Reading the observatory store…
Reading the observatory store…
First seen 22 Sep 2026, last seen 22 Sep 2026 05:55 UTC (1h ago). 5 observations on record. Location is an estimate derived from registration data — the source and confidence are stated below.
| Port | Service | Product | Technologies | TLS | State | Banner | Last seen |
|---|---|---|---|---|---|---|---|
| 21 tcp / tcp | ftp | ProFTPD |
| not negotiated | open | 220 ProFTPD Server (ProFTPD Default Installation) [::ffff:103.233.58.171] | 22 Sep 2026 2h ago |
| 22 tcp / tcp | ssh | OpenSSH 9.9 |
| not negotiated | open | SSH-2.0-OpenSSH_9.9 | 22 Sep 2026 2h ago |
| 53 tcp / tcp | dns | not identified | none detected | not negotiated | open | no banner captured | 22 Sep 2026 2h ago |
| 80 tcp / tcp | http | LiteSpeed |
| not negotiated | open | no banner captured | 22 Sep 2026 2h ago |
| 110 tcp / tcp | pop3 | Dovecot |
| not negotiated | open | +OK Dovecot ready. | 22 Sep 2026 2h ago |
| 143 tcp / tcp | imap | Dovecot |
| not negotiated | open | * OK [CAPABILITY IMAP4rev1 LOGIN-REFERRALS ID ENABLE IDLE SASL-IR LITERAL+ STARTTLS LOGINDISABLED] Dovecot ready. | 22 Sep 2026 2h ago |
| 443 tcp / tcp | https | PHP 8.1.34 |
| TLSv1.3certificate
| open | no banner captured | 22 Sep 2026 2h ago |
| 587 tcp / tcp | smtp-submission | Exim 4.100 |
| not negotiated | open | 220-access.himalayan.host ESMTP Exim 4.100 #2 Tue, 22 Sep 2026 11:14:08 +0545 220-We do not authorize the use of this system to transport u… | 22 Sep 2026 2h ago |
| 993 tcp / tcp | imaps | not identified | none detected | not negotiated | open | no banner captured | 22 Sep 2026 2h ago |
| 995 tcp / tcp | pop3s | not identified | none detected | not negotiated | open | no banner captured | 22 Sep 2026 2h ago |
| Observed at | Source | Collector | Confidence | Changed | State | Content hash |
|---|---|---|---|---|---|---|
| 22 Sep 2026 05:55 UTC | fingerprint | fingerprint-1 | high | unchanged | {"reverse_dns":"access.himalayan.host"} | 155d8a6ccd1e0e8ea635045983316fdf86f1c7c… |
| 22 Sep 2026 05:31 UTC | fingerprint | fingerprint-1 | high | changed | {"reverse_dns":"access.himalayan.host"} | 53f551d3c9aa96d1f4d58b92928d2b452f9e3a1… |
| 22 Sep 2026 05:29 UTC | fingerprint | fingerprint-1 | high | changed | {"services":{"21/tcp":{"state":"open","product":"ProFTPD","version":"","cert_sha256":"","tls_version":"","service_type":"ftp"},"22/tcp":{"state":"open","produc… | 093cefbbda8e41b3f6510fcfffb0ea505f06a1d… |
| 22 Sep 2026 05:15 UTC | fingerprint | fingerprint-1 | high | changed | {"reverse_dns":"access.himalayan.host"} | 5b251c9e1fdf84006f5573c7ae2c1042b225ead… |
| Detected at | Type | Field | Previous | Current | Significance | Confidence |
|---|---|---|---|---|---|---|
| 22 Sep 2026 05:31 UTC | TECHNOLOGY CHANGED | — | dovecot, exim, lets-encrypt, litespeed, openssh, php, proftpd | — | low | unknown |
| 22 Sep 2026 05:31 UTC | SERVICE DISAPPEARED | service:995/tcp | pop3s | — | medium | unknown |
| 22 Sep 2026 05:31 UTC | SERVICE DISAPPEARED | service:993/tcp | imaps | — | medium | unknown |
| 22 Sep 2026 05:31 UTC | SERVICE DISAPPEARED | service:80/tcp | LiteSpeed | — | medium | unknown |
| 22 Sep 2026 05:31 UTC | SERVICE DISAPPEARED | service:587/tcp | Exim 4.100 | — | medium | unknown |
| 22 Sep 2026 05:31 UTC | SERVICE DISAPPEARED | service:53/tcp | dns | — | medium | unknown |
| 22 Sep 2026 05:31 UTC | SERVICE DISAPPEARED | service:443/tcp | PHP 8.1.34 / TLSv1.3 | — | medium | unknown |
| 22 Sep 2026 05:31 UTC | SERVICE DISAPPEARED | service:22/tcp | OpenSSH 9.9 | — | medium | unknown |
| 22 Sep 2026 05:31 UTC | SERVICE DISAPPEARED | service:21/tcp | ProFTPD | — | medium | unknown |
| 22 Sep 2026 05:31 UTC | SERVICE DISAPPEARED | service:143/tcp | Dovecot | — | medium | unknown |
| 22 Sep 2026 05:31 UTC | SERVICE DISAPPEARED | service:110/tcp | Dovecot | — | medium | unknown |
