Opening the security report for www.erponline.matbao.com
www.erponline.matbao.com
Loading the security report for www.erponline.matbao.com
www.erponline.matbao.com
Is www.erponline.matbao.com Safe? Security Assessment | CyStack
www.erponline.matbao.com
Công Ty Cổ Phần Mắt Bão - Mat Bao Corporation
Industry
Computers, Electronics and Technology / Web Hosting and Domain Names
Origin
Vietnam
Global rank
#905,933
Rank in Vietnam
#17,304
Updated at
U88.9/100
Security level
UnratedProvisional
Data confidence
Low
Scope checked
52%
The score and grade reflect the result recorded at scan time. Review each check and its evidence for the full context.
Is the website “www.erponline.matbao.com” safe?
This report summarizes the security observations recorded for www.erponline.matbao.com at scan time. Review each check and its evidence for the full context.
Does www.erponline.matbao.com show known scam, phishing, or malware signals?
At assessment time, CyStack did not find www.erponline.matbao.com or related infrastructure on any scam, phishing, or malware warning list after checking 5 online reputation sources. This result reflects external observations; it does not guarantee absolute safety or verify the organization’s legal status or reputation.
Compare the security level of each assessed category at a glance.
Network attack surface95.5/100 · Good100% of this category was checked
Web security0/100 · Not enough data0% of this category was checked
Data sources
Data compiled from CyStack cybersecurity monitoring systems
CyStack compiles scan results from its internal cybersecurity monitoring systems, including CyStack VulnScan and CyStack Threat Intelligence, together with publicly available Internet data. The assessment only observes and analyzes information already available; it does not attempt unauthorized access, test passwords, send exploit code, or change or disrupt the assessed system.
These 3 failed checks or warnings have the greatest impact on the result for www.erponline.matbao.com.
DMARC blocking policyThe effective DMARC policy is quarantine.High
Why it matters
A policy of quarantine or reject tells receiving services to move suspicious mail to spam or refuse it. A monitoring-only policy (p=none) records the problem but does not ask receivers to stop spoofed mail.
What to do
After every legitimate sender passes DMARC, move gradually to quarantine and then reject, covering 100% of messages.
Authorized email senders (SPF)No SPF record was found.Medium
Why it matters
Sender Policy Framework (SPF) lists the systems allowed to send email for the domain. Without it, receiving services have less evidence to distinguish legitimate mail from spoofed mail.
What to do
Publish one SPF TXT record that includes every legitimate email service and no unauthorized sender.
Potentially sensitive subdomainsCyStack confirmed at least 172 active DNS subdomains of matbao.com. 17 names may expose sensitive services; discovery was partial, so more may exist.Medium
Why it matters
Names containing admin, development, staging, VPN, database, or monitoring terms may point attackers toward valuable systems. A name alone does not prove exposure, but it identifies a surface that should be reviewed.
What to do
Transport encryption0/100 · Not enough data0% of this category was checked
Threat reputation100/100 · Good100% of this category was checked
Vulnerability and technology risk0/100 · Not enough data0% of this category was checked
Email authentication64.3/100 · Review100% of this category was checked
Data exposure50/100 · Review100% of this category was checked
Domain and DNS hygiene91.7/100 · Good100% of this category was checked
Items to fix or review
This list contains only failed checks and warnings. Checks without enough evidence are grouped separately below.
DMARC blocking policyEmail protectionNeeds review
Check result
The effective DMARC policy is quarantine.
Why it matters
A policy of quarantine or reject tells receiving services to move suspicious mail to spam or refuse it. A monitoring-only policy (p=none) records the problem but does not ask receivers to stop spoofed mail.
What to do
After every legitimate sender passes DMARC, move gradually to quarantine and then reject, covering 100% of messages.
Sender Policy Framework (SPF) lists the systems allowed to send email for the domain. Without it, receiving services have less evidence to distinguish legitimate mail from spoofed mail.
