LeakIX - Host 131.0.136.171

Host 131.0.136.171

Colombia

DataWare Sistemas S.A.S.

Software information

Apache Apache

tcp/443 tcp/80

Open SMB file sharing detected

Malicious users exploiting this vulnerability may be able to read and/or write information to shared directories.

This may also include IPC services and lead to remote code execution.

IP: 131.0.136.171
Port: 445

First seen 2024-09-09 14:45
Last seen 2024-12-22 00:48
Open for 103 days
- Severity: high
  Fingerprint: 22420ce026fa767de22ea8c3df37235018002279ccf847a7ccf847a7ccf847a7
```
Found open SMB shares with NT AUTHORITY/ANONYMOUS LOGON
print$
private
IPC$
```
  Found on 2024-12-22 00:48
Create report

Open service 131.0.136.171:445

2024-12-22 00:48
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 5 hours ago by SmbPlugin
Create report
Open service 131.0.136.171:445

2024-12-20 00:57
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 2 days ago by SmbPlugin
Create report
Open service 131.0.136.171:445

2024-12-18 01:41
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 2024-12-18 by SmbPlugin
Create report
Open service 131.0.136.171:445

2024-12-17 20:26
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 2024-12-17 by SmbPlugin
Create report
Open service 131.0.136.171:445

2024-12-15 22:19
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 2024-12-15 by SmbPlugin
Create report
Open service 131.0.136.171:445

2024-12-13 21:59
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 2024-12-13 by SmbPlugin
Create report

Open service 131.0.136.171:80 · app.aveonline.co

2024-12-12 05:02

HTTP/1.1 301 Moved Permanently
Date: Thu, 12 Dec 2024 05:02:21 GMT
Server: Apache
Location: https://app.aveonline.co/
Content-Length: 233
Connection: close
Content-Type: text/html; charset=iso-8859-1

Page title: 301 Moved Permanently

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="https://app.aveonline.co/">here</a>.</p>
</body></html>

Found 2024-12-12 by HttpPlugin

Create report

Open service 131.0.136.171:443 · app.aveonline.co

2024-12-12 05:02

HTTP/1.1 200 OK
Date: Thu, 12 Dec 2024 05:02:23 GMT
Server: Apache
Upgrade: h2
Connection: Upgrade, close
Last-Modified: Wed, 15 Mar 2023 19:30:34 GMT
ETag: "9b7-5f6f560c74ab1"
Accept-Ranges: bytes
Content-Length: 2487
Vary: Accept-Encoding
Content-Type: text/html

Page title: Aveonline

<!DOCTYPE html>
<html lang="es">
  <head>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1" />
    <meta name="description" content="App Aveonline" />
    <link rel="icon" type="image/png" sizes="32x32" href="./favicon-32x32.png" />
    <link rel="icon" type="image/png" sizes="16x16" href="./favicon-16x16.png" />
    <!-- Meta Pixel Code -->
    <script>
      !function(f,b,e,v,n,t,s)
      {if(f.fbq)return;n=f.fbq=function(){n.callMethod?
      n.callMethod.apply(n,arguments):n.queue.push(arguments)};
      if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';
      n.queue=[];t=b.createElement(e);t.async=!0;
      t.src=v;s=b.getElementsByTagName(e)[0];
      s.parentNode.insertBefore(t,s)}(window, document,'script',
      'https://connect.facebook.net/en_US/fbevents.js');
      fbq('init', '967057470786141');
      fbq('track', 'PageView');
    </script>
    <noscript><img height="1" width="1" style="display:none"
      src="https://www.facebook.com/tr?id=967057470786141&ev=PageView&noscript=1"
    /></noscript>
    <!-- End Meta Pixel Code -->
    <!-- Google Tag Manager -->
    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
      new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
      j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
      'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
      })(window,document,'script','dataLayer','GTM-NRKQC8P');</script>
      <!-- End Google Tag Manager -->
      <!-- Google tag (gtag.js) -->
      <script async src="https://www.googletagmanager.com/gtag/js?id=UA-70349315-7"></script>
      <script>
        window.dataLayer = window.dataLayer || [];
        function gtag(){dataLayer.push(arguments);}
        gtag('js', new Date());
        gtag('config', 'UA-70349315-7');
      </script>
    <title>Aveonline</title>
    <script type="module" crossorigin src="./assetsPag/5c9152ea.js"></script>
    <link rel="stylesheet" href="./assetsPag/eda7ec1b.css">
  </head>
  <body class="mx-auto h-full min-h-[600px] w-full">
    <!-- Google Tag Manager (noscript) D => GTM-N45429W, P => GTM-NRKQC8P -->
    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-NRKQC8P"
      height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
      <!-- End Google Tag Manager (noscript) -->
    <div id="app"></div>
  </body>
  
</html>

Found 2024-12-12 by HttpPlugin

Create report

Open service 131.0.136.171:445

2024-12-12 00:39
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 2024-12-12 by SmbPlugin
Create report
Open service 131.0.136.171:445

2024-12-02 00:00
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 2024-12-02 by SmbPlugin
Create report
Open service 131.0.136.171:445

2024-11-29 23:34
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 2024-11-29 by SmbPlugin
Create report
Open service 131.0.136.171:445

2024-11-28 00:26
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 2024-11-28 by SmbPlugin
Create report

*.aveonline.coaveonline.co

Fingerprint:

baf94e3bd58ff046aca0cb6746eb6ca8c8e0d5883fc675fda6687fbfb9c27a10

CN:

*.aveonline.co

Key:

RSA-2048

Issuer:

SSL.com RSA SSL subCA

Not before:

2024-05-16 19:27

Not after:

2025-05-16 19:27

Domain summary

app.aveonline.co 1

1 recorded

Host 131.0.136.171

Colombia

Software information

Open SMB file sharing detected

*.aveonline.coaveonline.co

Domain summary