IntruderReport - 06 Oct 2021

Scan Summary: Phil Golden
Targets: 95.111.195.84, www.cansew.com, www.flowbee.com

7 October 2021

High
Threat Level
While no imminent risk of a breach was detected, the high severity issues could lead to a breach by attackers with existing access to the
affected systems, such as malicious customers or employees, or by reasonably highly skilled, determined or well resourced attackers.
High severity issues should ideally be resolved within thirty days to minimise the risk of a breach.
0 3 8 2
Critical High Medium Low

issues issues issues issues
Exposure over time
Differences since last assessment
New issues discovered Previous issues remediated Direction of travel
Critical 0 Critical 0  0
High 1 High 0  1  50%
Medium 1 Medium 0  1  14%
Low 0 Low 0  0
1 of 15
What we checked you for
You're on our Pro plan, which means all the targets included and their reachable webpages were checked for over
10,000 weaknesses including:
Vulnerable Software

Thousands of checks for known weaknesses in a huge variety of software and hardware, such as: Web servers
(e.g. Apache, Nginx), mail servers (e.g. Exim), development software (e.g. PHP), network monitoring software (e.g.
Zabbix, Nagios), networking systems (e.g. Cisco ASA), content management systems (e.g. Drupal, WordPress), as well
as other well-known weaknesses, such as 'Shellshock'
Web Application Vulnerabilities


Includes but is not limited to: Checks for multiple OWASP Top Ten issues, SQL injection, Cross-site scripting (XSS),
XML external entity (XXE) injection, local/remote file inclusion, web server misconfigurations, directory/path
traversal, directory listing & unintentionally exposed content
Common Mistakes & Misconfigurations


Checks for a wide range of misconfigurations, common mistakes and security best practices. These include:
VPN configuration weaknesses, exposed SVN/git repositories, unsupported operating systems, open mail relays, DNS
servers allowing zone transfer
Encryption Weaknesses

Weaknesses in SSL/TLS implementations, such as: 'Heartbleed', 'CRIME', 'BEAST', and 'ROBOT', weak encryption
ciphers, weak encryption protocols, SSL certificate misconfigurations, unencrypted services such as FTP
Attack Surface Reduction


Our service is designed to help your organisation reduce its attack surface and identify systems and software
which do not need to be exposed to the internet. Such as: Publicly exposed databases, administrative interfaces,
sensitive services, such as SMB, network monitoring software
Information Leakage

Checks for information which your systems are reporting to end-users which should remain private. This
information includes data which could be used to assist in the mounting of further attacks, such as: Local
directory path information, and internal IP addresses.
Those are the checks that were made for this report. However, your service with us also includes:
Monthly Checks

On average, more than 20 new vulnerabilities are discovered every day. A hacker may only need one of these
to breach your systems. The Pro plan includes monthly checks for the latest weaknesses which may affect
your systems, and ensures any recent changes haven't compromised your security.
Emerging Threats

The time between new vulnerabilities emerging and hackers exploiting them is now days, not weeks. For
organisations who need a more mature approach to cyber security, our emerging threat scans detect critical
threats to your systems without waiting for the next monthly check.
2 of 15
Issue Summary
Severity Issue details
High Possible Scan Interference

Number of occurrences: 3
High Sensitive Details Sent Over Unencrypted HTTP Protocol

High Unsupported PHP Version In Use

Medium Database Exposed to the Internet (MySQL)

Medium Email Server Accepts Credentials Without Encryption

Medium Insecure FTP Protocol In Use

Medium JQuery Version In Use Contains Known Vulnerabilities

Medium PHP Version In Use Contains Known Vulnerabilities

Medium Untrusted / Invalid SSL Certificate

Medium Weak SSH Ciphers Supported

Medium Weak SSL Ciphers Supported

Low Weak Integrity Settings For Remote Administration Service (SSH)

