139.5.70.233

ipv4in scopepriority NORMAL1 potential exposure

First seen 22 Sep 2026, last seen 22 Sep 2026 18:29 UTC (4h ago). 1 observations on record. Location is an estimate derived from registration data — the source and confidence are stated below.

Identity

What is known about this address

Reverse DNS: 233.70.5.139.dynamic.wlink.com.np
Hostname: —
ASN: AS17501 — WLINK-NEPAL-AS-AP - WorldLink Communications Pvt Ltd
Organisation: WLINK-NEPAL-AS-AP - WorldLink Communications Pvt Ltd
Location estimate: Patan, Bagmati Province, NPlow
Geolocation source: ip-api.com
First seen: 22 Sep 2026 07:25 UTC
Last seen: 22 Sep 2026 18:29 UTC

Services

Open services observed on this address

A service appears here only once a banner or handshake has actually been captured. Technology detections carry confidence and evidence; weak evidence is not stated as fact.

Port	Service	Product	Technologies	TLS	State	Banner	Last seen
80 tcp / tcp	http	nginx	nginxhigh server: nginx	not negotiated	open	no banner captured	22 Sep 2026 4h ago
443 tcp / tcp	https	PHP 8.1.8	nginxhigh server: nginx PHP8.1.8high X-Powered-By: PHP/8.1.8 Let's Encryptmedium TLS certificate issuer: CN=YR1,O=Let's Encrypt,C=US	TLSv1.3 certificate sha256 da9661d2769e7816136c2006cf748e546651388a74d80c88fa471ae2353329e1 subject CN=.metacloud.com.np issuer CN=YR1,O=Let's Encrypt,C=US commonName .metacloud.com.np notBefore 2026-09-02T04:08:57.000Z notAfter 2026-12-01T04:08:56.000Z keyAlgo RSA sigAlgo SHA256-RSA	open	no banner captured	22 Sep 2026 4h ago

Certificates

Certificates presented

Certificate 1

sha256: da9661d2769e7816136c2006cf748e546651388a74d80c88fa471ae2353329e1
subject: CN=*.metacloud.com.np
issuer: CN=YR1,O=Let's Encrypt,C=US
commonName: *.metacloud.com.np
notBefore: 2026-09-02T04:08:57.000Z
notAfter: 2026-12-01T04:08:56.000Z
keyAlgo: RSA
sigAlgo: SHA256-RSA

History

Observation history

Newest first. 1 observations on record.

Observed at	Source	Collector	Confidence	Changed	State	Content hash
22 Sep 2026 18:29 UTC	fingerprint	fingerprint-1	high	changed	{"services":{"80/tcp":{"state":"open","product":"nginx","version":"","cert_sha256":"","tls_version":"","service_type":"http"},"443/tcp":{"state":"open","produc…	f4dee0dc04b5ce227cc3b73f1a91026466ac5ab…

Change feed

Change events

Detected differences between consecutive observations. 3 on record.

Detected at	Type	Field	Previous	Current	Significance	Confidence
22 Sep 2026 18:29 UTC	NEW SERVICE	service:80/tcp	—	nginx	low	unknown
22 Sep 2026 18:29 UTC	NEW SERVICE	service:443/tcp	—	PHP 8.1.8 / TLSv1.3	low	unknown
22 Sep 2026 18:29 UTC	NEW ASSET	—	—	asset with 2 observed open endpoint(s)	low	unknown

Potential exposure

Version-based vulnerability matches

Matches are produced by comparing a detected product version against a known-issue list. They are potential exposures, not confirmed vulnerabilities, and nothing here has been exploited or verified.

1 match on this asset, each one unverified. Treat these as leads for manual review, never as findings.

Identifier	Severity	CVSS	Product / version	Status	Match confidence	Evidence	Detected
CVE-2022-31627 In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocate…	high	7.7	PHP 8.1.8	potential exposure — unverified	medium	{"match_reason":"keyword match on \"PHP 8.1.8\"","note":"version-string match only; not a confirmed exposure","observed…	22 Sep 2026

State

Current state against the previous state

The stored state document for this asset, compared field by field against its predecessor. Values are shown exactly as stored.

Only one state has been recorded. The current document is shown without a predecessor — no comparison is implied.

reverse_dns: 233.70.5.139.dynamic.wlink.com.np
services.443/tcp.cert_sha256: da9661d2769e7816136c2006cf748e546651388a74d80c88fa471ae2353329e1
services.443/tcp.product: PHP
services.443/tcp.service_type: https
services.443/tcp.state: open
services.443/tcp.tls_version: TLSv1.3
services.443/tcp.version: 8.1.8
services.80/tcp.cert_sha256
services.80/tcp.product: nginx
services.80/tcp.service_type: http
services.80/tcp.state: open
services.80/tcp.tls_version
services.80/tcp.version

