IP Address
IPv4
72.52.78.106
Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.
Run a live full scan of 72.52.78.106
On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.
ASN
AS6939
Hurricane Electric
Country
US
United States
Reverse DNS
chinesekungfuhustle.com
PTR
Open Ports
3
Last scan
Autonomous System
ASN
AS Name
Hurricane Electric
AS Type
—
RIR
ARIN
Allocated
1996-06-28
Allocation status
Allocated
Geolocation
Reverse DNS
Last seen
2026-07-20 22:52:19
Network
Prefix
RPKI
—
TLS Certificates
TLS certificate observations pending
Once our scan layer captures a TLS cert from this IP, certificate chain, JARM and JA4S fingerprints will appear here.
Known Vulnerabilities
Published CVEs matched to the software versions fingerprinted on this host. Matching is by product and version against the NVD dictionary — presence of a CVE does not confirm the host is exploitable (patches or backports may apply).
| CVE | Software | CVSS | Severity | Summary |
|---|---|---|---|---|
| CVE-2006-3738 | OpenSSL 0.9.7a | 10.0 | HIGH | Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions has unspecified impact and remo... |
| CVE-2007-0910 | PHP 4.4.0 | 10.0 | HIGH | Unspecified vulnerability in PHP before 5.2.1 allows attackers to "clobber" certain super-global variables via unspecified vectors. |
| CVE-2008-5557 | PHP 4.4.0 | 10.0 | HIGH | Heap-based buffer overflow in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring extension in PHP 4.3.0 through 5.2.6 allows context-dependent atta... |
| CVE-2009-4143 | PHP 4.4.0 | 10.0 | HIGH | PHP before 5.2.12 does not properly handle session data, which has unspecified impact and attack vectors related to (1) interrupt corruption of the SESSION supe... |
| CVE-2011-3268 | PHP 4.4.0 | 10.0 | HIGH | Buffer overflow in the crypt function in PHP before 5.3.7 allows context-dependent attackers to have an unspecified impact via a long salt argument, a different... |
| CVE-2012-2376 | PHP 4.4.0 | 10.0 | HIGH | Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execute arbitrary code via crafted arguments t... |
| CVE-2012-2688 | PHP 4.4.0 | 10.0 | HIGH | Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and re... |
| CVE-2006-1017 | PHP 4.4.0 | 9.3 | HIGH | The c-client library 2000, 2001, or 2004 for PHP before 4.4.4 and 5.x before 5.1.5 do not check the (1) safe_mode or (2) open_basedir functions, and when used i... |
| CVE-2006-3017 | PHP 4.4.0 | 9.3 | HIGH | zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variabl... |
| CVE-2007-2844 | PHP 4.4.0 | 9.3 | HIGH | PHP 4.x and 5.x before 5.2.1, when running on multi-threaded systems, does not ensure thread safety for libc crypt function calls using protection schemes such... |
| CVE-2016-1238 | Perl 5.8.0 | 7.8 | N/A | (1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6)... |
| CVE-2006-2937 | OpenSSL 0.9.7a | 7.8 | HIGH | OpenSSL 0.9.7 before 0.9.7l and 0.9.8 before 0.9.8d allows remote attackers to cause a denial of service (infinite loop and memory consumption) via malformed AS... |
| CVE-2006-2940 | OpenSSL 0.9.7a | 7.8 | HIGH | OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service (CPU consumption) via parasitic public keys... |
| CVE-2007-1883 | PHP 4.4.0 | 7.8 | HIGH | PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows context-dependent attackers to read arbitrary memory locations via an interruption that triggers a user s... |
| CVE-2007-1718 | PHP 4.4.0 | 7.8 | HIGH | CRLF injection vulnerability in the mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows remote attackers to inject arbitrary e-mail headers... |
| CVE-2007-1461 | PHP 4.4.0 | 7.8 | HIGH | The compress.bzip2:// URL wrapper provided by the bz2 extension in PHP before 4.4.7, and 5.x before 5.2.2, does not implement safemode or open_basedir checks, w... |
| CVE-2008-2384 | Apache 2.0.54 | 7.5 | HIGH | SQL injection vulnerability in mod_auth_mysql.c in the mod-auth-mysql (aka libapache2-mod-auth-mysql) module for the Apache HTTP Server 2.x, when configured to... |
| CVE-2004-2286 | Perl 5.8.0 | 7.5 | HIGH | Integer overflow in the duplication operator in ActivePerl allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via... |
| CVE-2007-5116 | Perl 5.8.0 | 7.5 | HIGH | Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitra... |
| CVE-2003-0131 | OpenSSL 0.9.7a | 7.5 | HIGH | The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a m... |
| CVE-2004-0079 | OpenSSL 0.9.7a | 7.5 | N/A | The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted... |
| CVE-2010-0742 | OpenSSL 0.9.7a | 7.5 | HIGH | The Cryptographic Message Syntax (CMS) implementation in crypto/cms/cms_asn1.c in OpenSSL before 0.9.8o and 1.x before 1.0.0a does not properly handle structure... |
| CVE-2010-4252 | OpenSSL 0.9.7a | 7.5 | HIGH | OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass... |
| CVE-2012-2110 | OpenSSL 0.9.7a | 7.5 | HIGH | The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret inte... |
