IP Address
IPv4
83.138.64.104
Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.
Run a live full scan of 83.138.64.104
On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.
ASN
AS34895
Click for details
Country
DE
Germany
Reverse DNS
kschro.han-solo.net
PTR
Open Ports
1
Last scan
Autonomous System
Geolocation
Reverse DNS
Last seen
2026-06-15 14:53:08
Network
Prefix
RPKI
—
Open Ports
| Port | Proto | Service | Server | Last seen |
|---|---|---|---|---|
| 80 | tcp | http | Apache/2.0.59easyTECC/2.0 (Unix) PHP/5.2.13 mod_perl/2.0.3 Perl/v5.8.8 | 2026-06-15 14:51:59.000 |
TLS Certificates
TLS certificate observations pending
Once our scan layer captures a TLS cert from this IP, certificate chain, JARM and JA4S fingerprints will appear here.
Known Vulnerabilities
Published CVEs matched to the software versions fingerprinted on this host. Matching is by product and version against the NVD dictionary — presence of a CVE does not confirm the host is exploitable (patches or backports may apply).
| CVE | Software | CVSS | Severity | Summary |
|---|---|---|---|---|
| CVE-2011-3268 | PHP 5.2.13 | 10.0 | HIGH | Buffer overflow in the crypt function in PHP before 5.3.7 allows context-dependent attackers to have an unspecified impact via a long salt argument, a different... |
| CVE-2012-2376 | PHP 5.2.13 | 10.0 | HIGH | Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execute arbitrary code via crafted arguments t... |
| CVE-2012-2688 | PHP 5.2.13 | 10.0 | HIGH | Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and re... |
| CVE-2007-1581 | PHP 5.2.13 | 9.3 | HIGH | The resource system in PHP 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting the hash_update_file function via a... |
| CVE-2016-1238 | Perl 5.8.8 | 7.8 | N/A | (1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6)... |
| CVE-2007-4658 | PHP 5.2.13 | 7.5 | HIGH | The money_format function in PHP 5 before 5.2.4, and PHP 4 before 4.4.8, permits multiple (1) %i and (2) %n tokens, which has unknown impact and attack vectors,... |
| CVE-2010-1868 | PHP 5.2.13 | 7.5 | HIGH | The (1) sqlite_single_query and (2) sqlite_array_query functions in ext/sqlite/sqlite.c in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent... |
| CVE-2010-2225 | PHP 5.2.13 | 7.5 | HIGH | Use-after-free vulnerability in the SplObjectStorage unserializer in PHP 5.2.x and 5.3.x through 5.3.2 allows remote attackers to execute arbitrary code or obta... |
| CVE-2011-1092 | PHP 5.2.13 | 7.5 | HIGH | Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (crash) and possibly read sensitive me... |
| CVE-2011-1153 | PHP 5.2.13 | 7.5 | HIGH | Multiple format string vulnerabilities in phar_object.c in the phar extension in PHP 5.3.5 and earlier allow context-dependent attackers to obtain sensitive inf... |
| CVE-2012-2311 | PHP 5.2.13 | 7.5 | HIGH | sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that cont... |
| CVE-2013-1635 | PHP 5.2.13 | 7.5 | HIGH | ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir d... |
| CVE-2014-9427 | PHP 5.2.13 | 7.5 | HIGH | sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not p... |
| CVE-2016-7478 | PHP 5.2.13 | 7.5 | N/A | Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a craf... |
| CVE-2013-1667 | Perl 5.8.8 | 7.5 | HIGH | The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted h... |
| CVE-2008-5302 | Perl 5.8.8 | 6.9 | MEDIUM | Race condition in the rmtree function in File::Path 1.08 and 2.07 (lib/File/Path.pm) in Perl 5.8.8 and 5.10.0 allows local users to create arbitrary setuid bina... |
| CVE-2008-5303 | Perl 5.8.8 | 6.9 | MEDIUM | Race condition in the rmtree function in File::Path 1.08 (lib/File/Path.pm) in Perl 5.8.8 allows local users to to delete arbitrary files via a symlink attack,... |
| CVE-2010-4697 | PHP 5.2.13 | 6.8 | MEDIUM | Use-after-free vulnerability in the Zend engine in PHP before 5.2.15 and 5.3.x before 5.3.4 might allow context-dependent attackers to cause a denial of service... |
| CVE-2011-4718 | PHP 5.2.13 | 6.8 | MEDIUM | Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID. |
| CVE-2010-1861 | PHP 5.2.13 | 6.4 | MEDIUM | The sysvshm extension for PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to write to arbitrary memory addresses by using an obj... |
| CVE-2010-2191 | PHP 5.2.13 | 6.4 | MEDIUM | The (1) parse_str, (2) preg_match, (3) unpack, and (4) pack functions; the (5) ZEND_FETCH_RW, (6) ZEND_CONCAT, and (7) ZEND_ASSIGN_CONCAT opcodes; and the (8) A... |
| CVE-2012-0057 | PHP 5.2.13 | 6.4 | MEDIUM | PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the lib... |
| CVE-2012-1172 | PHP 5.2.13 | 5.8 | MEDIUM | The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes... |
| CVE-2011-2939 | Perl 5.8.8 | 5.1 | MEDIUM | Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent... |
| CVE-2006-7243 | PHP 5.2.13 | 5.0 | MEDIUM | PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe... |
| CVE-2010-1130 | PHP 5.2.13 | 5.0 | MEDIUM | session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_pat... |
| CVE-2010-1860 | PHP 5.2.13 | 5.0 | MEDIUM | The html_entity_decode function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory conte... |
| CVE-2010-1862 | PHP 5.2.13 | 5.0 | MEDIUM | The chunk_split function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by... |
| CVE-2010-1864 | PHP 5.2.13 | 5.0 | MEDIUM | The addcslashes function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by... |
| CVE-2010-1917 | PHP 5.2.13 | 5.0 | MEDIUM | Stack consumption vulnerability in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to cause a denial of service (PHP crash) via... |
| CVE-2010-2097 | PHP 5.2.13 | 5.0 | MEDIUM | The (1) iconv_mime_decode, (2) iconv_substr, and (3) iconv_mime_encode functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attacke... |
| CVE-2010-2100 | PHP 5.2.13 | 5.0 | MEDIUM | The (1) htmlentities, (2) htmlspecialchars, (3) str_getcsv, (4) http_build_query, (5) strpbrk, and (6) strtr functions in PHP 5.2 through 5.2.13 and 5.3 through... |
| CVE-2010-2101 | PHP 5.2.13 | 5.0 | MEDIUM | The (1) strip_tags, (2) setcookie, (3) strtok, (4) wordwrap, (5) str_word_count, and (6) str_pad functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow... |
| CVE-2010-2190 | PHP 5.2.13 | 5.0 | MEDIUM | The (1) trim, (2) ltrim, (3) rtrim, and (4) substr_replace functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain... |
| CVE-2010-2484 | PHP 5.2.13 | 5.0 | MEDIUM | The strrchr function in PHP 5.2 before 5.2.14 allows context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption... |
| CVE-2010-3065 | PHP 5.2.13 | 5.0 | MEDIUM | The default session serializer in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 does not properly handle the PS_UNDEF_MARKER marker, which allows context-depende... |
| CVE-2010-4150 | PHP 5.2.13 | 5.0 | MEDIUM | Double free vulnerability in the imap_do_open function in the IMAP extension (ext/imap/php_imap.c) in PHP 5.2 before 5.2.15 and 5.3 before 5.3.4 allows attacker... |
| CVE-2010-4645 | PHP 5.2.13 | 5.0 | MEDIUM | strtod.c, as used in the zend_strtod function in PHP 5.2 before 5.2.17 and 5.3 before 5.3.5, and other products, allows context-dependent attackers to cause a d... |
| CVE-2010-4698 | PHP 5.2.13 | 5.0 | MEDIUM | Stack-based buffer overflow in the GD extension in PHP before 5.2.15 and 5.3.x before 5.3.4 allows context-dependent attackers to cause a denial of service (app... |
| CVE-2010-4699 | PHP 5.2.13 | 5.0 | MEDIUM | The iconv_mime_decode_headers function in the Iconv extension in PHP before 5.3.4 does not properly handle encodings that are unrecognized by the iconv and mbst... |
Tech Stack
Wappalyzer fingerprinting pending
HTTP-body analysis identifies web frameworks, CMS platforms, analytics, JS libraries and server-side languages from this host.
Origin / IP-Leak
USP
When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.
No origin-leak candidates for this IP
When this IP serves a TLS cert for a domain that fronts behind a CDN, that domain surfaces here as an origin-leak candidate with a confidence score.
Multi-Vantage Check
Reachability accrued passively from real user-triggered checks across our 65+ probe nodes. Run a live check to add fresh data.
ICMP responsive
This IP replied to our global ICMP sweep — last confirmed 2026-08-03.
No accumulated reachability data yet
Reachability accrues from real user-triggered checks. Trigger a Ping or HTTP check from our 65+ probe nodes to contribute the first data point.
Threat Intelligence
No threat-intel matches
This IP doesn't appear in any of the feeds we mirror (Tor exits, FireHOL Level 1-3, Spamhaus DROP/EDROP, URLhaus, OpenPhish). Absence here doesn't prove the IP is clean — it just means none of our public-feed sources flag it.
Co-Hosted Domains
No DNS-confirmed domains yet
We cross-reference body-cited domains against our DNS resolver records. Confirmations appear here once both sides have data for the same name.
External References
No external references found yet
As HTML bodies get banner-grabbed, references to external domains land here.
History
First observed
2026-05-26 10:29
Last observed
2026-06-15 14:51
Scan observations
4
The full change-log (ASN moves, cert rotations, port-state diffs) accumulates as our archives grow.