| 22 Sep 2026 05:29 UTC | TECHNOLOGY CHANGED | — | — | dovecot, exim, lets-encrypt, litespeed, openssh, php, proftpd | low | unknown |
| 22 Sep 2026 05:29 UTC | NEW SERVICE | service:995/tcp | — | pop3s | low | unknown |
| 22 Sep 2026 05:29 UTC | NEW SERVICE | service:993/tcp | — | imaps | low | unknown |
| 22 Sep 2026 05:29 UTC | NEW SERVICE | service:80/tcp | — | LiteSpeed | low | unknown |
| 22 Sep 2026 05:29 UTC | NEW SERVICE | service:587/tcp | — | Exim 4.100 | low | unknown |
| 22 Sep 2026 05:29 UTC | NEW SERVICE | service:53/tcp | — | dns | low | unknown |
| 22 Sep 2026 05:29 UTC | NEW SERVICE | service:443/tcp | — | PHP 8.1.34 / TLSv1.3 | low | unknown |
| 22 Sep 2026 05:29 UTC | NEW SERVICE | service:22/tcp | — | OpenSSH 9.9 | low | unknown |
| 22 Sep 2026 05:29 UTC | NEW SERVICE | service:21/tcp | — | ProFTPD | low | unknown |
| 22 Sep 2026 05:29 UTC | NEW SERVICE | service:143/tcp | — | Dovecot | low | unknown |
| 22 Sep 2026 05:29 UTC | NEW SERVICE | service:110/tcp | — | Dovecot | low | unknown |
| 22 Sep 2026 05:15 UTC | NEW ASSET | — | — | asset with no observed open endpoints | low | unknown |
7 matches on this asset, each one unverified. Treat these as leads for manual review, never as findings.
| Identifier | Severity | CVSS | Product / version | Status | Match confidence | Evidence | Detected |
|---|---|---|---|---|---|---|---|
CVE-2025-14180 In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an… | high | 7.5 | PHP 8.1.34 | potential exposure — unverified | medium | {"match_reason":"keyword match on \"PHP 8.1.34\"","note":"version-string match only; not a confirmed exposure","observe… | 22 Sep 2026 |
CVE-2025-14178 In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of … | medium | 6.5 | PHP 8.1.34 | potential exposure — unverified | medium | {"match_reason":"keyword match on \"PHP 8.1.34\"","note":"version-string match only; not a confirmed exposure","observe… | 22 Sep 2026 |
CVE-2025-14177 In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn se… | high | 7.5 | PHP 8.1.34 | potential exposure — unverified | medium | {"match_reason":"keyword match on \"PHP 8.1.34\"","note":"version-string match only; not a confirmed exposure","observe… | 22 Sep 2026 |
CVE-2026-94057 Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing. | medium | 4.0 | Exim 4.100 | potential exposure — unverified | medium | {"match_reason":"keyword match on \"Exim 4.100\"","note":"version-string match only; not a confirmed exposure","observe… | 22 Sep 2026 |
CVE-2026-94056 Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory. | high | 7.5 | Exim 4.100 | potential exposure — unverified | medium | {"match_reason":"keyword match on \"Exim 4.100\"","note":"version-string match only; not a confirmed exposure","observe… | 22 Sep 2026 |
CVE-2026-94055 Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free. | low | 3.7 | Exim 4.100 | potential exposure — unverified | medium | {"match_reason":"keyword match on \"Exim 4.100\"","note":"version-string match only; not a confirmed exposure","observe… | 22 Sep 2026 |
CVE-2026-94054 Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write. | high | 7.0 | Exim 4.100 | potential exposure — unverified | medium | {"match_reason":"keyword match on \"Exim 4.100\"","note":"version-string match only; not a confirmed exposure","observe… | 22 Sep 2026 |
| Field | Previous | Current | Reading |
|---|---|---|---|
| reverse_dns | access.himalayan.host | access.himalayan.host | unchanged |
{
"id": "c58c615978bbb0e5e1ad3b5f751f8d399",
"type": "ipv4",
"value": "103.233.58.171",
"hostname": "www.npncl.gov.np",
"reverseDns": "access.himalayan.host",
"asn": {
"number": 59370,
"name": "ACCESS-NP - Access World Tech Pvt. Ltd."
},
"organization": {
"id": "c4b6e309c615243e60f7da970121039cc",
"name": "ACCESS-NP - Access World Tech Pvt. Ltd."
