vnpt.com.vn

Check result

The certificate matches the requested target.

Why it matters

The certificate must list the exact hostname visitors requested in its Subject Alternative Names (SAN). A mismatch produces browser warnings because the certificate may belong to a different service.

What to do

Issue and deploy a certificate whose SAN list includes every public hostname served by this website address.

Data recorded by the system

Certificate domain names:

*.vnpt.com.vn, owa.vnpt.com.vn, mail.vnpt.com.vn, autodiscover.vnpt.com.vn, www.vnpt.com.vn, vnpt.com.vn

Assessed domain:

vnpt.com.vn

Check result

The certificate chains to a trusted root.

Why it matters

Browsers trust a website only when its certificate can be traced to a recognized certificate provider. An untrusted certificate causes warnings and prevents visitors from reliably confirming the website's identity.

What to do

Install a certificate from a provider trusted by common browsers and configure the server to send every required intermediate certificate.

Data recorded by the system

Certificate issuer:

CN=GlobalSign RSA OV SSL CA 2018,O=GlobalSign nv-sa,C=BE

Check result

A TLS handshake succeeded on port 443.

Why it matters

HTTPS encrypts data between visitors and the website and helps prove they reached the intended service. Without it, network observers may read or alter traffic and browsers may show a security warning.

What to do

Provide the entire website over HTTPS using a certificate trusted by common browsers.

Data recorded by the system

Encryption suite:

TLS RSA WITH AES 256 GCM SHA384

IP address:

123.31.36.235

Version:

TLS 1.2

Check result

No matched candidate was listed as a known-exploited vulnerability.

Why it matters

A possible CVE match also appears in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means attackers have used that vulnerability in real incidents. The match is urgent to investigate, but the installed software still needs to be confirmed as affected.

What to do

Verify the installed product immediately and follow the CISA and vendor instructions for mitigation, patching, or upgrading if it is affected.

Data recorded by the system

Possible vulnerabilities:

0

Possible vulnerabilities shown:

0

Total possible vulnerabilities:

0

Complete:

Yes

Vulnerabilities missing complete matching evidence:

Check result

The target resolved to 1 public IP address(es).

Why it matters

Public DNS connects the domain to its Internet addresses. Missing or incorrect records can make the service unreachable or send traffic to the wrong system.

What to do

Make sure the domain resolves only to its intended public IP addresses, and remove private, reserved, or outdated records.

Data recorded by the system

IP addresses:

123.31.36.235

Check result

This check does not apply to the target.

Why it matters

If either a password page or the address receiving its form uses HTTP, someone observing the network may read or change the submitted password.

What to do

Serve every page containing a password field over HTTPS and submit each password form directly to an HTTPS address.

Data recorded by the system

Check result

No public management service was found on the scanned TCP port set.

Why it matters

Remote administration services such as RDP, VNC, Docker, Kubernetes, and management consoles are high-value targets. Public exposure allows anyone on the Internet to attempt passwords or exploit an unpatched service.

What to do

Remove direct Internet access and require a VPN, a hardened access gateway, or trusted source networks; also use MFA where supported.

Data recorded by the system

Complete:

Yes

Fingerprint Complete:

Yes

Fingerprint Identified:

2

Fingerprint Targets:

2

Ports checked:

21, 22, 23, 25, 53, 80, 110, 111, 139, 143, 389, 443, 445, 465, 512, 513, 514, 587, 636, 873, 990, 993, 995, 1,080, 1,433, 1,521, 1,883, 2,049, 2,181, 2,375, 2,376, 3,000, 3,306, 3,389, 5,000, 5,432, 5,601, 5,672, 5,900, 5,984, 6,379, 6,443, 7,001, 7,687, 8,080, 8,443, 8,500, 8,883, 8,888, 9,042, 9,090, 9,200, 10,000, 10,250, 10,255, 11,211, 15,672, 27,017

Check result

No public datastore service was found on the scanned TCP port set.

Why it matters

Databases and caches often contain sensitive information and are normally used only by internal applications. Direct Internet access makes password attacks and configuration mistakes much more likely to become a data breach.

What to do

Listen only on private interfaces, allow connections only from required application systems, and require strong authentication and encryption.

Data recorded by the system

Complete:

Yes

Fingerprint Complete:

Yes

Fingerprint Identified:

2

Fingerprint Targets:

2

Ports checked:

21, 22, 23, 25, 53, 80, 110, 111, 139, 143, 389, 443, 445, 465, 512, 513, 514, 587, 636, 873, 990, 993, 995, 1,080, 1,433, 1,521, 1,883, 2,049, 2,181, 2,375, 2,376, 3,000, 3,306, 3,389, 5,000, 5,432, 5,601, 5,672, 5,900, 5,984, 6,379, 6,443, 7,001, 7,687, 8,080, 8,443, 8,500, 8,883, 8,888, 9,042, 9,090, 9,200, 10,000, 10,250, 10,255, 11,211, 15,672, 27,017

Check result

No public file-sharing service was found on the scanned TCP port set.