Raw detail document

GET /assets/c99d8eb72536dbf189222c08ad03b5251

Show the fields returned by the API

{
  "id": "c99d8eb72536dbf189222c08ad03b5251",
  "type": "ipv4",
  "value": "139.5.70.233",
  "hostname": null,
  "reverseDns": "233.70.5.139.dynamic.wlink.com.np",
  "asn": {
    "number": 17501,
    "name": "WLINK-NEPAL-AS-AP - WorldLink Communications Pvt Ltd"
  },
  "organization": {
    "id": "c4f150547622eacc586af3e263e09205e",
    "name": "WLINK-NEPAL-AS-AP - WorldLink Communications Pvt Ltd"
  },
  "location": {
    "country": "NP",
    "city": "Patan",
    "province": "Bagmati Province",
    "district": "",
    "confidence": "low",
    "source": "ip-api.com"
  },
  "scopeStatus": "in_scope",
  "priority": "NORMAL",
  "firstSeen": "2026-09-22T07:25:52.973Z",
  "lastSeen": "2026-09-22T18:29:32.477Z",
  "observationCount": 1,
  "openServices": 2,
  "serviceCount": 2,
  "technologies": [
    "lets-encrypt",
    "nginx",
    "php"
  ],
  "vulnerabilityMatches": [
    {
      "id": "c4ad0aa2a435071573992c861e56c2fef",
      "cve": "CVE-2022-31627",
      "severity": "high",
      "cvssScore": 7.7,
      "summary": "In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.",
      "product": "PHP",
      "version": "8.1.8",
      "status": "potential",
      "matchConfidence": "medium",
      "evidence": "{\"match_reason\":\"keyword match on \\\"PHP 8.1.8\\\"\",\"note\":\"version-string match only; not a confirmed exposure\",\"observed_product\":\"PHP\",\"observed_version\":\"8.1.8\",\"source\":\"nvd\"}",
      "detectedAt": "2026-09-22T19:05:18.630Z",
      "assetValue": "139.5.70.233",
      "serviceId": "cbffba9026ffd7e9e602cad390633a72c",
      "port": 443,
      "technologySlug": "lets-encrypt"
    }
  ],
  "network": {
    "id": "cf010283b8c5e72719493deeaab6cdb57",
    "prefix": "139.5.70.0/24",
    "ipVersion": 4
  },
  "services": [
    {
      "id": "c877ef7b441a235f552ce19e12b9d8e55",
      "assetId": "c99d8eb72536dbf189222c08ad03b5251",
      "assetValue": null,
      "port": 80,
      "protocol": "tcp",
      "transport": "tcp",
      "serviceType": "http",
      "product": "nginx",
      "productVersion": null,
      "tlsVersion": null,
      "banner": null,
      "state": "open",
      "firstSeen": "2026-09-22T18:29:32.424Z",
      "lastSeen": "2026-09-22T18:29:32.424Z",
      "observationCount": 0,
      "technologies": [
        {
          "slug": "nginx",
          "name": "nginx",
          "category": "web-server",
          "vendor": "NGINX, Inc.",
          "version": null,
          "confidence": "high",
          "evidence": "server: nginx",
          "detectedAt": "2026-09-22T18:29:32.433Z"
        }
      ],
      "certificate": null
    },
    {
      "id": "cbffba9026ffd7e9e602cad390633a72c",
      "assetId": "c99d8eb72536dbf189222c08ad03b5251",
      "assetValue": null,
      "port": 443,
      "protocol": "tcp",
      "transport": "tcp",
      "serviceType": "https",
      "product": "PHP",
      "productVersion": "8.1.8",
      "tlsVersion": "TLSv1.3",
      "banner": null,
      "state": "open",
      "firstSeen": "2026-09-22T18:29:32.452Z",
      "lastSeen": "2026-09-22T18:29:32.452Z",
      "observationCount": 0,
      "technologies": [
        {
          "slug": "nginx",
          "name": "nginx",
          "category": "web-server",
          "vendor": "NGINX, Inc.",
          "version": null,
          "confidence": "high",
          "evidence": "server: nginx",
          "detectedAt": "2026-09-22T18:29:32.455Z"
        },
        {
          "slug": "php",
          "name": "PHP",
          "category": "language",
          "vendor": "PHP Group",
          "version": "8.1.8",
          "confidence": "high",
          "evidence": "X-Powered-By: PHP/8.1.8",
          "detectedAt": "2026-09-22T18:29:32.458Z"
        },
        {
          "slug": "lets-encrypt",
          "name": "Let's Encrypt",
          "category": "certificate-authority",
          "vendor": "Internet Security Research Group",
          "version": null,
          "confidence": "medium",
          "evidence": "TLS certificate issuer: CN=YR1,O=Let's Encrypt,C=US",
          "detectedAt": "2026-09-22T18:29:32.461Z"
        }
      ],
      "certificate": {
        "id": "cb17e331d2464876006b14765ae5cbbc1",
        "sha256": "da9661d2769e7816136c2006cf748e546651388a74d80c88fa471ae2353329e1",
        "subject": "CN=*.metacloud.com.np",
        "issuer": "CN=YR1,O=Let's Encrypt,C=US",
        "commonName": "*.metacloud.com.np",
        "notBefore": "2026-09-02T04:08:57.000Z",
        "notAfter": "2026-12-01T04:08:56.000Z",
        "sans": [
          "*.metacloud.com.np",
          "metacloud.com.np"
        ],