CyStack confirmed at least 172 active DNS subdomains of matbao.com. 17 names may expose sensitive services; discovery was partial, so more may exist.
Why it matters
Names containing admin, development, staging, VPN, database, or monitoring terms may point attackers toward valuable systems. A name alone does not prove exposure, but it identifies a surface that should be reviewed.
27 email exposure records ending in @matbao.com are associated with approximately 8 infected devices. These are intelligence observations; they do not prove that the email accounts are still active or that the devices belong to the organization.
Why it matters
Email routing records (MX)Domain and DNSNeeds review
Check result
No explicit MX or Null MX record was found.
Why it matters
MX records direct incoming email to the correct mail servers. Broken records can stop delivery, while a Null MX clearly tells senders that the domain does not receive email.
A domain should clearly state whether it receives email. Without valid MX records or a Null MX, senders may try an unintended server and delivery behavior becomes unpredictable.
Allowed certificate issuers (CAA)Domain and DNSNeeds review
Check result
Found 0 applicable CAA record(s).
Why it matters
Certificate Authority Authorization (CAA) records state which certificate providers may issue certificates for the domain. This reduces the chance of an unintended provider issuing one.
Inconclusive checks (19)These checks lack reliable evidence. They are neither confirmed issues nor passed checks.
Password form transport securityWebsite protectionUnknown
Check result
The scan could not determine “Password form transport security” from the collected evidence.
Why it matters
If either a password page or the address receiving its form uses HTTP, someone observing the network may read or change the submitted password.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Secure website connection (HTTPS)HTTPS and encryptionUnknown
Check result
The scan could not determine “Secure website connection (HTTPS)” from the collected evidence.
Why it matters
HTTPS encrypts data between visitors and the website and helps prove they reached the intended service. Without it, network observers may read or alter traffic and browsers may show a security warning.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Evidence and check scope
HTTPS port tested:
443
Session cookies protected from scripts (HttpOnly)Website protectionUnknown
Check result
The scan could not determine “Session cookies protected from scripts (HttpOnly)” from the collected evidence.
Why it matters
HttpOnly prevents browser scripts from directly reading a cookie. It does not fix script injection, but it makes theft of session and authentication cookies more difficult.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Cookies sent only over HTTPS (Secure)Website protectionUnknown
Check result
The scan could not determine “Cookies sent only over HTTPS (Secure)” from the collected evidence.
Why it matters
The Secure attribute prevents a browser from sending a cookie over unencrypted HTTP. Without it, session or authentication data may be exposed to someone observing the network.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
The scan could not determine “Cross-site access rules (CORS)” from the collected evidence.
Why it matters
Cross-Origin Resource Sharing (CORS) decides which websites may read responses from this service in a visitor's browser. Rules that trust arbitrary origins, especially with login cookies, can expose private data to another website.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
The scan could not determine “Allowed browser content (CSP)” from the collected evidence.
Why it matters
Content Security Policy (CSP) limits where scripts, styles, frames, and other browser content may come from. A strong policy reduces the impact if an attacker manages to inject content into a page.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
The scan could not determine “Cross-site cookie protection (SameSite)” from the collected evidence.
Why it matters
SameSite limits when a browser includes cookies in requests started by another website. This helps prevent another site from silently making an authenticated request on a user's behalf.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Protection from deceptive framing (clickjacking)Website protectionUnknown
Check result
The scan could not determine “Protection from deceptive framing (clickjacking)” from the collected evidence.
Why it matters
Another website can place this page inside a hidden or misleading frame and trick a user into clicking an unintended action. Frame restrictions tell browsers which sites, if any, may embed the page.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Insecure content on an HTTPS pageWebsite protectionUnknown
Check result
The scan could not determine “Insecure content on an HTTPS page” from the collected evidence.
Why it matters
An HTTPS page can still load scripts, frames, styles, or forms over unencrypted HTTP. An attacker on the network may alter that content and compromise the otherwise secure page.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
The scan could not determine “Correct file-type handling (nosniff)” from the collected evidence.