| CVE-2005-3390 | PHP 4.4.0 | 7.5 | HIGH | The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when register_globals is enabled, allows remote attackers to modify the GLOBALS arra... |
| CVE-2005-3391 | PHP 4.4.0 | 7.5 | HIGH | Multiple vulnerabilities in PHP before 4.4.1 allow remote attackers to bypass safe_mode and open_basedir restrictions via unknown attack vectors in (1) ext/curl... |
| CVE-2005-3392 | PHP 4.4.0 | 7.5 | HIGH | Unspecified vulnerability in PHP before 4.4.1, when using the virtual function on Apache 2, allows remote attackers to bypass safe_mode and open_basedir directi... |
| CVE-2006-0097 | PHP 4.4.0 | 7.5 | HIGH | Stack-based buffer overflow in the create_named_pipe function in libmysql.c in PHP 4.3.10 and 4.4.x before 4.4.3 for Windows allows attackers to execute arbitra... |
| CVE-2006-4433 | PHP 4.4.0 | 7.5 | HIGH | PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of the session identifier (PHPSESSID) for third party session handlers, which might make... |
| CVE-2007-4658 | PHP 4.4.0 | 7.5 | HIGH | The money_format function in PHP 5 before 5.2.4, and PHP 4 before 4.4.8, permits multiple (1) %i and (2) %n tokens, which has unknown impact and attack vectors,... |
| CVE-2007-1700 | PHP 4.4.0 | 7.5 | HIGH | The session extension in PHP 4 before 4.4.5, and PHP 5 before 5.2.1, calculates the reference count for the session variables without considering the internal p... |
| CVE-2007-1890 | PHP 4.4.0 | 7.5 | HIGH | Integer overflow in the msg_receive function in PHP 4 before 4.4.5 and PHP 5 before 5.2.1, on FreeBSD and possibly other platforms, allows context-dependent att... |
| CVE-2007-1376 | PHP 4.4.0 | 7.5 | HIGH | The shmop functions in PHP before 4.4.5, and before 5.2.1 in the 5.x series, do not verify that their arguments correspond to a shmop resource, which allows con... |
| CVE-2007-1888 | PHP 4.4.0 | 7.5 | HIGH | Buffer overflow in the sqlite_decode_binary function in src/encode.c in SQLite 2, as used by PHP 4.x through 5.x and other applications, allows context-dependen... |
| CVE-2007-1885 | PHP 4.4.0 | 7.5 | HIGH | Integer overflow in the str_replace function in PHP 4 before 4.4.5 and PHP 5 before 5.2.1 allows context-dependent attackers to execute arbitrary code via a sin... |
| CVE-2007-0905 | PHP 4.4.0 | 7.5 | HIGH | PHP before 5.2.1 allows attackers to bypass safe_mode and open_basedir restrictions via unspecified vectors in the session extension. NOTE: it is possible that... |
| CVE-2007-1825 | PHP 4.4.0 | 7.5 | HIGH | Buffer overflow in the imap_mail_compose function in PHP 5 before 5.2.1, and PHP 4 before 4.4.5, allows remote attackers to execute arbitrary code via a long bo... |
| CVE-2007-1777 | PHP 4.4.0 | 7.5 | HIGH | Integer overflow in the zip_read_entry function in PHP 4 before 4.4.5 allows remote attackers to execute arbitrary code via a ZIP archive that contains an entry... |
| CVE-2007-0906 | PHP 4.4.0 | 7.5 | HIGH | Multiple buffer overflows in PHP before 5.2.1 allow attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors in the (1... |
| CVE-2007-0909 | PHP 4.4.0 | 7.5 | HIGH | Multiple format string vulnerabilities in PHP before 5.2.1 might allow attackers to execute arbitrary code via format string specifiers to (1) all of the *print... |
Tech Stack
Detected via Wappalyzer-style rules on the HTTP response body, headers, scripts and meta tags.
Origin / IP-Leak
USP
When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.
No origin-leak candidates for this IP
When this IP serves a TLS cert for a domain that fronts behind a CDN, that domain surfaces here as an origin-leak candidate with a confidence score.
Hosted Domains
Multi-Vantage Check
Reachability accrued passively from real user-triggered checks across our 65+ probe nodes. Run a live check to add fresh data.
ICMP responsive
This IP replied to our global ICMP sweep — last confirmed 2026-07-24.
No accumulated reachability data yet
Reachability accrues from real user-triggered checks. Trigger a Ping or HTTP check from our 65+ probe nodes to contribute the first data point.
Threat Intelligence
No threat-intel matches
This IP doesn't appear in any of the feeds we mirror (Tor exits, FireHOL Level 1-3, Spamhaus DROP/EDROP, URLhaus, OpenPhish). Absence here doesn't prove the IP is clean — it just means none of our public-feed sources flag it.
Co-Hosted Domains
No DNS-confirmed domains yet
We cross-reference body-cited domains against our DNS resolver records. Confirmations appear here once both sides have data for the same name.
External References
No external references found yet
As HTML bodies get banner-grabbed, references to external domains land here.
History
First observed
2026-05-26 04:21
Last observed
2026-07-20 22:52
Scan observations
10
The full change-log (ASN moves, cert rotations, port-state diffs) accumulates as our archives grow.