},
"location": {
"country": "NP",
"city": "Kathmandu",
"province": "Bagmati Province",
"district": "",
"confidence": "low",
"source": "ip-api.com"
},
"scopeStatus": "in_scope",
"priority": "HIGH",
"firstSeen": "2026-09-22T05:15:11.188Z",
"lastSeen": "2026-09-22T05:55:09.053Z",
"observationCount": 5,
"openServices": 10,
"serviceCount": 10,
"technologies": [
"dovecot",
"exim",
"lets-encrypt",
"litespeed",
"openssh",
"php",
"proftpd"
],
"vulnerabilityMatches": [
{
"id": "cf983d80263c85815d8b257a32eda9271",
"cve": "CVE-2025-14180",
"severity": "high",
"cvssScore": 7.5,
"summary": "In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \\x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.",
"product": "PHP",
"version": "8.1.34",
"status": "potential",
"matchConfidence": "medium",
"evidence": "{\"match_reason\":\"keyword match on \\\"PHP 8.1.34\\\"\",\"note\":\"version-string match only; not a confirmed exposure\",\"observed_product\":\"PHP\",\"observed_version\":\"8.1.34\",\"source\":\"nvd\"}",
"detectedAt": "2026-09-22T05:44:56.807Z",
"assetValue": "103.233.58.171",
"serviceId": "c3345561d98fc9c9493f3a903e03d773c",
"port": 443,
"technologySlug": "lets-encrypt"
},
{
"id": "c43b78141296fb71db8b48338e835f99c",
"cve": "CVE-2025-14178",
"severity": "medium",
"cvssScore": 6.5,
"summary": "In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.",
"product": "PHP",
"version": "8.1.34",
"status": "potential",
"matchConfidence": "medium",
"evidence": "{\"match_reason\":\"keyword match on \\\"PHP 8.1.34\\\"\",\"note\":\"version-string match only; not a confirmed exposure\",\"observed_product\":\"PHP\",\"observed_version\":\"8.1.34\",\"source\":\"nvd\"}",
"detectedAt": "2026-09-22T05:44:56.805Z",
"assetValue": "103.233.58.171",
"serviceId": "c3345561d98fc9c9493f3a903e03d773c",
"port": 443,
"technologySlug": "lets-encrypt"
},
{
"id": "ced2530f41879eb26908d7eddb3ffd002",
"cve": "CVE-2025-14177",
"severity": "high",
"cvssScore": 7.5,
"summary": "In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.",
"product": "PHP",
"version": "8.1.34",
"status": "potential",
"matchConfidence": "medium",
"evidence": "{\"match_reason\":\"keyword match on \\\"PHP 8.1.34\\\"\",\"note\":\"version-string match only; not a confirmed exposure\",\"observed_product\":\"PHP\",\"observed_version\":\"8.1.34\",\"source\":\"nvd\"}",
"detectedAt": "2026-09-22T05:44:56.802Z",
"assetValue": "103.233.58.171",
"serviceId": "c3345561d98fc9c9493f3a903e03d773c",
"port": 443,
"technologySlug": "lets-encrypt"
},
{
"id": "cf3b3aa3f828996471f026aebbc08fb63",
"cve": "CVE-2026-94057",
"severity": "medium",
"cvssScore": 4,
"summary": "Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.",
"product": "Exim",
"version": "4.100",
"status": "potential",
"matchConfidence": "medium",
"evidence": "{\"match_reason\":\"keyword match on \\\"Exim 4.100\\\"\",\"note\":\"version-string match only; not a confirmed exposure\",\"observed_product\":\"Exim\",\"observed_version\":\"4.100\",\"source\":\"nvd\"}",
"detectedAt": "2026-09-22T05:44:50.838Z",
"assetValue": "103.233.58.171",
"serviceId": "c3bfb85fbf69ebc4c8d4460946d587252",
"port": 587,
"technologySlug": "exim"
},
{
"id": "cb69f605cf74e90c788cc949db8e30f06",
"cve": "CVE-2026-94056",
"severity": "high",
"cvssScore": 7.5,
"summary": "Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.",
"product": "Exim",
"version": "4.100",
"status": "potential",
"matchConfidence": "medium",
"evidence": "{\"match_reason\":\"keyword match on \\\"Exim 4.100\\\"\",\"note\":\"version-string match only; not a confirmed exposure\",\"observed_product\":\"Exim\",\"observed_version\":\"4.100\",\"source\":\"nvd\"}",
"detectedAt": "2026-09-22T05:44:50.836Z",
"assetValue": "103.233.58.171",
"serviceId": "c3bfb85fbf69ebc4c8d4460946d587252",
"port": 587,
"technologySlug": "exim"
},
{
"id": "ca3eed6c0963512ae7d4e0896fc325a49",
"cve": "CVE-2026-94055",
"severity": "low",
"cvssScore": 3.7,
"summary": "Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.",
"product": "Exim",
"version": "4.100",
"status": "potential",
"matchConfidence": "medium",
"evidence": "{\"match_reason\":\"keyword match on \\\"Exim 4.100\\\"\",\"note\":\"version-string match only; not a confirmed exposure\",\"observed_product\":\"Exim\",\"observed_version\":\"4.100\",\"source\":\"nvd\"}",