Why it matters
Without the nosniff setting, a browser may guess a file's type and treat harmless-looking content as executable code. This can turn an incorrect Content-Type into a security issue.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
The scan could not determine “HSTS availability” from the collected evidence.
Why it matters
HTTP Strict Transport Security (HSTS) tells a browser to use HTTPS automatically on future visits. This reduces the chance that a visitor is downgraded to an unencrypted connection.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Automatic redirect to HTTPSHTTPS and encryptionUnknown
Check result
The scan could not determine “Automatic redirect to HTTPS” from the collected evidence.
Why it matters
Visitors may enter an address beginning with HTTP or follow an old link. Redirecting them immediately to HTTPS prevents the rest of the visit from continuing over an unencrypted connection.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Public directory listingSoftware vulnerabilitiesUnknown
Check result
The scan could not determine “Public directory listing” from the collected evidence.
Why it matters
When a web server automatically lists a directory, visitors may discover files that were never linked publicly, including backups, logs, or deployment artifacts.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
The scan could not determine “Browser feature restrictions (Permissions-Policy)” from the collected evidence.
Why it matters
Permissions-Policy controls whether this page and embedded content may use features such as the camera, microphone, and location. Leaving unused features available creates unnecessary access paths.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
The scan could not determine “URL privacy (Referrer-Policy)” from the collected evidence.
Why it matters
When a visitor follows a link, the browser may send the previous page's URL to the destination. Paths and query values in that URL can reveal sensitive context to another website.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
The scan could not determine “HSTS protection period” from the collected evidence.
Why it matters
The max-age value controls how long browsers remember to use HTTPS. A very short period provides limited protection, while includeSubDomains also covers every subdomain and can break one that does not support HTTPS.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
The scan could not determine “Exposed software version” from the collected evidence.
Why it matters
Exact web server or framework versions help attackers quickly look for known weaknesses that may apply. Hiding a version is not a substitute for patching, but unnecessary disclosure gives away useful targeting information.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Technologies visible from the InternetSoftware vulnerabilitiesUnknown
Check result
Technology fingerprints could not be evaluated from the root response.
Why it matters
Response headers, page content, and other public clues suggest which technologies the service uses. These observations help explain the attack surface, but they can be incomplete or mistaken and do not by themselves confirm a vulnerability.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Observed WAF, CDN, or edge serviceSoftware vulnerabilitiesUnknown
Check result
Passive WAF and edge signals were unavailable because no root response was obtained.
Why it matters
Public response details suggest that a Web Application Firewall (WAF), CDN, or other edge service is present. This quick scan identified the provider but did not test whether attack blocking is configured or working correctly.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Informational checks (2)These neutral observations add context and are counted as neither passed checks nor confirmed issues.
Blacklist check coverageIP reputationInformation
Check result
5 providers were definitive and 1 were inconclusive.
Why it matters
This shows how many independent blacklist services returned a clear result. A service that was unavailable was not checked successfully and must not be treated as a clean result.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Observed 0 versioned product(s); 0 had exact CPE mappings and 0 completed lookup(s).
Why it matters
This shows how many detected products had reliable version information and an exact CPE identity, allowing them to be checked against CVE applicability data. A product that could not be checked must not be treated as free of known vulnerabilities.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Evidence and check scope
Complete:
Yes
Software items found:
0
Passed or not applicable (24)
Public DNS recordsDomain and DNS
Check result
The target resolved to 1 public IP address(es).
Why it matters
Public DNS connects the domain to its Internet addresses. Missing or incorrect records can make the service unreachable or send traffic to the wrong system.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Evidence and check scope
IP addresses:
104.199.192.117
Certificate matches the websiteHTTPS and encryptionNot applicable
Check result
The scan recorded “Certificate matches the website” as not applicable.