Low Weak TLS Protocol Version Supported

3 of 15
Issues
Possible Scan Interference (High)
Description
Our scanner detected some potential interference with the scan, this may prevent us from correctly finding your
weaknesses, and prevent you from fixing them.
A common way systems like firewalls or 'Intrusion Prevention Systems' try to deter or prevent hackers is to detect their
attacks and block all communication from that source. This works when the attacker behaviour is obvious; like our scans
that try to identify thousands of weaknesses in a short space of time. However, in situations where attackers target
specific issues across a wide variety of targets (like the whole internet), or disguise their attacks by sending them from
multiple locations, these attacks can sneak through this type of blocking.
If you are using an Intrusion Prevention System, or your firewall has a similar service built in, you might be preventing
our scans from finding a weaknesses that a hacker could later exploit, and not benefitting from our service to help
secure your systems. This issue can also be triggered by web application firewalls (WAFs).
Note that we detect this by identifying when services that initially look open to our scans are later closed. This can indicate that
blocking is in place, that the server was restarted, that there was network interference or that firewall settings were changed
during the scan.
Remediation Advice
Consider adding our scanning IPs to your Intrusion Prevention System or web application firewall 'whitelist'. This will
allow our scans to operate without being blocked, and help us identify your weaknesses, so you can fix them before a
hacker finds them. The full list of our scanning IPs is shown below:
35.177.219.0/26
3.9.159.128/25
18.168.180.128/25
18.168.224.128/25
54.93.254.128/26
18.194.95.64/26
3.124.123.128/25
3.67.7.128/25
139.162.214.111
203.12.218.0/24 (most recent)
178.79.140.186 (Network scans only)

Occurrences
First seen
95.111.195.84 04 Oct 2021 03:03

www.cansew.com 04 Oct 2021 14:46
www.flowbee.com 04 Oct 2021 04:22
Sensitive Details Sent Over Unencrypted HTTP Protocol (High)
Description
The application does not require a secure connection (HTTPS) to be used when sending sensitive data. HTTPS is the
secure extension of the HTTP protocol.
Passwords and other data submitted over a connection lacking HTTPS are vulnerable to capture by an attacker who is
suitably positioned to view traffic sent between the user and application, in what is referred to as a Man-in-the-Middle
(MitM) attack. Connections made over HTTPS are encrypted using ‘Transport Layer Security’ (TLS), so that they remain
confidential end-to-end.
Without an encrypted connection (HTTPS), a MitM attacker can impersonate your application, or tamper with data sent
4 of 15
between the client and the application.
MitM attacks could be carried out by any malicious party located in areas such as the client's own network (e.g. using an
unsecured WiFi network at a cafe or gym), within the client or server's Internet Service Provider (ISP), or within the
server's hosting infrastructure.
Remediation Advice
All applications handling sensitive data should use an encrypted HTTPS connection to protect client-server
communications. Where cookies are used for transmitting session tokens, the secure flag should be set to prevent
transmission without encryption.
Occurrences
Path First seen
95.111.195.84 : 8080 (tcp) /login 07 Oct 2021 06:47
Unsupported PHP Version In Use (High)
Description
The version of PHP in use is no longer supported by the vendor. Because it is not supported, it no longer receives
security updates or patches and therefore leaves the system exposed to unpatched security weaknesses.
For further information, please see:

http://php.net/supported-versions.php
Remediation Advice
Upgrade the version of PHP in use to the latest available supported version.
Occurrences
Version First seen
www.cansew.com : 443 (tcp) 7.1.33 04 Oct 2021 14:46
Database Exposed to the Internet (MySQL) (Medium)
Description
A MySQL database, which is usually intended only to be accessible on local networks (i.e. not exposed to the public) was
discovered exposed to the Internet. Databases are designed to be repositories for business information and should
never be directly exposed to the Internet.
Exposing this database to the Internet increases your organisation’s risk in three ways, as an attacker could:
Attempt to use default, common or stolen credentials to login

Use privately owned/publicly unknown vulnerabilities to compromise the database
Exploit newly released vulnerabilities before you have time to patch the system
Remediation Advice
If this database does not need to be accessed over the Internet, implement a firewall policy to block access from the
outside the internal network.
If remote access is required, firewall policy should only permit access to whitelisted IP addresses, or its access should be
secured through a VPN.
Occurrences
First seen
www.cansew.com : 3306 (tcp) 04 Oct 2021 14:46
Email Server Accepts Credentials Without Encryption (Medium)
Description
The email server allows users to send their username and password without encryption.
5 of 15
Passwords and other data submitted over a connection lacking encryption are vulnerable to capture by an attacker who
is suitably positioned to view traffic sent between the user and email server, in what is referred to as a Man-in-the-
Middle (MitM) attack. Traffic that is encrypted in transit remains confidential end-to-end.
MitM attacks could be carried out by any malicious party located in areas such as the client's own network (e.g. using an
unsecured WiFi network at a cafe, or gym), within the client or server's Internet Service Provider (ISP), or within the
server's hosting infrastructure.
Remediation Advice
The email server should be configured to only allow encrypted authentication methods.
Occurrences
First seen