Why it matters

Services such as SMB, NFS, and rsync can reveal or modify shared files and have a history of serious vulnerabilities. They rarely need to accept connections directly from the public Internet.

What to do

Limit file-sharing services to private networks or a tightly controlled VPN, and allow only the users and systems that require access.

Data recorded by the system

Complete:

Yes

Fingerprint Complete:

Yes

Fingerprint Identified:

2

Fingerprint Targets:

2

Ports checked:

21, 22, 23, 25, 53, 80, 110, 111, 139, 143, 389, 443, 445, 465, 512, 513, 514, 587, 636, 873, 990, 993, 995, 1,080, 1,433, 1,521, 1,883, 2,049, 2,181, 2,375, 2,376, 3,000, 3,306, 3,389, 5,000, 5,432, 5,601, 5,672, 5,900, 5,984, 6,379, 6,443, 7,001, 7,687, 8,080, 8,443, 8,500, 8,883, 8,888, 9,042, 9,090, 9,200, 10,000, 10,250, 10,255, 11,211, 15,672, 27,017

Check result

No public legacy cleartext service was found on the scanned TCP port set.

Why it matters

Older services such as Telnet, FTP, and unencrypted mail or directory protocols can send passwords and data in readable form. Anyone able to observe the network path may capture them.

What to do

Disable the legacy service or replace it with an encrypted alternative such as SSH, SFTP, HTTPS, or the secure version of the mail protocol.

Data recorded by the system

Complete:

Yes

Fingerprint Complete:

Yes

Fingerprint Identified:

2

Fingerprint Targets:

2

Ports checked:

21, 22, 23, 25, 53, 80, 110, 111, 139, 143, 389, 443, 445, 465, 512, 513, 514, 587, 636, 873, 990, 993, 995, 1,080, 1,433, 1,521, 1,883, 2,049, 2,181, 2,375, 2,376, 3,000, 3,306, 3,389, 5,000, 5,432, 5,601, 5,672, 5,900, 5,984, 6,379, 6,443, 7,001, 7,687, 8,080, 8,443, 8,500, 8,883, 8,888, 9,042, 9,090, 9,200, 10,000, 10,250, 10,255, 11,211, 15,672, 27,017

Check result

No issue was found by this check.

Why it matters

Cross-Origin Resource Sharing (CORS) decides which websites may read responses from this service in a visitor's browser. Rules that trust arbitrary origins, especially with login cookies, can expose private data to another website.

What to do

Allow only explicitly trusted websites, compare the Origin value with an exact approved list, and never allow login credentials with the wildcard origin (*).

Data recorded by the system

Arbitrary origin accepted:

No

Credentials allowed:

No

Allows all origins:

No

Check result

The certificate is valid from 2025-08-06T09:02:07Z to 2026-09-07T09:02:06Z.

Why it matters

A certificate works only between its start and expiry dates. An expired, not-yet-valid, or soon-to-expire certificate can trigger browser warnings and interrupt access to the website or API.

What to do

Use automatic renewal, monitor renewal failures, and alert the responsible team well before expiry.

Data recorded by the system

Days remaining:

47.7

Expires at:

Sep 07, 2026, 04:02 PM GMT+7

Valid from:

Aug 06, 2025, 04:02 PM GMT+7

Check result

The certificate uses SHA256-RSA with a 2048-bit public key.

Why it matters

The certificate's public key and signature algorithm protect it from forgery. Keys that are too short or signatures based on obsolete algorithms provide less protection against modern attacks.

What to do

Use RSA with at least 2048 bits or a modern elliptic-curve key, and use SHA-256 or a stronger signature algorithm.

Data recorded by the system

Public-key algorithm:

RSA

Public-key size:

2,048

Signature algorithm:

SHA256-RSA

Check result

No independent abuse-list consensus was found across 5 definitive providers.

Why it matters

Security and email providers maintain DNS-based blacklists of IP addresses associated with spam, malware, or compromised systems. Several current, independent listings are a strong reason to investigate, although a shared IP can sometimes affect unrelated customers.

What to do

Verify each listing against the affected IP, investigate mail and host activity, fix the underlying cause, and then follow the provider's removal process.

Data recorded by the system

Blocklists with no match:

5

Confirmed blocklist matches:

No

Blocklists checked conclusively:

5

Blocklists unavailable:

1

IPv4 addresses checked:

Check result

No potentially applicable CVE was returned for 1 exact versioned product(s).

Why it matters

The detected product and version were compared with vulnerability records from the National Vulnerability Database (NVD). A match is a lead, not confirmation: the installed software may include vendor fixes or may differ from the version visible on the Internet.

What to do

Confirm the exact installed package and read the vendor advisory. If that installation is affected, apply the vendor patch or upgrade to a fixed version.

Data recorded by the system

Possible vulnerabilities:

0

Possible vulnerabilities shown:

0

Total possible vulnerabilities:

0

Complete:

Yes

Vulnerabilities missing complete matching evidence:

Check result

This check does not apply to the target.

Why it matters

HttpOnly prevents browser scripts from directly reading a cookie. It does not fix script injection, but it makes theft of session and authentication cookies more difficult.

What to do

Set HttpOnly on session and authentication cookies unless the application has a documented need to read them in browser code.

Check result

This check does not apply to the target.

Why it matters

The Secure attribute prevents a browser from sending a cookie over unencrypted HTTP. Without it, session or authentication data may be exposed to someone observing the network.

What to do

Set Secure on every session, authentication, and other sensitive cookie served by the HTTPS application.

Check result

This check does not apply to the target.

Why it matters

A policy of quarantine or reject tells receiving services to move suspicious mail to spam or refuse it. A monitoring-only policy (p=none) records the problem but does not ask receivers to stop spoofed mail.

What to do

After every legitimate sender passes DMARC, move gradually to quarantine and then reject, covering 100% of messages.

References

Check result

This check does not apply to the target.

Why it matters

Receiving services may ignore a DMARC record that contains duplicate fields, invalid values, or is published at the wrong DNS name. An ignored record provides no reliable protection from domain impersonation.

What to do

Publish one valid DMARC record at _dmarc and correct duplicate fields, unsupported values, and invalid report addresses.

References

Check result

No issue was found by this check.

Why it matters

An HTTPS page can still load scripts, frames, styles, or forms over unencrypted HTTP. An attacker on the network may alter that content and compromise the otherwise secure page.

What to do

Load every script, frame, stylesheet, and form destination over HTTPS, and remove or replace resources that do not support it.

Data recorded by the system

Insecure page resources:

0

Check result

The server presented 2 certificate(s).

Why it matters

The server must provide the intermediate certificates that connect its website certificate to a trusted provider. If any are missing, some browsers, mobile devices, or API clients may reject the connection.

What to do

Configure the server to send the website certificate followed by every required intermediate certificate, but not the root certificate.

Data recorded by the system

Certificates in the chain:

2

Check result

The HTTP root redirects to HTTPS within the target domain.

Why it matters

Visitors may enter an address beginning with HTTP or follow an old link. Redirecting them immediately to HTTPS prevents the rest of the visit from continuing over an unencrypted connection.

What to do

Redirect every HTTP URL directly to its corresponding HTTPS URL without passing through another HTTP address.

Data recorded by the system

Final connection:

https

Website reachable:

Yes

Redirects followed:

1

Check result

The root page did not match a common automatic directory-index pattern.

Why it matters

When a web server automatically lists a directory, visitors may discover files that were never linked publicly, including backups, logs, or deployment artifacts.

What to do

Disable automatic directory indexes unless public file browsing is an intentional feature, and remove sensitive files from web-accessible folders.

Data recorded by the system

Directory listing pattern found:

No

Homepage only:

Yes

Check result

Found 1 MX record(s); 0 target(s) were invalid.

Why it matters

MX records direct incoming email to the correct mail servers. Broken records can stop delivery, while a Null MX clearly tells senders that the domain does not receive email.

What to do

Correct unreachable or outdated MX hosts, or publish a Null MX if the domain is not intended to receive email.

Data recorded by the system

Does not receive email:

No

Check result

This check does not apply to the target.

Why it matters

SameSite limits when a browser includes cookies in requests started by another website. This helps prevent another site from silently making an authenticated request on a user's behalf.

What to do

Use SameSite=Lax or Strict by default. Use SameSite=None only for a required cross-site flow and always combine it with Secure.

Check result

This check does not apply to the target.

Why it matters

The final SPF rule tells receiving services how confidently they should reject unlisted senders. A permissive result allows more spoofed mail to appear legitimate than a hard fail (-all).

What to do

Confirm that every legitimate sender is included, then end the SPF record with -all.

References

Check result

This check does not apply to the target.

Why it matters

More than one SPF record, invalid terms, or too many DNS lookups can make SPF return a permanent error. Receiving services may then be unable to verify authorized senders.

What to do

Keep one valid SPF record, remove invalid terms, and remain within the SPF limit of ten DNS-based lookups.

References

Check result

No public unexpected service was found on the scanned TCP port set.

Why it matters

Every open service can be discovered and attacked and must be configured, monitored, and patched. Services without a clear public purpose add risk without providing business value.

What to do

Confirm the owner and purpose of every open port, then stop or firewall any service that is not intentionally public.

Data recorded by the system

Complete:

Yes

Fingerprint Complete:

Yes

Fingerprint Identified:

2

Fingerprint Targets:

2

Ports checked:

21, 22, 23, 25, 53, 80, 110, 111, 139, 143, 389, 443, 445, 465, 512, 513, 514, 587, 636, 873, 990, 993, 995, 1,080, 1,433, 1,521, 1,883, 2,049, 2,181, 2,375, 2,376, 3,000, 3,306, 3,389, 5,000, 5,432, 5,601, 5,672, 5,900, 5,984, 6,379, 6,443, 7,001, 7,687, 8,080, 8,443, 8,500, 8,883, 8,888, 9,042, 9,090, 9,200, 10,000, 10,250, 10,255, 11,211, 15,672, 27,017

Check result

No issue was found by this check.

Why it matters

Exact web server or framework versions help attackers quickly look for known weaknesses that may apply. Hiding a version is not a substitute for patching, but unnecessary disclosure gives away useful targeting information.

What to do

Remove unnecessary version details from Server, X-Powered-By, error pages, and application metadata, and keep the software patched.

Check result

Found 1 MX record(s); 0 target(s) were invalid.

Why it matters

A domain should clearly state whether it receives email. Without valid MX records or a Null MX, senders may try an unintended server and delivery behavior becomes unpredictable.

What to do

Publish valid MX records for the intended mail servers, or a Null MX if the domain never accepts email.

Data recorded by the system

Does not receive email:

No

Check result

Found 2 authoritative name server(s).

Why it matters

Authoritative name servers tell visitors where the domain is hosted. Depending on only one server creates a single point of failure for the website and email.

What to do

Use at least two authoritative name servers, preferably on independent and resilient infrastructure.

Data recorded by the system

DNS servers:

hcm-server1.vnn.vn, vdc-hn01.vnn.vn

Check result

This check does not apply to the target.

Why it matters

The max-age value controls how long browsers remember to use HTTPS. A very short period provides limited protection, while includeSubDomains also covers every subdomain and can break one that does not support HTTPS.

What to do

Use a long max-age, and add includeSubDomains only after confirming that every active subdomain works correctly over HTTPS.

Check result

This check does not apply to the target.

Why it matters

DMARC aggregate reports show which systems send email using the domain and which messages fail verification. They help find both impersonation attempts and legitimate services that need correction.

What to do

Add an aggregate report address (rua) that is protected and monitored, or use a trusted DMARC reporting service.

References

Check result

5 providers were definitive and 1 were inconclusive.

Why it matters

This shows how many independent blacklist services returned a clear result. A service that was unavailable was not checked successfully and must not be treated as a clean result.

Data recorded by the system

Blocklists with no match:

5

Confirmed blocklist matches:

No

Blocklists checked conclusively:

5

Blocklists unavailable:

1

IPv4 addresses checked:

1

Blocklists reporting an issue:

Check result

Public signals from the website and its open services revealed 9 technology item(s).

Why it matters

Response headers, page content, and other public clues suggest which technologies the service uses. These observations help explain the attack surface, but they can be incomplete or mistaken and do not by themselves confirm a vulnerability.

Data recorded by the system

Technologies found:

9

Detection method:

Website and exposed-service analysis

Root Response Count:

7

Service Inventory Complete:

Yes

Service Inventory Count:

9

Check result

No WAF, CDN, or edge product matched the passive root-response signals; this does not prove that protection is absent.

Why it matters

Public response details suggest that a Web Application Firewall (WAF), CDN, or other edge service is present. This quick scan identified the provider but did not test whether attack blocking is configured or working correctly.

Data recorded by the system

Protection detected:

No

Detection method:

Web response signals

Check result

Observed 1 versioned product(s); 1 had exact CPE mappings and 1 completed lookup(s).

Why it matters

This shows how many detected products had reliable version information and an exact CPE identity, allowing them to be checked against CVE applicability data. A product that could not be checked must not be treated as free of known vulnerabilities.

Data recorded by the system

Possible vulnerabilities:

0

Possible vulnerabilities shown:

0

Total possible vulnerabilities:

0

Complete:

Yes

Vulnerabilities missing complete matching evidence:

0