"detectedAt": "2026-09-22T05:44:50.833Z",
"assetValue": "103.233.58.171",
"serviceId": "c3bfb85fbf69ebc4c8d4460946d587252",
"port": 587,
"technologySlug": "exim"
},
{
"id": "c294856583cf5ffa089d0132ab92c385b",
"cve": "CVE-2026-94054",
"severity": "high",
"cvssScore": 7,
"summary": "Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.",
"product": "Exim",
"version": "4.100",
"status": "potential",
"matchConfidence": "medium",
"evidence": "{\"match_reason\":\"keyword match on \\\"Exim 4.100\\\"\",\"note\":\"version-string match only; not a confirmed exposure\",\"observed_product\":\"Exim\",\"observed_version\":\"4.100\",\"source\":\"nvd\"}",
"detectedAt": "2026-09-22T05:44:50.831Z",
"assetValue": "103.233.58.171",
"serviceId": "c3bfb85fbf69ebc4c8d4460946d587252",
"port": 587,
"technologySlug": "exim"
}
],
"network": {
"id": "c86748ca13ab7265a28be3002da7c2f6c",
"prefix": "103.233.58.0/23",
"ipVersion": 4
},
"services": [
{
"id": "c72d90a94cb290d1b732061f491a142ca",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"port": 21,
"protocol": "tcp",
"transport": "tcp",
"serviceType": "ftp",
"product": "ProFTPD",
"productVersion": null,
"tlsVersion": null,
"banner": "220 ProFTPD Server (ProFTPD Default Installation) [::ffff:103.233.58.171]",
"state": "open",
"firstSeen": "2026-09-22T05:29:31.310Z",
"lastSeen": "2026-09-22T05:29:31.310Z",
"observationCount": 0,
"technologies": [
{
"slug": "proftpd",
"name": "ProFTPD",
"category": "ftp-server",
"vendor": "ProFTPD Project",
"version": null,
"confidence": "high",
"evidence": "FTP banner: 220 ProFTPD Server (ProFTPD Default Installation) [::ffff:103.233.58.171]",
"detectedAt": "2026-09-22T05:29:31.312Z"
}
],
"certificate": null
},
{
"id": "c225a812e2925baed9e150efe6de77705",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"port": 22,
"protocol": "tcp",
"transport": "tcp",
"serviceType": "ssh",
"product": "OpenSSH",
"productVersion": "9.9",
"tlsVersion": null,
"banner": "SSH-2.0-OpenSSH_9.9",
"state": "open",
"firstSeen": "2026-09-22T05:29:31.316Z",
"lastSeen": "2026-09-22T05:29:31.316Z",
"observationCount": 0,
"technologies": [
{
"slug": "openssh",
"name": "OpenSSH",
"category": "remote-access",
"vendor": "OpenBSD Project",
"version": "9.9",
"confidence": "high",
"evidence": "SSH banner: SSH-2.0-OpenSSH_9.9",
"detectedAt": "2026-09-22T05:29:31.318Z"
}
],
"certificate": null
},
{
"id": "c23d305520ce079f201bb1d1c318847c4",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"port": 53,
"protocol": "tcp",
"transport": "tcp",
"serviceType": "dns",
"product": null,
"productVersion": null,
"tlsVersion": null,
"banner": null,
"state": "open",
"firstSeen": "2026-09-22T05:29:31.322Z",
"lastSeen": "2026-09-22T05:29:31.322Z",
"observationCount": 0,
"technologies": [],
"certificate": null
},
{
"id": "cb6bec175d39547bf3ae2cebd71bed876",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"port": 80,
"protocol": "tcp",
"transport": "tcp",
"serviceType": "http",
"product": "LiteSpeed",
"productVersion": null,
"tlsVersion": null,
"banner": null,
"state": "open",
"firstSeen": "2026-09-22T05:29:31.324Z",
"lastSeen": "2026-09-22T05:29:31.324Z",
"observationCount": 0,
"technologies": [
{
"slug": "litespeed",
"name": "LiteSpeed",
"category": "web-server",
"vendor": "LiteSpeed Technologies",
"version": null,
"confidence": "high",
"evidence": "server: LiteSpeed",
"detectedAt": "2026-09-22T05:29:31.327Z"
}
],
"certificate": null
},
{
"id": "c05b4048d95b0d552d210c5ec6f643e0c",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"port": 110,
"protocol": "tcp",
"transport": "tcp",
"serviceType": "pop3",
"product": "Dovecot",
"productVersion": null,
"tlsVersion": null,
"banner": "+OK Dovecot ready.",
"state": "open",
"firstSeen": "2026-09-22T05:29:31.329Z",
"lastSeen": "2026-09-22T05:29:31.329Z",
"observationCount": 0,
"technologies": [
{
"slug": "dovecot",
"name": "Dovecot",
"category": "mail-server",
"vendor": "Dovecot",
"version": null,
"confidence": "high",
"evidence": "IMAP banner: +OK Dovecot ready.",
"detectedAt": "2026-09-22T05:29:31.331Z"
}
],
"certificate": null
},
{
"id": "cfea0774218e133737e1715ee5c98db52",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"port": 143,
