tkrz.de security report

Certificate, security headers, email authentication, DNS, registration, and exposed hosts — from public sources.

80risk

Critical

Exposed services or known CVEs need attention now.

1Critical

2High

8Medium

12Low

2Info

Collected 8 hours ago10.1sfrom cache

Certificate Transparency43
DNS resolution16
Network ownership0
CDN / WAF detection0
Exposed ports & CVEs45
Registration
DNS posture4
Email authentication2
Certificate
Security headers5
Archived URLs
Analysis25

noteFound 43 hostnames; this runtime allows 50 outbound requests per scan, so the 21 most likely to matter were resolved.
noteCertificate inspection is unavailable in this runtime.
noteNetwork ownership lookup is unavailable in this runtime; ASN and org are omitted.
noteCDN/WAF detection is unavailable in this runtime.
noteNo registration data: RDAP has no record at this level.

Shodan matched these CVEs against the service banners it saw on 185.64.168.13 (cloud.tkrz.de), which advertise http server 2.4.68. These are version-fingerprint matches, not confirmed exploits: a distribution may have back-ported the fix while leaving the banner unchanged. Severity reflects the volume of known issues associated with this host, not a CVSS score. CVE-2013-4365 CVE-2013-2765 CVE-2013-0942 CVE-2013-0941 CVE-2012-4360 CVE-2012-4001 CVE-2012-3526 CVE-2011-2688 CVE-2011-1176 CVE-2009-2299 CVE-2009-0796 CVE-2007-4723
What to do
Confirm the running versions on 185.64.168.13 and compare them against the current security release for each package before treating any single CVE as live.
CVE-2013-4365 ↗CVE-2013-2765 ↗CVE-2013-0942 ↗CVE-2013-0941 ↗CVE-2012-4360 ↗
asset: 185.64.168.13
Shodan matched these CVEs against the service banners it saw on 185.124.233.193 (tkrz.de), which advertise exim 4.99.4, exim 4.99.5. These are version-fingerprint matches, not confirmed exploits: a distribution may have back-ported the fix while leaving the banner unchanged. Severity reflects the volume of known issues associated with this host, not a CVSS score. CVE-2026-66141 CVE-2026-66140
What to do
Confirm the running versions on 185.124.233.193 and compare them against the current security release for each package before treating any single CVE as live.
CVE-2026-66141 ↗CVE-2026-66140 ↗
asset: 185.124.233.193
Shodan matched these CVEs against the service banners it saw on 185.79.196.29 (mail.lists.tkrz.de), which advertise ntp 3, nginx 1.24.0. These are version-fingerprint matches, not confirmed exploits: a distribution may have back-ported the fix while leaving the banner unchanged. Severity reflects the volume of known issues associated with this host, not a CVSS score. CVE-2025-23419 CVE-2023-44487
What to do
Confirm the running versions on 185.79.196.29 and compare them against the current security release for each package before treating any single CVE as live.
CVE-2025-23419 ↗CVE-2023-44487 ↗
asset: 185.79.196.29
185.124.233.193 (tkrz.de) reports exim 4.99.4, exim 4.99.5. Publishing precise versions lets anyone match the host against a CVE feed without probing it, which is how targets get shortlisted for mass exploitation after a new advisory lands.
What to do
Suppress version tokens in server banners (for example `ServerTokens Prod` in Apache) and keep the packages current.
asset: 185.124.233.193
FTP transmits credentials in cleartext.
What to do
Restrict 21/tcp to a VPN, bastion, or allow-listed source range.
asset: 185.124.233.193:21
Public SSH invites credential stuffing and key brute force.
What to do
Restrict 22/tcp to a VPN, bastion, or allow-listed source range.
asset: 185.124.233.193:22
Public SSH invites credential stuffing and key brute force.
What to do
Restrict 22/tcp to a VPN, bastion, or allow-listed source range.
asset: 91.190.225.179:22
185.79.196.29 (mail.lists.tkrz.de) reports ntp 3, nginx 1.24.0. Publishing precise versions lets anyone match the host against a CVE feed without probing it, which is how targets get shortlisted for mass exploitation after a new advisory lands.
What to do
Suppress version tokens in server banners (for example `ServerTokens Prod` in Apache) and keep the packages current.
asset: 185.79.196.29
185.64.168.13 (cloud.tkrz.de) reports http server 2.4.68. Publishing precise versions lets anyone match the host against a CVE feed without probing it, which is how targets get shortlisted for mass exploitation after a new advisory lands.
What to do
Suppress version tokens in server banners (for example `ServerTokens Prod` in Apache) and keep the packages current.
asset: 185.64.168.13
Public SSH invites credential stuffing and key brute force.
What to do
Restrict 22/tcp to a VPN, bastion, or allow-listed source range.
asset: 185.143.169.245:22
CSP is the main defence that limits what an injected script can do. Without it, any XSS bug is fully exploitable.
What to do
Start with a report-only policy, tighten it against the reports, then enforce.
asset: https://www.tkrz.de/
Check it is not an open relay.
What to do
Restrict 25/tcp to a VPN, bastion, or allow-listed source range.
asset: 185.124.233.193:25
91.190.225.179 (meet.tkrz.de) reports openssh 10.0p2. Publishing precise versions lets anyone match the host against a CVE feed without probing it, which is how targets get shortlisted for mass exploitation after a new advisory lands.
What to do
Suppress version tokens in server banners (for example `ServerTokens Prod` in Apache) and keep the packages current.
asset: 91.190.225.179
217.146.20.125 (mx.cloudmail.tkrz.de) reports outlook web access 15.2.2562. Publishing precise versions lets anyone match the host against a CVE feed without probing it, which is how targets get shortlisted for mass exploitation after a new advisory lands.
What to do
Suppress version tokens in server banners (for example `ServerTokens Prod` in Apache) and keep the packages current.
asset: 217.146.20.125
Check it is not an open relay.
What to do
Restrict 25/tcp to a VPN, bastion, or allow-listed source range.
asset: 217.146.20.125:25
45.82.124.223 (webmail.tkrz.de) reports internet information services 10.0, asp.net 4.0.30319, outlook web access 15.1.2507. Publishing precise versions lets anyone match the host against a CVE feed without probing it, which is how targets get shortlisted for mass exploitation after a new advisory lands.
What to do
Suppress version tokens in server banners (for example `ServerTokens Prod` in Apache) and keep the packages current.
asset: 45.82.124.223
Check it is not an open relay.
What to do
Restrict 25/tcp to a VPN, bastion, or allow-listed source range.
asset: 45.82.124.223:25
Check it is not an open relay.
What to do
Restrict 25/tcp to a VPN, bastion, or allow-listed source range.
asset: 185.64.168.33:25
Check it is not an open relay.
What to do
Restrict 25/tcp to a VPN, bastion, or allow-listed source range.
asset: 185.79.196.29:25
91.190.224.203 (portal.tkrz.de) reports internet information services 10.0. Publishing precise versions lets anyone match the host against a CVE feed without probing it, which is how targets get shortlisted for mass exploitation after a new advisory lands.
What to do
Suppress version tokens in server banners (for example `ServerTokens Prod` in Apache) and keep the packages current.
asset: 91.190.224.203
185.143.169.245 (lg.tkrz.de) reports openssh 10.0p2. Publishing precise versions lets anyone match the host against a CVE feed without probing it, which is how targets get shortlisted for mass exploitation after a new advisory lands.
What to do
Suppress version tokens in server banners (for example `ServerTokens Prod` in Apache) and keep the packages current.
asset: 185.143.169.245
185.64.168.251 (dnsweb.tkrz.de) reports nginx 1.26.3. Publishing precise versions lets anyone match the host against a CVE feed without probing it, which is how targets get shortlisted for mass exploitation after a new advisory lands.
What to do
Suppress version tokens in server banners (for example `ServerTokens Prod` in Apache) and keep the packages current.
asset: 185.64.168.251
Answers for this domain are not signed, so a resolver cannot tell a forged response from a real one.
What to do
Enable DNSSEC at your DNS host and publish the DS record at the registrar.
asset: tkrz.de
Mail to this domain can be downgraded to plaintext by an on-path attacker, because senders have no way to know TLS is required.
What to do
Publish an MTA-STS policy (a TXT record plus a small HTTPS-hosted file).
asset: tkrz.de
Any public certificate authority may issue certificates for this domain. CAA lets you name the ones allowed to.
What to do
Add a CAA record naming your CA, e.g. `0 issue "letsencrypt.org"`.
asset: tkrz.de