Why it matters
The certificate must list the exact hostname visitors requested in its Subject Alternative Names (SAN). A mismatch produces browser warnings because the certificate may belong to a different service.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Browser-trusted certificateHTTPS and encryptionNot applicable
Check result
The scan recorded “Browser-trusted certificate” as not applicable.
Why it matters
Browsers trust a website only when its certificate can be traced to a recognized certificate provider. An untrusted certificate causes warnings and prevents visitors from reliably confirming the website's identity.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
No exact product version was observed, so there was no reliable CVE candidate to compare with the CISA Known Exploited Vulnerabilities catalog. This check is not applicable.
Why it matters
A possible CVE match also appears in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means attackers have used that vulnerability in real incidents. The match is urgent to investigate, but the installed software still needs to be confirmed as affected.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Evidence and check scope
Known exploited vulnerabilities:
0
Total known-exploited candidates:
Public management service exposurePublic infrastructure
Check result
No public management service was found on the scanned TCP port set.
Why it matters
Remote administration services such as RDP, VNC, Docker, Kubernetes, and management consoles are high-value targets. Public exposure allows anyone on the Internet to attempt passwords or exploit an unpatched service.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Evidence and check scope
Complete:
Yes
Ports checked:
21, 22, 23, 25, 53, 80, 110, 111, 139, 143… and 48 more
Services selected for identification:
0
Database or cache exposed to the InternetPublic infrastructure
Check result
No public datastore service was found on the scanned TCP port set.
Why it matters
Databases and caches often contain sensitive information and are normally used only by internal applications. Direct Internet access makes password attacks and configuration mistakes much more likely to become a data breach.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Evidence and check scope
Complete:
Yes
Ports checked:
21, 22, 23, 25, 53, 80, 110, 111, 139, 143… and 48 more
Services selected for identification:
0
File-sharing service exposed to the InternetPublic infrastructure
Check result
No public file-sharing service was found on the scanned TCP port set.
Why it matters
Services such as SMB, NFS, and rsync can reveal or modify shared files and have a history of serious vulnerabilities. They rarely need to accept connections directly from the public Internet.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Evidence and check scope
Complete:
Yes
Ports checked:
21, 22, 23, 25, 53, 80, 110, 111, 139, 143… and 48 more
Services selected for identification:
0
Unencrypted legacy servicePublic infrastructure
Check result
No public legacy cleartext service was found on the scanned TCP port set.
Why it matters
Older services such as Telnet, FTP, and unencrypted mail or directory protocols can send passwords and data in readable form. Anyone able to observe the network path may capture them.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Evidence and check scope
Complete:
Yes
Ports checked:
21, 22, 23, 25, 53, 80, 110, 111, 139, 143… and 48 more
Services selected for identification:
0
DNS abuse-list reputationIP reputation
Check result
No independent abuse-list consensus was found across 5 definitive providers.
Why it matters
Security and email providers maintain DNS-based blacklists of IP addresses associated with spam, malware, or compromised systems. Several current, independent listings are a strong reason to investigate, although a shared IP can sometimes affect unrelated customers.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Evidence and check scope
IPv4 addresses checked:
1
Blocklists reporting an issue:
0
Blocklists with no match:
5
Email spoofing protection (DMARC)Email protection
Check result
A DMARC policy was found.
Why it matters
DMARC lets the domain owner tell receiving services what to do when the visible From address is not verified by SPF or DKIM. Without DMARC, attackers have more opportunity to impersonate the domain in phishing email.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
The core DMARC policy tags passed structural validation.
Why it matters
Receiving services may ignore a DMARC record that contains duplicate fields, invalid values, or is published at the wrong DNS name. An ignored record provides no reliable protection from domain impersonation.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
An expired domain stops directing users to the organization's services and may eventually become available to someone else. A domain close to expiry leaves little time to recover from payment or account problems.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Evidence and check scope
Registration expires at:
Days remaining:
598
Domain registration statusDomain and DNS
Check result
RDAP returned 4 status value(s); 0 require attention.
