MEDIUM | The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service (a... |
| CVE-2012-0789 | PHP 5.2.17 | 5.0 | MEDIUM | Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strto... |
| CVE-2012-1171 | PHP 5.2.17 | 5.0 | MEDIUM | The libxml RSHUTDOWN function in PHP 5.x allows remote attackers to bypass the open_basedir protection mechanism and read arbitrary files via vectors involving... |
| CVE-2012-2336 | PHP 5.2.17 | 5.0 | MEDIUM | sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack... |
| CVE-2012-3365 | PHP 5.2.17 | 5.0 | MEDIUM | The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the open_basedir protection mechanism via unspecified vectors. |
| CVE-2013-1643 | PHP 5.2.17 | 5.0 | MEDIUM | The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external ent... |
| CVE-2013-2110 | PHP 5.2.17 | 5.0 | MEDIUM | Heap-based buffer overflow in the php_quot_print_encode function in ext/standard/quot_print.c in PHP before 5.3.26 and 5.4.x before 5.4.16 allows remote attacke... |
| CVE-2013-4635 | PHP 5.2.17 | 5.0 | MEDIUM | Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attacke... |
| CVE-2012-3499 | Apache 2.2.22 | 4.3 | MEDIUM | Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject ar... |
| CVE-2012-4558 | Apache 2.2.22 | 4.3 | MEDIUM | Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer... |
| CVE-2011-0421 | PHP 5.2.17 | 4.3 | MEDIUM | The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED argument, which... |
| CVE-2011-0708 | PHP 5.2.17 | 4.3 | MEDIUM | exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms performs an incorrect cast, which allows remote attackers to cause a denial of service (app... |
| CVE-2011-1464 | PHP 5.2.17 | 4.3 | MEDIUM | Buffer overflow in the strval function in PHP before 5.3.6, when the precision configuration option has a large value, might allow context-dependent attackers t... |
| CVE-2011-1468 | PHP 5.2.17 | 4.3 | MEDIUM | Multiple memory leaks in the OpenSSL extension in PHP before 5.3.6 might allow remote attackers to cause a denial of service (memory consumption) via (1) plaint... |
| CVE-2011-1469 | PHP 5.2.17 | 4.3 | MEDIUM | Unspecified vulnerability in the Streams component in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) by ac... |
| CVE-2011-1470 | PHP 5.2.17 | 4.3 | MEDIUM | The Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via a ziparchive stream that is not pr... |
| CVE-2013-4248 | PHP 5.2.17 | 4.3 | MEDIUM | The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\0' character in a do... |
| CVE-2012-2687 | Apache 2.2.22 | 2.6 | LOW | Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Serv... |
Tech Stack
Wappalyzer fingerprinting pending
HTTP-body analysis identifies web frameworks, CMS platforms, analytics, JS libraries and server-side languages from this host.
Origin / IP-Leak
USP
When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.
No origin-leak candidates for this IP
When this IP serves a TLS cert for a domain that fronts behind a CDN, that domain surfaces here as an origin-leak candidate with a confidence score.
Multi-Vantage Check
Reachability accrued passively from real user-triggered checks across our 65+ probe nodes. Run a live check to add fresh data.
ICMP responsive
This IP replied to our global ICMP sweep — last confirmed 2026-08-02.
No accumulated reachability data yet
Reachability accrues from real user-triggered checks. Trigger a Ping or HTTP check from our 65+ probe nodes to contribute the first data point.
Threat Intelligence
No threat-intel matches
This IP doesn't appear in any of the feeds we mirror (Tor exits, FireHOL Level 1-3, Spamhaus DROP/EDROP, URLhaus, OpenPhish). Absence here doesn't prove the IP is clean — it just means none of our public-feed sources flag it.
Co-Hosted Domains
No DNS-confirmed domains yet
We cross-reference body-cited domains against our DNS resolver records. Confirmations appear here once both sides have data for the same name.
External References
No external references found yet
As HTML bodies get banner-grabbed, references to external domains land here.
History
First observed
2026-05-25 21:34
Last observed
2026-07-23 10:10
Scan observations
8
The full change-log (ASN moves, cert rotations, port-state diffs) accumulates as our archives grow.