final https://www.tkrz.de/status 200time 3385msstack cloudflare · TYPO3 CMS

✓http:// redirects to https://
✓Strict-Transport-Security
max-age=31536000; includeSubDomains
✗Content-Security-Policy
✓Clickjacking protection
SAMEORIGIN
✓X-Content-Type-Options
nosniff
✓Referrer-Policy
no-referrer-when-downgrade
✓Permissions-Policy
geolocation=(), microphone=()
–security.txt publishedoptional — tells researchers where to report bugs

✓Receives mail via 1 server
fw01.tkrz.de
✓SPFends in -all
v=spf1 a:fw01.tkrz.de ip4:185.39.85.56 ip4:46.182.148.120 ip4:89.251.128.98 ip4:89.251.128.37 ip4:89.251.128.97 ip4:185.64.168.28 ip6:2a02:f08:b00b:1000::2 ip6:2a01:4f8:222:a07::2 include:spf.emailsys.net include:spf.protection.outlook.com include:5pf.cows-server.de -all
✓DMARCp=quarantine
v=DMARC1; p=quarantine; rua=mailto:abuse@tkrz.de; ruf=mailto:abuse@tkrz.de
!MTA-STSinbound mail can be downgraded to plaintext

!DNSSECanswers can be forged
–CAAany CA may issue
✓IPv6 (AAAA)
✓4 nameservers
ns1.tkrz.de ns2.tkrz.de ns3.tkrz.de ns4.tkrz.de

Address	Ports	CVEs	Edge	Network
185.124.233.193 tkrz.de +5	2122255380143443465+3	2	direct	—
91.190.225.179 meet.tkrz.de	22804433478522252699090	0	direct	—
217.146.20.125 mx.cloudmail.tkrz.de +1	2580443587993995	0	direct	—
45.82.124.223 webmail.tkrz.de +2	2580443465587	0	direct	—
185.64.168.33 fw01.tkrz.de	25443465500587	0	direct	—
185.79.196.29 mail.lists.tkrz.de +2	2580123443	2	direct	—
91.190.224.203 portal.tkrz.de	80443	0	direct	—
185.64.168.13 cloud.tkrz.de +1	80443	12	direct	—
185.143.169.245 lg.tkrz.de +1	22	0	direct	—
94.16.2.34 pop3.tkrz.de +1	2000	0	direct	—
185.64.168.251 dnsweb.tkrz.de	80	0	direct	—
185.64.186.11 msp.tkrz.de	none known	0	direct	—

Archived URLs

Endpoints the Wayback Machine has kept — config files, backups, scripts. Slow to fetch, so it is here on request.

tkrz.de security report

Critical

Findings

Security headers

Email authentication

DNS

Hosts

Hostnames