www.flowbee.com : 110 (tcp) 04 Oct 2021 04:22
Insecure FTP Protocol In Use (Medium)
Description
An unencrypted FTP service (e.g. FTP, TFTP) was found to be running on the host. An attacker in a position to sniff or
modify network traffic (e.g. on an unsecured wireless network) could exploit the plain-text nature of the FTP/TFTP
protocol to obtain a valid user's login details and gain unauthorised access to data exposed by the service.
Note that protocols such as SSL can be used in combination with FTP or TFTP to add security (e.g. FTP over SSL, FTPS). In
this case, the security configuration of the service should be reviewed to ensure that it has been correctly configured.
Please see the 'Raw Scanner Output' for further information.
Remediation Advice
If secure file transfer is a requirement, the FTP service should be replaced with a more modern and secure service such
as SFTP or SCP.
If the detected services are FTP over SSL (FTPS) implementations, their configurations should be reviewed to ensure that
they operate in implicit mode. Note that an FTPS service which is configured in implicit mode will not be compatible with
clients which are only able to connect over the insecure FTP protocol. Furthermore, configure the server so that control
connections are encrypted.
Occurrences
First seen
JQuery Version In Use Contains Known Vulnerabilities (Medium)
Description
The version of JQuery in use contains a number of known security vulnerabilities which could be used to compromise
the system or affect its availability.
JQuery is a popular JavaScript library used in web development.
Remediation Advice
Upgrade the version of JQuery in use to the latest available supported version.
Occurrences
Version First seen
95.111.195.84 : 8080 (tcp) 1.10.2 07 Oct 2021 06:47
PHP Version In Use Contains Known Vulnerabilities (Medium)
6 of 15
Description
The version of PHP in use contains a number of known security vulnerabilities which could be used to compromise the
system or affect its availability. PHP is a scripting language usually used for web development.
For further detail on specific vulnerabilities affecting the installed version of software, please see the raw scanner
output in the occurrences table below and refer to:
http://www.cvedetails.com/vulnerability-list/vendor_id-74/product_id-128/PHP-PHP.html
Remediation Advice
Upgrade the version of PHP in use to the latest available supported version.
Occurrences
Version First seen
www.cansew.com : 443 (tcp) 7.1.33 04 Oct 2021 14:46
Untrusted / Invalid SSL Certificate (Medium)
Description
The SSL certificate installed on the host is not valid/trusted. This means that a user will be presented with a certificate
error when connecting to the service and will be unable to verify the authenticity of the connection.
An attacker in a position to intercept network traffic (eg. over a shared wireless network), could use this weakness to
carry out a Man-in-the-Middle attack against the service, which would allow them to gain access to any data transferred
between the user and the server.
Remediation Advice
Ensure the certificate installed on the host:
Is signed by a trusted Certification Authority (CA).

Has a "commonName", which matches the host name.
Has not expired.
Has a validity period of less than 825 days
There are a number of other reasons why a certificate may not be trusted. Please check the 'Raw Scanner Output' in the
occurrences table for further details.
Occurrences
First seen

Weak SSH Ciphers Supported (Medium)
Description
The SSH service on the host was found to support weak ciphers. If an attacker is able to intercept the communications
between the SSH client and server, they would theoretically be able to decrypt this communication. Please note that the
complexity and mathematics behind the attack are non-trivial and make it infeasible for all but the most highly skilled
and resourced attackers.
Remediation Advice
The SSH service should be configured to allow only strong ciphers. For example, in OpenSSH v6.7+, the following
directive can be configured in "/etc/ssh/sshd_config":
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-
ctr,aes128-ctr
For further information please see:

https://wiki.mozilla.org/Security/Guidelines/OpenSSH
Occurrences
7 of 15
Cipher First seen
www.cansew.com : 22 (tcp) arcfour 04 Oct 2021 14:46