"protocol": "tcp",
"transport": "tcp",
"serviceType": "imap",
"product": "Dovecot",
"productVersion": null,
"tlsVersion": null,
"banner": "* OK [CAPABILITY IMAP4rev1 LOGIN-REFERRALS ID ENABLE IDLE SASL-IR LITERAL+ STARTTLS LOGINDISABLED] Dovecot ready.",
"state": "open",
"firstSeen": "2026-09-22T05:29:31.334Z",
"lastSeen": "2026-09-22T05:29:31.334Z",
"observationCount": 0,
"technologies": [
{
"slug": "dovecot",
"name": "Dovecot",
"category": "mail-server",
"vendor": "Dovecot",
"version": null,
"confidence": "high",
"evidence": "IMAP banner: * OK [CAPABILITY IMAP4rev1 LOGIN-REFERRALS ID ENABLE IDLE SASL-IR LITERAL+ STARTTLS LOGINDISABLED] Dovecot ready.",
"detectedAt": "2026-09-22T05:29:31.336Z"
}
],
"certificate": null
},
{
"id": "c3345561d98fc9c9493f3a903e03d773c",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"port": 443,
"protocol": "tcp",
"transport": "tcp",
"serviceType": "https",
"product": "PHP",
"productVersion": "8.1.34",
"tlsVersion": "TLSv1.3",
"banner": null,
"state": "open",
"firstSeen": "2026-09-22T05:29:31.343Z",
"lastSeen": "2026-09-22T05:29:31.343Z",
"observationCount": 0,
"technologies": [
{
"slug": "litespeed",
"name": "LiteSpeed",
"category": "web-server",
"vendor": "LiteSpeed Technologies",
"version": null,
"confidence": "high",
"evidence": "server: LiteSpeed",
"detectedAt": "2026-09-22T05:29:31.347Z"
},
{
"slug": "php",
"name": "PHP",
"category": "language",
"vendor": "PHP Group",
"version": "8.1.34",
"confidence": "high",
"evidence": "X-Powered-By: PHP/8.1.34",
"detectedAt": "2026-09-22T05:29:31.349Z"
},
{
"slug": "lets-encrypt",
"name": "Let's Encrypt",
"category": "certificate-authority",
"vendor": "Internet Security Research Group",
"version": null,
"confidence": "medium",
"evidence": "TLS certificate issuer: CN=YR1,O=Let's Encrypt,C=US",
"detectedAt": "2026-09-22T05:29:31.353Z"
}
],
"certificate": {
"id": "cfbea592fa37e4810d882cec07f066c8d",
"sha256": "4bc898a570e1aa8ae124a355220e9422d9d79263682457a4c695b84914bfadb5",
"subject": "CN=mail.arthalagani.com",
"issuer": "CN=YR1,O=Let's Encrypt,C=US",
"commonName": "mail.arthalagani.com",
"notBefore": "2026-09-08T23:48:56.000Z",
"notAfter": "2026-12-07T23:48:55.000Z",
"sans": [
"arthalagani.com",
"autoconfig.arthalagani.com",
"autodiscover.arthalagani.com",
"cpanel.arthalagani.com",
"cpcalendars.arthalagani.com",
"cpcontacts.arthalagani.com",
"mail.arthalagani.com",
"webdisk.arthalagani.com",
"webmail.arthalagani.com",
"www.arthalagani.com"
],
"keyAlgo": "RSA",
"sigAlgo": "SHA256-RSA"
}
},
{
"id": "c3bfb85fbf69ebc4c8d4460946d587252",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"port": 587,
"protocol": "tcp",
"transport": "tcp",
"serviceType": "smtp-submission",
"product": "Exim",
"productVersion": "4.100",
"tlsVersion": null,
"banner": "220-access.himalayan.host ESMTP Exim 4.100 #2 Tue, 22 Sep 2026 11:14:08 +0545 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.",
"state": "open",
"firstSeen": "2026-09-22T05:29:31.355Z",
"lastSeen": "2026-09-22T05:29:31.355Z",
"observationCount": 0,
"technologies": [
{
"slug": "exim",
"name": "Exim",
"category": "mail-server",
"vendor": "Exim Project",
"version": "4.100",
"confidence": "high",
"evidence": "SMTP banner: 220-access.himalayan.host ESMTP Exim 4.100 #2 Tue, 22 Sep 2026 11:14:08 +0545 220-We do not authorize the use of this ...",
"detectedAt": "2026-09-22T05:29:31.358Z"
}
],
"certificate": null
},
{
"id": "c1c2372bbc2a24c8e131b7324ae7edeff",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"port": 993,
"protocol": "tcp",
"transport": "tcp",
"serviceType": "imaps",
"product": null,
"productVersion": null,
"tlsVersion": null,
"banner": null,
"state": "open",
"firstSeen": "2026-09-22T05:29:31.362Z",
"lastSeen": "2026-09-22T05:29:31.362Z",
"observationCount": 0,
"technologies": [],
"certificate": null
},
{
"id": "c29d419436492f5464c4208da6aa650ae",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"port": 995,
"protocol": "tcp",
"transport": "tcp",
"serviceType": "pop3s",
"product": null,
"productVersion": null,
"tlsVersion": null,
"banner": null,
"state": "open",
"firstSeen": "2026-09-22T05:29:31.364Z",
"lastSeen": "2026-09-22T05:29:31.364Z",
"observationCount": 0,
"technologies": [],
"certificate": null
}
],
"certificates": [
{
