5.9.226.40
Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.
Run a live full scan of 5.9.226.40
On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.
Autonomous System
Geolocation
Reverse DNS
Network
Open Ports
| Port | Proto | Service | Server | Last seen |
|---|---|---|---|---|
| 80 | tcp | http | Apache/2.2.22 (Debian) DAV/2 PHP/5.4.45-0+deb7u8 mod_ssl/2.2.22 OpenSSL/1.0.1t mod_wsgi/3.3 Python/3.2.3 | 2026-06-17 15:52:48.000 |
| 443 | tcp | https | Apache/2.2.22 (Debian) DAV/2 PHP/5.4.45-0+deb7u8 mod_ssl/2.2.22 OpenSSL/1.0.1t mod_wsgi/3.3 Python/3.2.3 | 2026-05-25 21:43:53.000 |
| 5269 | tcp | — | — | 2026-07-22 21:51:35.000 |
TLS Certificates
Known Vulnerabilities
Published CVEs matched to the software versions fingerprinted on this host. Matching is by product and version against the NVD dictionary — presence of a CVE does not confirm the host is exploitable (patches or backports may apply).
| CVE | Software | CVSS | Severity | Summary |
|---|---|---|---|---|
| CVE-2017-3169 | Apache 2.2.22 | 9.8 | N/A | In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() d... |
| CVE-2016-2177 | OpenSSL 1.0.1t | 9.8 | N/A | OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (int... |
| CVE-2016-2182 | OpenSSL 1.0.1t | 9.8 | N/A | The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a den... |
| CVE-2016-6303 | OpenSSL 1.0.1t | 9.8 | N/A | Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-boun... |
| CVE-2016-5636 | Python 3.2.3 | 9.8 | N/A | Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers... |
| CVE-2016-2179 | OpenSSL 1.0.1t | 7.5 | N/A | The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which all... |
| CVE-2016-2180 | OpenSSL 1.0.1t | 7.5 | N/A | The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h al... |
| CVE-2016-2181 | OpenSSL 1.0.1t | 7.5 | N/A | The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence numbe... |
| CVE-2016-2183 | OpenSSL 1.0.1t | 7.5 | N/A | The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billi... |
| CVE-2016-6302 | OpenSSL 1.0.1t | 7.5 | N/A | The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows rem... |
| CVE-2016-6304 | OpenSSL 1.0.1t | 7.5 | N/A | Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (me... |
| CVE-2014-1912 | Python 3.2.3 | 7.5 | HIGH | Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remo... |
| CVE-2016-0772 | Python 3.2.3 | 6.5 | N/A | The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might al... |
| CVE-2014-0240 | mod_wsgi 3.3 | 6.2 | MEDIUM | The mod_wsgi module before 3.5 for Apache, when daemon mode is enabled, does not properly handle error codes returned by setuid when run on certain Linux kernel... |
| CVE-2016-4975 | Apache 2.2.22 | 6.1 | N/A | Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32... |
| CVE-2016-5699 | Python 3.2.3 | 6.1 | N/A | CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows re... |
| CVE-2016-6306 | OpenSSL 1.0.1t | 5.9 | N/A | The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via craft... |
| CVE-2013-7440 | Python 3.2.3 | 5.9 | N/A | The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man... |
| CVE-2014-9365 | Python 3.2.3 | 5.8 | MEDIUM | The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when ac... |
| CVE-2016-2178 | OpenSSL 1.0.1t | 5.5 | N/A | The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easi... |
| CVE-2013-5704 | Apache 2.2.22 | 5.0 | MEDIUM | The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer po... |
| CVE-2012-3499 | Apache 2.2.22 | 4.3 | MEDIUM | Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject ar... |
| CVE-2012-4558 | Apache 2.2.22 | 4.3 | MEDIUM | Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer... |
| CVE-2013-2099 | Python 3.2.3 | 4.3 | MEDIUM | Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x, and earlier, and unspecified versions of python-backports-ssl_ma... |
| CVE-2013-4238 | Python 3.2.3 | 4.3 | MEDIUM | The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternativ... |
| CVE-2013-7040 | Python 3.2.3 | 4.3 | MEDIUM | Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the abili... |
| CVE-2014-2667 | Python 3.2.3 | 3.3 | LOW | Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow... |
| CVE-2012-2687 | Apache 2.2.22 | 2.6 | LOW | Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Serv... |
Tech Stack
Wappalyzer fingerprinting pending
HTTP-body analysis identifies web frameworks, CMS platforms, analytics, JS libraries and server-side languages from this host.
Origin / IP-Leak
When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.
No origin-leak candidates for this IP
When this IP serves a TLS cert for a domain that fronts behind a CDN, that domain surfaces here as an origin-leak candidate with a confidence score.
Hosted Domains
Multi-Vantage Check
Reachability accrued passively from real user-triggered checks across our 65+ probe nodes. Run a live check to add fresh data.
No accumulated reachability data yet
Reachability accrues from real user-triggered checks. Trigger a Ping or HTTP check from our 65+ probe nodes to contribute the first data point.
Threat Intelligence
No threat-intel matches
This IP doesn't appear in any of the feeds we mirror (Tor exits, FireHOL Level 1-3, Spamhaus DROP/EDROP, URLhaus, OpenPhish). Absence here doesn't prove the IP is clean — it just means none of our public-feed sources flag it.
Co-Hosted Domains
Domains this host references in its HTML AND whose DNS A/AAAA record resolves back to this IP — i.e. actually hosted here.
External References
Domains the body links to whose DNS does NOT resolve to this IP — usually CDN assets, embeds, or third-party services. Boilerplate (Google Fonts, jsDelivr, w3.org…) is already filtered.
History
The full change-log (ASN moves, cert rotations, port-state diffs) accumulates as our archives grow.