www.cansew.com : 22 (tcp) arcfour128 04 Oct 2021 14:46
www.cansew.com : 22 (tcp) arcfour256 04 Oct 2021 14:46
www.cansew.com : 22 (tcp) 3des-cbc 04 Oct 2021 14:46
www.cansew.com : 22 (tcp) aes128-cbc 04 Oct 2021 14:46
www.cansew.com : 22 (tcp) blowfish-cbc 04 Oct 2021 14:46
www.cansew.com : 22 (tcp) cast128-cbc 04 Oct 2021 14:46
www.cansew.com : 22 (tcp) rijndael- 04 Oct 2021 14:46
cbc@lysator.liu.se
www.flowbee.com : 22 (tcp) 3des-cbc 04 Oct 2021 04:22
www.flowbee.com : 22 (tcp) aes128-cbc 04 Oct 2021 04:22
www.flowbee.com : 22 (tcp) blowfish-cbc 04 Oct 2021 04:22
www.flowbee.com : 22 (tcp) cast128-cbc 04 Oct 2021 04:22
Weak SSL Ciphers Supported (Medium)
Description
A service on the host was found to support weak cipher suites. If an attacker is able to intercept the communications
between the client and the server, they would theoretically be able to decrypt this communication. Although an attack is
possible in theory, the complexity and mathematics behind most attacks are non-trivial and make it infeasible for all but
the most highly skilled and resourced attackers.
Please note, "Null" ciphers are considerably easier to exploit, as the traffic is not encrypted, though still requires access
to communications between the client and the server.
Remediation Advice
The service should be hardened to ensure an attacker cannot gain unauthorised access to the data being transferred.
For example, the following configurations should not be supported:
The DES, Triple-DES (3DES), Blowfish, RC4 or MD5 algorithms

Ciphers with less than 128-bit keys
Any version of SSL (including version 3)
Anonymous or "Null" ciphers
Block ciphers using 64-bit blocks
Export ciphers
The Mozilla SSL Configuration Generator is a good resource for configuring services securely:
https://mozilla.github.io/server-side-tls/ssl-config-generator/
Occurrences
Cipher First seen
www.cansew.com : 21 (tcp) ADH-RC4-MD5(128- 04 Oct 2021 14:46

bits)
www.cansew.com : 21 (tcp) ECDHE-RSA-RC4- 04 Oct 2021 14:46
SHA(128-bits)
www.cansew.com : 21 (tcp) AECDH-RC4-SHA(128- 04 Oct 2021 14:46
bits)
www.cansew.com : 21 (tcp) RC4-MD5(128-bits) 04 Oct 2021 14:46
www.cansew.com : 21 (tcp) RC4-SHA(128-bits) 04 Oct 2021 14:46
www.cansew.com : 21 (tcp) EDH-RSA-DES-CBC3- 04 Oct 2021 14:46
SHA(168-bits)
www.cansew.com : 21 (tcp) ADH-DES-CBC3- 04 Oct 2021 14:46
SHA(168-bits)
www.cansew.com : 21 (tcp) ECDHE-RSA-DES- 04 Oct 2021 14:46
CBC3-SHA(168-bits)
8 of 15
www.cansew.com : 21 (tcp) AECDH-DES-CBC3- 04 Oct 2021 14:46
SHA(168-bits)
www.cansew.com : 21 (tcp) DES-CBC3-SHA(168- 04 Oct 2021 14:46
bits)
SHA(168-bits)
CBC3-SHA(168-bits)
bits)
SHA(168-bits)
CBC3-SHA(168-bits)
bits)
SHA(168-bits)
CBC3-SHA(168-bits)
bits)
SHA(168-bits)
CBC3-SHA(168-bits)
bits)
www.cansew.com : 21 (tcp) Anonymous Ciphers 04 Oct 2021 14:46
(no authentication)
Weak Integrity Settings For Remote Administration Service (SSH) (Low)
Description
The remote administration service (known as SSH) on the identified servers is using a weak configuration for its integrity
checks.
This means that in theory an attacker may be able to interfere with the communication between the server and anyone
using the SSH remote administration service.
However, in order to do this the attacker would need to be in a position to intercept and modify network traffic. In
addition, the likelihood of an attacker being able to use this vulnerability to their own advantage is very low, due to the
complexity of the attack. Therefore, we would not expect this vulnerability to be exploited.
Remediation Advice
You can edit your SSH configuration file, normally found at '/etc/ssh/ssh_config' to remove support for the weak MAC
settings as follows:
The default is normally:

MACs hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96
However you can remove the weak MACs by changing it to:

MACs hmac-sha1,hmac-ripemd160
Occurrences
MAC First seen
www.cansew.com : 22 (tcp) hmac-md5 04 Oct 2021 14:46

www.cansew.com : 22 (tcp) hmac-md5-96 04 Oct 2021 14:46
www.cansew.com : 22 (tcp) hmac-sha1-96 04 Oct 2021 14:46
Weak TLS Protocol Version Supported (Low)

9 of 15
Weak TLS Protocol Version Supported (Low)
Description
A service on the host was found to support a weak version of the 'Transport Layer Security' (TLS) encryption protocol.
TLS is used to encrypt data in transit between a client and server, and older versions of the protocol (TLS 1.0 and TLS
1.1) have been deprecated in favour of the more secure, newer versions of the protocol (TLS 1.2, TLS 1.3). If an attacker
is able to intercept the communications between the client and the server, they would theoretically be able to decrypt
this communication.
Please note that the complexity and mathematics behind the attack are non-trivial and make it infeasible for all but the
most highly skilled and resourced attackers.
Remediation Advice
The most secure versions of the TLS encryption protocol are TLS 1.2 and TLS 1.3. Where possible, TLS 1.0 and TLS 1.1
should be disabled entirely to avoid the possibility of an attacker downgrading the encryption protocol in use to one of
these older, insecure versions.
Occurrences
First seen

10 of 15
Raw Reconnaissance Data
Target (IP and Hostnames) Port Protocol Service Service info
95.111.195.84 9115 tcp unknown

95-111-195-84.sg-
sin1.upcloud.host
8080 tcp http lighttpd 1.4.55
80, 443 tcp http nginx
22 tcp ssh OpenSSH 8.2p1
Ubuntu
4ubuntu0.3
Ubuntu Linux;
protocol 2.0
69.167.170.48 21 tcp ftp Pure-FTPd

host.flowbee.com
www.flowbee.com
22 tcp ssh OpenSSH 7.4
protocol 2.0
53 tcp domain ISC BIND
9.11.4-P2
RedHat
Enterprise
Linux 7
80, 443 tcp http Apache httpd
110 tcp pop3 Dovecot pop3d
143 tcp imap Dovecot imapd
465, 587 tcp smtp Exim smtpd
4.94.2
993 tcp imaps
995 tcp pop3s
2077 tcp tsrmagt
2078, 2080 tcp http cPanel httpd
unauthorized
2079 tcp idware-router
2082 tcp infowave
2083 tcp radsec
2086 tcp gnunet
2087 tcp eli
2095 tcp nbx-ser
2096 tcp nbx-dir
53 udp domain ISC BIND
9.11.4-P2
RedHat
Enterprise
Linux 7
166.62.76.33 21 tcp ftp Pure-FTPd

ip-166-62-76-
33.ip.secureserver.net
www.cansew.com
22 tcp ssh OpenSSH 5.3
protocol 2.0
80, 443 tcp http Apache httpd
110 tcp pop3 Dovecot pop3d
143 tcp imap Dovecot imapd
465, 587 tcp smtp Exim smtpd
4.93
993 tcp imaps
11 of 15
995 tcp pop3s
1248 tcp hermes
2077 tcp tsrmagt
2078, 2080 tcp http cPanel httpd
unauthorized
2079 tcp idware-router
2082 tcp infowave
2083 tcp radsec
2086 tcp gnunet
2087 tcp eli
2095 tcp nbx-ser
2096 tcp nbx-dir
3306 tcp mysql MySQL 5.6.51-
cll-lve
63112 tcp rpcbind
12 of 15
Scan Info
Targets included in this scan
95.111.195.84 www.cansew.com
www.flowbee.com
Scan timings
This scan ran from 07 Oct 2021 05:13 to 07 Oct 2021 06:47.
13 of 15
About Intruder
Intruder Systems Ltd is an independent security advisory company, specialising in providing continuous security
monitoring for internet-facing web applications and infrastructure.
Intruder consultants have previously worked for Big Four professional services firms, as well as specialist technical
security consultancies. This background has afforded Intruder industry-leading technical skills combined with thorough
professionalism. Intruder consultants have delivered work for government agencies, international financial institutions,
and global retail giants.
Intruder aims to deliver the highest calibre of security assessments in the industry, with a focus on technical excellence,
risks presented in the context of realistic scenarios, and delivered with the utmost quality.
Intruder is Cyber Essentials certified.
Intruder is a CREST accredited Vulnerability Assessment service.
Professional Membership
Intruder is a member of the Cyber-security Information Sharing Partnership.
The Cyber-security Information Sharing Partnership (CiSP), part of CERT-UK, is a joint industry government initiative to
share cyber threat and vulnerability information in order to increase overall situational awareness of the cyber threat
and therefore reduce the impact on UK business.
Intruder is a partner of the Cyber Growth Partnership.
The Cyber Growth Partnership (CGP) is a group composed of representatives from UK industry, government and
academia. The GCP provides oversight and gives strategic guidance to the Government on supporting the development
of the UK cyber security ecosystem.
Credentials
GCHQ Cyber Accelerator Alumni
BT SME Award 2017 – "Securing the Nation": Cyber Security