"id": "cfbea592fa37e4810d882cec07f066c8d",
"sha256": "4bc898a570e1aa8ae124a355220e9422d9d79263682457a4c695b84914bfadb5",
"subject": "CN=mail.arthalagani.com",
"issuer": "CN=YR1,O=Let's Encrypt,C=US",
"commonName": "mail.arthalagani.com",
"notBefore": "2026-09-08T23:48:56.000Z",
"notAfter": "2026-12-07T23:48:55.000Z",
"sans": [
"arthalagani.com",
"autoconfig.arthalagani.com",
"autodiscover.arthalagani.com",
"cpanel.arthalagani.com",
"cpcalendars.arthalagani.com",
"cpcontacts.arthalagani.com",
"mail.arthalagani.com",
"webdisk.arthalagani.com",
"webmail.arthalagani.com",
"www.arthalagani.com"
],
"keyAlgo": "RSA",
"sigAlgo": "SHA256-RSA"
}
],
"recentObservations": [
{
"id": "cba6fdf8768618f517329f82f4341286e",
"observedAt": "2026-09-22T05:55:09.052Z",
"source": "fingerprint",
"collector": "fingerprint-1",
"confidence": "high",
"state": {
"reverse_dns": "access.himalayan.host"
},
"evidence": {
"ports": [
21,
22,
23,
25,
53,
80,
110,
143,
443,
445,
587,
993,
995,
1433,
1521,
3306,
3389,
5432,
5900,
6379,
8080,
8443,
8888,
9200,
27017
],
"services": 0,
"reachable": false,
"reverse_dns": "access.himalayan.host",
"ports_probed": 25,
"technologies": null,
"open_services": 10,
"probe_duration": 33
},
"contentHash": "155d8a6ccd1e0e8ea635045983316fdf86f1c7c841bd449ecb08e37e20edd5db",
"changed": false
},
{
"id": "c999a83ae242fe6f7b85f8e73f728a8d7",
"observedAt": "2026-09-22T05:31:54.852Z",
"source": "fingerprint",
"collector": "fingerprint-1",
"confidence": "high",
"state": {
"reverse_dns": "access.himalayan.host"
},
"evidence": {
"ports": [
21,
22,
23,
25,
53,
80,
110,
143,
443,
445,
587,
993,
995,
1433,
1521,
3306,
3389,
5432,
5900,
6379,
8080,
8443,
8888,
9200,
27017
],
"services": 0,
"reachable": false,
"reverse_dns": "access.himalayan.host",
"ports_probed": 25,
"technologies": null,
"open_services": 10,
"probe_duration": 0
},
"contentHash": "53f551d3c9aa96d1f4d58b92928d2b452f9e3a1b2c71233169dbf18836c094b7",
"changed": true
},
{
"id": "c4225a8bbb47727142df2456fb23769c3",
"observedAt": "2026-09-22T05:29:31.368Z",
"source": "fingerprint",
"collector": "fingerprint-1",
"confidence": "high",
"state": {
"services": {
"21/tcp": {
"state": "open",
"product": "ProFTPD",
"version": "",
"cert_sha256": "",
"tls_version": "",
"service_type": "ftp"
},
"22/tcp": {
"state": "open",
"product": "OpenSSH",
"version": "9.9",
"cert_sha256": "",
"tls_version": "",
"service_type": "ssh"
},
"53/tcp": {
"state": "open",
"product": "",
"version": "",
"cert_sha256": "",
"tls_version": "",
"service_type": "dns"
},
"80/tcp": {
"state": "open",
"product": "LiteSpeed",
"version": "",
"cert_sha256": "",
"tls_version": "",
"service_type": "http"
},
"110/tcp": {
"state": "open",
"product": "Dovecot",
"version": "",
"cert_sha256": "",
"tls_version": "",
"service_type": "pop3"
},
"143/tcp": {
"state": "open",
"product": "Dovecot",
"version": "",
"cert_sha256": "",
"tls_version": "",
"service_type": "imap"
},
"443/tcp": {
"state": "open",
"product": "PHP",
"version": "8.1.34",
"cert_sha256": "4bc898a570e1aa8ae124a355220e9422d9d79263682457a4c695b84914bfadb5",
"tls_version": "TLSv1.3",
"service_type": "https"
},
"587/tcp": {
"state": "open",
"product": "Exim",
"version": "4.100",
"cert_sha256": "",
"tls_version": "",
"service_type": "smtp-submission"
},
"993/tcp": {
"state": "open",
"product": "",
"version": "",
"cert_sha256": "",
"tls_version": "",
"service_type": "imaps"
},
"995/tcp": {
"state": "open",
"product": "",
"version": "",
"cert_sha256": "",
"tls_version": "",
"service_type": "pop3s"
}
},
"reverse_dns": "access.himalayan.host",
"technologies": [
"dovecot",
"exim",
"lets-encrypt",
"litespeed",
"openssh",
"php",
"proftpd"
]
},
"evidence": {
"ports": [
21,
22,
23,
25,
53,
80,
110,
143,
443,
445,
587,
993,
995,
1433,
1521,
3306,
3389,
5432,
5900,
6379,
8080,
8443,
8888,
9200,
27017
],
"services": 10,
"reachable": true,
"reverse_dns": "access.himalayan.host",
"ports_probed": 25,
"technologies": [
"dovecot",
"exim",
"lets-encrypt",
"litespeed",
"openssh",
"php",
"proftpd"
],
"open_services": 10,
"probe_duration": 25002
},
"contentHash": "093cefbbda8e41b3f6510fcfffb0ea505f06a1d338924cbe6fdced2006ff66b2",
"changed": true
},
{
"id": "c2fe764925e13f10b67ffe8be944a2470",
"observedAt": "2026-09-22T05:15:11.190Z",
"source": "fingerprint",
"collector": "fingerprint-1",
"confidence": "high",
"state": {
"reverse_dns": "access.himalayan.host"
},
"evidence": {
"ports": [
21,
22,
23,
25,
53,
80,
110,
143,
443,
445,
587,
993,
995,
1433,
1521,
3306,
3389,
5432,
5900,
6379,
8080,
8443,
8888,
9200,
27017
],
"services": 0,
"reachable": false,
"reverse_dns": "access.himalayan.host",
"ports_probed": 25,
"technologies": null,
"open_services": 0,
"probe_duration": 34
},
"contentHash": "5b251c9e1fdf84006f5573c7ae2c1042b225ead025f88b995a5664bb34016ace",
"changed": false
}
],
"recentChanges": [
{
"id": "c0732424e37952d0bca362059dae879b7",
"changeType": "TECHNOLOGY_CHANGED",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": null,
"previousValue": "dovecot, exim, lets-encrypt, litespeed, openssh, php, proftpd",
"currentValue": null,
"detectedAt": "2026-09-22T05:31:54.867Z",
"significance": "low",
"severity": "info",
"confidence": null,
"detail": "technology no longer detected: dovecot, exim, lets-encrypt, litespeed, openssh, php, proftpd",
"serviceId": null
},
{
"id": "c364195a2efc6ecfe7b336f756d557d74",
"changeType": "SERVICE_DISAPPEARED",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": "service:995/tcp",
"previousValue": "pop3s",
"currentValue": null,
"detectedAt": "2026-09-22T05:31:54.866Z",
"significance": "medium",
"severity": "warning",
"confidence": null,
"detail": "endpoint no longer responding",
"serviceId": null
},
{
"id": "cc12238f64c8b7068f35c55166ce9390b",
"changeType": "SERVICE_DISAPPEARED",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": "service:993/tcp",
"previousValue": "imaps",
"currentValue": null,
"detectedAt": "2026-09-22T05:31:54.864Z",
"significance": "medium",
"severity": "warning",
"confidence": null,
"detail": "endpoint no longer responding",
"serviceId": null
},
{
"id": "c2e697a89589c8986c022dd168822175b",
"changeType": "SERVICE_DISAPPEARED",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": "service:80/tcp",
"previousValue": "LiteSpeed",
"currentValue": null,
"detectedAt": "2026-09-22T05:31:54.863Z",
"significance": "medium",
"severity": "warning",
"confidence": null,
"detail": "endpoint no longer responding",
"serviceId": null
},
{
"id": "c7f27e3f651de7d3407ad11bc53cc6477",
"changeType": "SERVICE_DISAPPEARED",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": "service:587/tcp",
"previousValue": "Exim 4.100",
"currentValue": null,
"detectedAt": "2026-09-22T05:31:54.862Z",
"significance": "medium",
"severity": "warning",
"confidence": null,
"detail": "endpoint no longer responding",
"serviceId": null
},
{
"id": "c3470f3ac29d32bb0fa0ccdc227f6bfbe",
"changeType": "SERVICE_DISAPPEARED",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": "service:53/tcp",
"previousValue": "dns",
"currentValue": null,
"detectedAt": "2026-09-22T05:31:54.860Z",
"significance": "medium",
"severity": "warning",
"confidence": null,
"detail": "endpoint no longer responding",
"serviceId": null
},
{
"id": "cc824e320d4de7f44c64e079d9b462320",
"changeType": "SERVICE_DISAPPEARED",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": "service:443/tcp",
"previousValue": "PHP 8.1.34 / TLSv1.3",
"currentValue": null,
"detectedAt": "2026-09-22T05:31:54.859Z",
"significance": "medium",
"severity": "warning",
"confidence": null,
"detail": "endpoint no longer responding",
"serviceId": null
},
{
"id": "c905fb158af0b119d8b3dc35ea2fd1fff",
"changeType": "SERVICE_DISAPPEARED",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": "service:22/tcp",
"previousValue": "OpenSSH 9.9",
"currentValue": null,
"detectedAt": "2026-09-22T05:31:54.857Z",
"significance": "medium",
"severity": "warning",
"confidence": null,
"detail": "endpoint no longer responding",
"serviceId": null
},
{
"id": "c43efedc70bb4ef2cf809e8adf3f8bb6f",
"changeType": "SERVICE_DISAPPEARED",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": "service:21/tcp",
"previousValue": "ProFTPD",
"currentValue": null,
"detectedAt": "2026-09-22T05:31:54.856Z",
"significance": "medium",
"severity": "warning",
"confidence": null,
"detail": "endpoint no longer responding",
"serviceId": null
},
{
"id": "c6b1e2c3da88f1867a9a95cd6812e0893",
"changeType": "SERVICE_DISAPPEARED",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": "service:143/tcp",
"previousValue": "Dovecot",
"currentValue": null,
"detectedAt": "2026-09-22T05:31:54.855Z",
"significance": "medium",
"severity": "warning",
"confidence": null,
"detail": "endpoint no longer responding",
"serviceId": null
},
{
"id": "c6f8dfe1e0dba17c86e8a7c89f41055b3",
"changeType": "SERVICE_DISAPPEARED",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": "service:110/tcp",
"previousValue": "Dovecot",
"currentValue": null,
"detectedAt": "2026-09-22T05:31:54.854Z",
"significance": "medium",
"severity": "warning",
"confidence": null,
"detail": "endpoint no longer responding",
"serviceId": null
},
{
"id": "c6b01aa90a878d1de1dbf4e6198c076f2",
"changeType": "TECHNOLOGY_CHANGED",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": null,
"previousValue": null,
"currentValue": "dovecot, exim, lets-encrypt, litespeed, openssh, php, proftpd",
"detectedAt": "2026-09-22T05:29:31.382Z",
"significance": "low",
"severity": "info",
"confidence": null,
"detail": "technology detected: dovecot, exim, lets-encrypt, litespeed, openssh, php, proftpd",
"serviceId": null
},
{
"id": "c51f86506cb6a905fb2a1114a9bb15717",
"changeType": "NEW_SERVICE",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": "service:995/tcp",
"previousValue": null,
"currentValue": "pop3s",
"detectedAt": "2026-09-22T05:29:31.381Z",
"significance": "low",
"severity": "notice",
"confidence": null,
"detail": "newly observed open endpoint",
"serviceId": null
},
{
"id": "c4b912d565f4718edf1398e011d358441",
"changeType": "NEW_SERVICE",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": "service:993/tcp",
"previousValue": null,
"currentValue": "imaps",
"detectedAt": "2026-09-22T05:29:31.380Z",
"significance": "low",
"severity": "notice",
"confidence": null,
"detail": "newly observed open endpoint",
"serviceId": null
},
{
"id": "c4e5f248e06076717a2740c153a3eab8b",
"changeType": "NEW_SERVICE",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": "service:80/tcp",
"previousValue": null,
"currentValue": "LiteSpeed",
"detectedAt": "2026-09-22T05:29:31.379Z",
"significance": "low",
"severity": "notice",
"confidence": null,
"detail": "newly observed open endpoint",
"serviceId": null
},
{
"id": "c44cd40fd4efcae8d9ddbe48e03c5355a",
"changeType": "NEW_SERVICE",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": "service:587/tcp",
"previousValue": null,
"currentValue": "Exim 4.100",
"detectedAt": "2026-09-22T05:29:31.377Z",
"significance": "low",
"severity": "notice",
"confidence": null,
"detail": "newly observed open endpoint",
"serviceId": null
},
{
"id": "c679ed01286b319713211060668f0f6fc",
"changeType": "NEW_SERVICE",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": "service:53/tcp",
"previousValue": null,
"currentValue": "dns",
"detectedAt": "2026-09-22T05:29:31.376Z",
"significance": "low",
"severity": "notice",
"confidence": null,
"detail": "newly observed open endpoint",
"serviceId": null
},
{
"id": "ca989e012fe6cd065eaaf067915b8a034",
"changeType": "NEW_SERVICE",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": "service:443/tcp",
"previousValue": null,
"currentValue": "PHP 8.1.34 / TLSv1.3",
"detectedAt": "2026-09-22T05:29:31.374Z",
"significance": "low",
"severity": "notice",
"confidence": null,
"detail": "newly observed open endpoint",
"serviceId": null
},
{
"id": "c61101f0373bf421f8cdbaeae11037d28",
"changeType": "NEW_SERVICE",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": "service:22/tcp",
"previousValue": null,
"currentValue": "OpenSSH 9.9",
"detectedAt": "2026-09-22T05:29:31.373Z",
"significance": "low",
"severity": "notice",
"confidence": null,
"detail": "newly observed open endpoint",
"serviceId": null
},
{
"id": "c96ee8a43bc0aeeedbe7b842176d7f3f0",
"changeType": "NEW_SERVICE",
"assetId": "c58c615978bbb0e5e1ad3b5f751f8d399",
"assetValue": null,
"field": "service:21/tcp",
"previousValue": null,
"currentValue": "ProFTPD",
"detectedAt": "2026-09-22T05:29:31.372Z",
"significance": "low",
"severity": "notice",
"confidence": null,
"detail": "newly observed open endpoint",
"serviceId": null
}
],
"dnsRecords": [],
"state": {
"current": {
"reverse_dns": "access.himalayan.host"
},
"previous": {
"reverse_dns": "access.himalayan.host"
},
"comparable": true
}
}