📅 Original date posted:2015-08-17
📝 Original message:Dude, while it does appear plausible that the box is insecure, is it truly
warranted to jump to any particular conclusion from that alone?
What if all the open ports is just because it is a honey pot?
On Mon, Aug 17, 2015 at 11:41 AM, Jonathan Wilkins via bitcoin-dev <
bitcoin-dev at lists.linuxfoundation.org> wrote:
> I'm sure that most people here were skeptical, but FWIW, the server that
> hosts vistomail.com is a mess, it's a Plesk box with more than a couple
> of services with dubious security histories. MailEnable smtpd, MSRPC, RDP,
> see for yourself:
>
> Most likely someone popped the box and is entertaining themselves.
>
> Nmap scan report for vistomail.com (190.97.163.93)
> Host is up (0.10s latency).
> Not shown: 65521 filtered ports
> PORT STATE SERVICE VERSION
> 21/tcp open ftp Microsoft ftpd
> | ssl-cert: Subject: commonName=secureanonymoussurfing.com
> | Not valid before: 2015-05-03T00:00:00+00:00
> |_Not valid after: 2018-05-02T23:59:59+00:00
> |_ssl-date: 2015-08-16T00:08:25+00:00; +1m09s from local time.
> 25/tcp open smtp MailEnable smptd 8.60--
> | smtp-commands: vistomail.com [192.241.217.85], this server offers 4
> extensions, AUTH LOGIN, SIZE 20480000, HELP, AUTH=LOGIN,
> |_ 211 Help:->Supported Commands:
> HELO,EHLO,QUIT,HELP,RCPT,MAIL,DATA,RSET,NOOP
> 53/tcp open domain Microsoft DNS 6.1.7601
> | dns-nsid:
> |_ bind.version: Microsoft DNS 6.1.7601 (1DB14556)
> 80/tcp open http Microsoft IIS httpd 7.5
> |_http-favicon: Parallels Control Panel
> | http-methods: Potentially risky methods: TRACE
> |_See http://nmap.org/nsedoc/scripts/http-methods.html
> | http-ntlm-info:
> | Target_Name: DS04
> | NetBIOS_Domain_Name: DS04
> | NetBIOS_Computer_Name: DS04
> | DNS_Domain_Name: DS04
> | DNS_Computer_Name: DS04
> |_ Product_Version: 6.1 (Build 7601)
> |_http-title: Domain Default page
> 110/tcp open pop3 MailEnable POP3 Server
> |_pop3-capabilities: USER TOP UIDL
> 135/tcp open msrpc Microsoft Windows RPC
> 143/tcp open imap MailEnable imapd
> |_imap-capabilities: completed CAPABILITY AUTH=CRAM-MD5 CHILDREN
> UIDPLUSA0001 AUTH=LOGIN IMAP4rev1 OK IDLE IMAP4
> 443/tcp open ssl/http Microsoft IIS httpd 7.5
> |_http-favicon: Parallels Control Panel
> | http-methods: Potentially risky methods: TRACE
> |_See http://nmap.org/nsedoc/scripts/http-methods.html
> |_http-title: Domain Default page
> | ssl-cert: Subject: commonName=secureanonymoussurfing.com
> | Not valid before: 2015-05-03T00:00:00+00:00
> |_Not valid after: 2018-05-02T23:59:59+00:00
> |_ssl-date: 2015-08-16T00:08:24+00:00; +1m09s from local time.
> 587/tcp open smtp MailEnable smptd 8.60--
> | smtp-commands: vistomail.com [192.241.217.85], this server offers 4
> extensions, AUTH LOGIN, SIZE 20480000, HELP, AUTH=LOGIN,
> |_ 211 Help:->Supported Commands:
> HELO,EHLO,QUIT,HELP,RCPT,MAIL,DATA,RSET,NOOP
> 3389/tcp open ms-wbt-server Microsoft Terminal Service
> 8443/tcp open https-alt?
> | ssl-cert: Subject: commonName=Parallels
> Panel/organizationName=Parallels,
> Inc./stateOrProvinceName=Virginia/countryName=US
> | Not valid before: 2015-03-13T19:40:20+00:00
> |_Not valid after: 2016-03-12T19:40:20+00:00
> |_ssl-date: 2015-08-16T00:08:24+00:00; +1m09s from local time.
> 8880/tcp open http Microsoft IIS httpd 7.5
> |_http-favicon: Parallels Control Panel
> |_http-methods: No Allow or Public header in OPTIONS response (status code
> 500)
> |_http-title: Site doesn't have a title (text/html; charset=utf-8).
> 49154/tcp open msrpc Microsoft Windows RPC
> 49156/tcp open msrpc Microsoft Windows RPC
> Warning: OSScan results may be unreliable because we could not find at
> least 1 open and 1 closed port
> Device type: general purpose|phone
> Running: Microsoft Windows 2008|7|Phone|Vista
> OS CPE: cpe:/o:microsoft:windows_server_2008:r2
> cpe:/o:microsoft:windows_7::-:professional cpe:/o:microsoft:windows_8
> cpe:/o:microsoft:windows cpe:/o:microsoft:windows_vista::-
> cpe:/o:microsoft:windows_vista::sp1
> OS details: Windows Server 2008 R2, Microsoft Windows 7 Professional or
> Windows 8, Microsoft Windows Phone 7.5 or 8.0, Microsoft Windows Vista SP0
> or SP1, Windows Server 2008 SP1, or Windows 7, Microsoft Windows Vista SP2,
> Windows 7 SP1, or Windows Server 2008
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20150817/ff62efbd/attachment.html>;
Warren Togami Jr. [ARCHIVE] /
npub1s5…zxem8
2023-06-07 15:48:07
in reply to nevent1q…ez4s
Author Public Key
npub1s5p2xnl52ksr3a4qfa8re5znmja46ugm3x3ayy0x2c2mqrsw6ewsmzxem8Published at
2023-06-07 15:48:07Event JSON
{
"id": "e71ad79bfaf202440ac2f3b50231bb9732ca30447fecedce2141e1b11cd61c57",
"pubkey": "8502a34ff455a038f6a04f4e3cd053dcbb5d711b89a3d211e65615b00e0ed65d",
"created_at": 1686152887,
"kind": 1,
"tags": [
[
"e",
"b0c27244bf323381eda932a8efdbff26a98bda50cdd6efc27a1cec0b7598036f",
"",
"root"
],
[
"e",
"d9fc20fdd8660612549a12d001b80288f8e6d3ee2724109429b18ade658223a8",
"",
"reply"
],
[
"p",
"2b7ca979c782e26abbdc15d6438d4c59bd4775d9dfb988a1c12f4f11363f6f86"
]
],
"content": "📅 Original date posted:2015-08-17\n📝 Original message:Dude, while it does appear plausible that the box is insecure, is it truly\nwarranted to jump to any particular conclusion from that alone?\n\nWhat if all the open ports is just because it is a honey pot?\n\n\nOn Mon, Aug 17, 2015 at 11:41 AM, Jonathan Wilkins via bitcoin-dev \u003c\nbitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\n\u003e I'm sure that most people here were skeptical, but FWIW, the server that\n\u003e hosts vistomail.com is a mess, it's a Plesk box with more than a couple\n\u003e of services with dubious security histories. MailEnable smtpd, MSRPC, RDP,\n\u003e see for yourself:\n\u003e\n\u003e Most likely someone popped the box and is entertaining themselves.\n\u003e\n\u003e Nmap scan report for vistomail.com (190.97.163.93)\n\u003e Host is up (0.10s latency).\n\u003e Not shown: 65521 filtered ports\n\u003e PORT STATE SERVICE VERSION\n\u003e 21/tcp open ftp Microsoft ftpd\n\u003e | ssl-cert: Subject: commonName=secureanonymoussurfing.com\n\u003e | Not valid before: 2015-05-03T00:00:00+00:00\n\u003e |_Not valid after: 2018-05-02T23:59:59+00:00\n\u003e |_ssl-date: 2015-08-16T00:08:25+00:00; +1m09s from local time.\n\u003e 25/tcp open smtp MailEnable smptd 8.60--\n\u003e | smtp-commands: vistomail.com [192.241.217.85], this server offers 4\n\u003e extensions, AUTH LOGIN, SIZE 20480000, HELP, AUTH=LOGIN,\n\u003e |_ 211 Help:-\u003eSupported Commands:\n\u003e HELO,EHLO,QUIT,HELP,RCPT,MAIL,DATA,RSET,NOOP\n\u003e 53/tcp open domain Microsoft DNS 6.1.7601\n\u003e | dns-nsid:\n\u003e |_ bind.version: Microsoft DNS 6.1.7601 (1DB14556)\n\u003e 80/tcp open http Microsoft IIS httpd 7.5\n\u003e |_http-favicon: Parallels Control Panel\n\u003e | http-methods: Potentially risky methods: TRACE\n\u003e |_See http://nmap.org/nsedoc/scripts/http-methods.html\n\u003e | http-ntlm-info:\n\u003e | Target_Name: DS04\n\u003e | NetBIOS_Domain_Name: DS04\n\u003e | NetBIOS_Computer_Name: DS04\n\u003e | DNS_Domain_Name: DS04\n\u003e | DNS_Computer_Name: DS04\n\u003e |_ Product_Version: 6.1 (Build 7601)\n\u003e |_http-title: Domain Default page\n\u003e 110/tcp open pop3 MailEnable POP3 Server\n\u003e |_pop3-capabilities: USER TOP UIDL\n\u003e 135/tcp open msrpc Microsoft Windows RPC\n\u003e 143/tcp open imap MailEnable imapd\n\u003e |_imap-capabilities: completed CAPABILITY AUTH=CRAM-MD5 CHILDREN\n\u003e UIDPLUSA0001 AUTH=LOGIN IMAP4rev1 OK IDLE IMAP4\n\u003e 443/tcp open ssl/http Microsoft IIS httpd 7.5\n\u003e |_http-favicon: Parallels Control Panel\n\u003e | http-methods: Potentially risky methods: TRACE\n\u003e |_See http://nmap.org/nsedoc/scripts/http-methods.html\n\u003e |_http-title: Domain Default page\n\u003e | ssl-cert: Subject: commonName=secureanonymoussurfing.com\n\u003e | Not valid before: 2015-05-03T00:00:00+00:00\n\u003e |_Not valid after: 2018-05-02T23:59:59+00:00\n\u003e |_ssl-date: 2015-08-16T00:08:24+00:00; +1m09s from local time.\n\u003e 587/tcp open smtp MailEnable smptd 8.60--\n\u003e | smtp-commands: vistomail.com [192.241.217.85], this server offers 4\n\u003e extensions, AUTH LOGIN, SIZE 20480000, HELP, AUTH=LOGIN,\n\u003e |_ 211 Help:-\u003eSupported Commands:\n\u003e HELO,EHLO,QUIT,HELP,RCPT,MAIL,DATA,RSET,NOOP\n\u003e 3389/tcp open ms-wbt-server Microsoft Terminal Service\n\u003e 8443/tcp open https-alt?\n\u003e | ssl-cert: Subject: commonName=Parallels\n\u003e Panel/organizationName=Parallels,\n\u003e Inc./stateOrProvinceName=Virginia/countryName=US\n\u003e | Not valid before: 2015-03-13T19:40:20+00:00\n\u003e |_Not valid after: 2016-03-12T19:40:20+00:00\n\u003e |_ssl-date: 2015-08-16T00:08:24+00:00; +1m09s from local time.\n\u003e 8880/tcp open http Microsoft IIS httpd 7.5\n\u003e |_http-favicon: Parallels Control Panel\n\u003e |_http-methods: No Allow or Public header in OPTIONS response (status code\n\u003e 500)\n\u003e |_http-title: Site doesn't have a title (text/html; charset=utf-8).\n\u003e 49154/tcp open msrpc Microsoft Windows RPC\n\u003e 49156/tcp open msrpc Microsoft Windows RPC\n\u003e Warning: OSScan results may be unreliable because we could not find at\n\u003e least 1 open and 1 closed port\n\u003e Device type: general purpose|phone\n\u003e Running: Microsoft Windows 2008|7|Phone|Vista\n\u003e OS CPE: cpe:/o:microsoft:windows_server_2008:r2\n\u003e cpe:/o:microsoft:windows_7::-:professional cpe:/o:microsoft:windows_8\n\u003e cpe:/o:microsoft:windows cpe:/o:microsoft:windows_vista::-\n\u003e cpe:/o:microsoft:windows_vista::sp1\n\u003e OS details: Windows Server 2008 R2, Microsoft Windows 7 Professional or\n\u003e Windows 8, Microsoft Windows Phone 7.5 or 8.0, Microsoft Windows Vista SP0\n\u003e or SP1, Windows Server 2008 SP1, or Windows 7, Microsoft Windows Vista SP2,\n\u003e Windows 7 SP1, or Windows Server 2008\n\u003e\n\u003e _______________________________________________\n\u003e bitcoin-dev mailing list\n\u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n\u003e\n\u003e\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20150817/ff62efbd/attachment.html\u003e",
"sig": "a01aac3ec5e6e8221253a6b5c11e555ca56b60f4d630563c7d6faec8cc61f098d63f445ecb2f9dfe7d9437d8cdafcb4ff6d16ec3ad13e37b0f09760baf21cae8"
}