        "keyAlgo": "RSA",
        "sigAlgo": "SHA256-RSA"
      }
    }
  ],
  "certificates": [
    {
      "id": "cb17e331d2464876006b14765ae5cbbc1",
      "sha256": "da9661d2769e7816136c2006cf748e546651388a74d80c88fa471ae2353329e1",
      "subject": "CN=*.metacloud.com.np",
      "issuer": "CN=YR1,O=Let's Encrypt,C=US",
      "commonName": "*.metacloud.com.np",
      "notBefore": "2026-09-02T04:08:57.000Z",
      "notAfter": "2026-12-01T04:08:56.000Z",
      "sans": [
        "*.metacloud.com.np",
        "metacloud.com.np"
      ],
      "keyAlgo": "RSA",
      "sigAlgo": "SHA256-RSA"
    }
  ],
  "recentObservations": [
    {
      "id": "c3fabd125fcd8babaa6b8c2cea6e55a56",
      "observedAt": "2026-09-22T18:29:32.466Z",
      "source": "fingerprint",
      "collector": "fingerprint-1",
      "confidence": "high",
      "state": {
        "services": {
          "80/tcp": {
            "state": "open",
            "product": "nginx",
            "version": "",
            "cert_sha256": "",
            "tls_version": "",
            "service_type": "http"
          },
          "443/tcp": {
            "state": "open",
            "product": "PHP",
            "version": "8.1.8",
            "cert_sha256": "da9661d2769e7816136c2006cf748e546651388a74d80c88fa471ae2353329e1",
            "tls_version": "TLSv1.3",
            "service_type": "https"
          }
        },
        "reverse_dns": "233.70.5.139.dynamic.wlink.com.np",
        "technologies": [
          "lets-encrypt",
          "nginx",
          "php"
        ]
      },
      "evidence": {
        "ports": [
          21,
          22,
          23,
          25,
          53,
          80,
          110,
          143,
          443,
          445,
          465,
          587,
          993,
          995,
          1433,
          1521,
          3306,
          3389,
          5432,
          5900,
          6379,
          8080,
          8443,
          8888,
          9200,
          27017
        ],
        "services": 2,
        "reachable": true,
        "reverse_dns": "233.70.5.139.dynamic.wlink.com.np",
        "ports_probed": 26,
        "technologies": [
          "lets-encrypt",
          "nginx",
          "php"
        ],
        "open_services": 2,
        "probe_duration": 29037
      },
      "contentHash": "f4dee0dc04b5ce227cc3b73f1a91026466ac5abc25c7c7e3462479189671abd3",
      "changed": true
    }
  ],
  "recentChanges": [
    {
      "id": "c3af689cb05d8fc2e8365333a36dfd21f",
      "changeType": "NEW_SERVICE",
      "assetId": "c99d8eb72536dbf189222c08ad03b5251",
      "assetValue": null,
      "field": "service:80/tcp",
      "previousValue": null,
      "currentValue": "nginx",
      "detectedAt": "2026-09-22T18:29:32.474Z",
      "significance": "low",
      "severity": "notice",
      "confidence": null,
      "detail": "endpoint responded on first observation",
      "serviceId": null
    },
    {
      "id": "cc013628ab849cf168ed05190e6089851",
      "changeType": "NEW_SERVICE",
      "assetId": "c99d8eb72536dbf189222c08ad03b5251",
      "assetValue": null,
      "field": "service:443/tcp",
      "previousValue": null,
      "currentValue": "PHP 8.1.8 / TLSv1.3",
      "detectedAt": "2026-09-22T18:29:32.472Z",
      "significance": "low",
      "severity": "notice",
      "confidence": null,
      "detail": "endpoint responded on first observation",
      "serviceId": null
    },
    {
      "id": "cf6e0b9065b2a356897db0bf3e9ffb4b7",
      "changeType": "NEW_ASSET",
      "assetId": "c99d8eb72536dbf189222c08ad03b5251",
      "assetValue": null,
      "field": null,
      "previousValue": null,
      "currentValue": "asset with 2 observed open endpoint(s)",
      "detectedAt": "2026-09-22T18:29:32.470Z",
      "significance": "low",
      "severity": "notice",
      "confidence": null,
      "detail": "asset observed for the first time",
      "serviceId": null
    }
  ],
  "dnsRecords": [],
  "state": {
    "current": {
      "services": {
        "80/tcp": {
          "state": "open",
          "product": "nginx",
          "version": "",
          "cert_sha256": "",
          "tls_version": "",
          "service_type": "http"
        },
        "443/tcp": {
          "state": "open",
          "product": "PHP",
          "version": "8.1.8",
          "cert_sha256": "da9661d2769e7816136c2006cf748e546651388a74d80c88fa471ae2353329e1",
          "tls_version": "TLSv1.3",
          "service_type": "https"
        }
      },
      "reverse_dns": "233.70.5.139.dynamic.wlink.com.np",
      "technologies": [
        "lets-encrypt",
        "nginx",
        "php"
      ]
    },
    "previous": null,
    "comparable": false
  }
}