category
Finalist – UK's Most Innovative Small Cyber Security

Company 2016 – DCMS & techUK
CyLon Accelerator Alumni
14 of 15
 www.intruder.io  contact@intruder.io  intruder_io
15 of 15

IntruderReport - 06 Oct 2021

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

IntruderReport - 06 Oct 2021

Uploaded by

Copyright:

Available Formats

Scan Summary: Phil Golden

Targets: 95.111.195.84, www.cansew.com, www.flowbee.com

Critical High Medium Low

Exposure over time

Differences since last assessment

New issues discovered Previous issues remediated Direction of travel

High 1 High 0  1  50%

Medium 1 Medium 0  1  14%

Web Application Vulnerabilities

Common Mistakes & Misconfigurations

Attack Surface Reduction

Severity Issue details

High Possible Scan Interference

High Sensitive Details Sent Over Unencrypted HTTP Protocol

High Unsupported PHP Version In Use

Medium Database Exposed to the Internet (MySQL)

Medium Email Server Accepts Credentials Without Encryption

Medium Insecure FTP Protocol In Use

Medium JQuery Version In Use Contains Known Vulnerabilities

Medium PHP Version In Use Contains Known Vulnerabilities

Medium Untrusted / Invalid SSL Certificate

Medium Weak SSH Ciphers Supported

Medium Weak SSL Ciphers Supported

Low Weak Integrity Settings For Remote Administration Service (SSH)

Low Weak TLS Protocol Version Supported

Possible Scan Interference (High)

178.79.140.186 (Network scans only)

95.111.195.84 04 Oct 2021 03:03

Sensitive Details Sent Over Unencrypted HTTP Protocol (High)

Path First seen

95.111.195.84 : 8080 (tcp) /login 07 Oct 2021 06:47

Unsupported PHP Version In Use (High)

For further information, please see:

Version First seen

www.cansew.com : 443 (tcp) 7.1.33 04 Oct 2021 14:46

Database Exposed to the Internet (MySQL) (Medium)

Attempt to use default, common or stolen credentials to login

www.cansew.com : 3306 (tcp) 04 Oct 2021 14:46

Email Server Accepts Credentials Without Encryption (Medium)

www.cansew.com : 587 (tcp) 04 Oct 2021 14:46

Insecure FTP Protocol In Use (Medium)

Please see the 'Raw Scanner Output' for further information.

www.cansew.com : 21 (tcp) 04 Oct 2021 14:46

JQuery Version In Use Contains Known Vulnerabilities (Medium)

JQuery is a popular JavaScript library used in web development.

Version First seen

95.111.195.84 : 8080 (tcp) 1.10.2 07 Oct 2021 06:47

PHP Version In Use Contains Known Vulnerabilities (Medium)

Version First seen

www.cansew.com : 443 (tcp) 7.1.33 04 Oct 2021 14:46

Untrusted / Invalid SSL Certificate (Medium)

Is signed by a trusted Certification Authority (CA).

www.cansew.com : 21 (tcp) 04 Oct 2021 14:46

Weak SSH Ciphers Supported (Medium)

For further information please see:

www.cansew.com : 22 (tcp) arcfour 04 Oct 2021 14:46

Weak SSL Ciphers Supported (Medium)

The DES, Triple-DES (3DES), Blowfish, RC4 or MD5 algorithms

Cipher First seen

www.cansew.com : 21 (tcp) ADH-RC4-MD5(128- 04 Oct 2021 14:46

Weak Integrity Settings For Remote Administration Service (SSH) (Low)

The default is normally: