This domain´s SSL Server configuration ready for the Hall of Shame!

Viruses and worms
1

See: https://securityheaders.io/?q=https%3A%2F%2Fservices.horizonhomecare.com%2F
Scan gives similar results over http and https… :o
POODLE and DROWn vulnerable: http://toolbar.netcraft.com/site_report?url=https%3A%2F%2Fservices.horizonhomecare.com%2F
and https://test.drownattack.com/?site= horizonhomecare.com
DNS seems OK: http://www.dnsinspect.com/horizonhomecare.com/1459370304
Custom error: Fail and two warnings: https://services.horizonhomecare.com/
See: https://services.horizonhomecare.com/
Now we get connection time outs.

polonus

2

And another candidate and I do not understand why some server admin does not do these scans on the workfloor :o
Re: http://toolbar.netcraft.com/site_report?url=https://www.sor.no POODLE vulnerable and DROWn vulnerable
and https://securityheaders.io/?q=https%3A%2F%2Fwww.sor.no%2F
and https://test.drownattack.com/?site=https%3A%2F%2Fwww.sor.no%2F
-http://www.sor.no
Detected libraries:
jquery - 1.11.2 : -https://code.jquery.com/jquery-1.11.2.min.js
Info: Severity: medium
https://github.com/jquery/jquery/issues/2432
http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/
jquery - 1.6.4 : -https://cdn.optimizely.com/js/2951300515.js
Info: Severity: medium
http://bugs.jquery.com/ticket/11290
http://research.insecurelabs.org/jquery/test/
Info: Severity: medium
https://github.com/jquery/jquery/issues/2432
http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/
2 vulnerable libraries detected

7 issues here :o see: https://sritest.io/#report/2f383c77-783f-4d3a-a24a-584a19335cd0

More to come Fail and 4 Warnings: https://asafaweb.com/Scan?Url=https%3A%2F%2Fwww.sor.no
4 problems here: http://mxtoolbox.com/domain/www.sor.no/

So all wrong that could go wrong on that servers, one glimmering of hope here: http://www.dnsinspect.com/sor.no/1459374409

polonus (volunteer website security analyst and website error/hunter’

3

Another candidate: http://toolbar.netcraft.com/site_report?url=https://tutanota.com
Re: https://cryptoreport.websecurity.symantec.com/checker/views/certCheck.jsp - BEast vulnerable.
Script running and where it lands: http://www.domxssscanner.com/scan?url=https%3A%2F%2Ftutanota.com%2Fjs%2Fbundle.js

WARNING: Name servers software versions are exposed:
195.253.51.245: “ironDNS Name Server (nameserver-1.3.18, nameserver-1.3.18, r3767) pr-201”
195.253.54.31: “ironDNS Name Server (nameserver-1.3.18, nameserver-1.3.18, r3767) pr-203”
2a01:5b0:0:126::1f: “ironDNS Name Server (nameserver-1.3.18, nameserver-1.3.18, r3767) pr-203”
2a01:5b0:2:56::f5: “ironDNS Name Server (nameserver-1.3.18, nameserver-1.3.18, r3767) pr-201”
Exposing name server’s versions may be risky, when a new vulnerability is found your name servers may be automatically exploited by script kiddies until you patch the system. Learn how to hide version. See: http://www.dnsinspect.com/tutanota.com/1459431615

This should not be online: https://piwik.tutanota.de/ E-status: https://securityheaders.io/?q=https%3A%2F%2Fpiwik.tutanota.de%2F
See: http://www.domxssscanner.com/scan?url=https%3A%2F%2Fpiwik.tutanota.de%2F
lands at jquery.smartbanner.js … associated with the “exploit kit approach,”

Results from scanning URL: -https://piwik.tutanota.de/libs/jquery/jquery.smartbanner.js?cb=0446a2b87d4d94f247cd10a7a3fbb85a
Number of sources found: 18
Number of sinks found: 5

Unique IDs about your web browsing habits have been insecurely sent to third parties.

csedlrdxxxxxxxxxxxxqf0dfg7 piwik.tutanota.de piwik_sessid
Tracker could be tracking safely if the site was secure.

polonus

4

Another one from the https everywhere atlas: https://cryptoreport.websecurity.symantec.com/checker/views/certCheck.jsp
and https://www.eff.org/https-everywhere/atlas/domains/mmonit.com.html
See: http://toolbar.netcraft.com/site_report?url=https://mmonit.com
E Status after redirect from http: https://securityheaders.io/?q=https%3A%2F%2Fmmonit.com%2F
nameserver organisation vulnerable to DROWn: https://test.drownattack.com/?site=whois.networksolutions.com
Only script running: -https://ssl.google-analytics.com/ga.js
BEast vuln: https://cryptoreport.websecurity.symantec.com/checker/views/certCheck.jsp
, where the BaseHTTPRequestHandler for monit agent resides.
Here they seem to find nothing wrong: https://app.webinspector.com/public/reports/51738361
on 1 outgoing link -http://www.tildeslash.com/ : https://cryptoreport.websecurity.symantec.com/checker/views/certCheck.jsp
retirable code there: Detected libraries:
jquery - 1.10.2 : (active1) -http://62.109.39.247/startup/common-files/js/jquery-1.10.2.min.js
Info: Severity: medium
https://github.com/jquery/jquery/issues/2432
http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/
(active) - the library was also found to be active by running code
1 vulnerable library detected

polonus