Why it matters
Registrar or registry restrictions such as hold, redemption, or pending deletion can disable the domain. If they are not resolved, the organization may lose control of its website and email identity.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Evidence and check scope
Registration statuses:
client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Certificate expiry and validityHTTPS and encryptionNot applicable
Check result
The scan recorded “Certificate expiry and validity” as not applicable.
Why it matters
A certificate works only between its start and expiry dates. An expired, not-yet-valid, or soon-to-expire certificate can trigger browser warnings and interrupt access to the website or API.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Certificate key and signature strengthHTTPS and encryptionNot applicable
Check result
The scan recorded “Certificate key and signature strength” as not applicable.
Why it matters
The certificate's public key and signature algorithm protect it from forgery. Keys that are too short or signatures based on obsolete algorithms provide less protection against modern attacks.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Supported TLS versionsHTTPS and encryptionNot applicable
Check result
The scan recorded “Supported TLS versions” as not applicable.
Why it matters
TLS 1.0 and TLS 1.1 use outdated security designs and are no longer accepted by modern standards. Leaving them enabled allows older, weaker connection methods.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Potential CVEs for observed versionsSoftware vulnerabilitiesNot applicable
Check result
The scan completed without observing an exact product version that could be matched reliably to CVE records. This check is not applicable; it does not mean the system is free of vulnerabilities.
Why it matters
The detected product and version were compared with vulnerability records from the National Vulnerability Database (NVD). A match is a lead, not confirmation: the installed software may include vendor fixes or may differ from the version visible on the Internet.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Evidence and check scope
Data source:
nvd
Source link:
Complete certificate chainHTTPS and encryptionNot applicable
Check result
The scan recorded “Complete certificate chain” as not applicable.
Why it matters
The server must provide the intermediate certificates that connect its website certificate to a trusted provider. If any are missing, some browsers, mobile devices, or API clients may reject the connection.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
The scan recorded “SPF protection level” as not applicable.
Why it matters
The final SPF rule tells receiving services how confidently they should reject unlisted senders. A permissive result allows more spoofed mail to appear legitimate than a hard fail (-all).
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
The scan recorded “Valid SPF configuration” as not applicable.
Why it matters
More than one SPF record, invalid terms, or too many DNS lookups can make SPF return a permanent error. Receiving services may then be unable to verify authorized senders.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
No public unexpected service was found on the scanned TCP port set.
Why it matters
Every open service can be discovered and attacked and must be configured, monitored, and patched. Services without a clear public purpose add risk without providing business value.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Evidence and check scope
Complete:
Yes
Ports checked:
21, 22, 23, 25, 53, 80, 110, 111, 139, 143… and 48 more
Services selected for identification:
0
DMARC monitoring reportsEmail protection
Check result
Aggregate reporting is configured.
Why it matters
DMARC aggregate reports show which systems send email using the domain and which messages fail verification. They help find both impersonation attempts and legitimate services that need correction.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
DNSSEC adds digital signatures so resolvers can detect forged DNS answers. This quick check confirms the parent domain has a DS record, but it does not validate the complete signature chain.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Authoritative name servers tell visitors where the domain is hosted. Depending on only one server creates a single point of failure for the website and email.
What to do next
Review the recorded evidence with a security specialist before using this result for a current decision.
Remove obsolete DNS names and protect non-public systems with strong authentication, MFA, network allowlists, or a VPN.
Evidence and check scope
Data available:
Yes
Complete:
No
Total:
172
Total is a minimum count:
Yes
List shortened:
No
Sensitive-looking names:
17
Domain in scope:
matbao.com
Scope rule:
Registered-domain scope
Collection-data version:
3
Infostealer intelligence may contain credentials associated with the domain, but it does not prove that an account is current, valid, or still exposed.
What to do
Review the masked evidence and observation time, validate affected accounts and devices, then reset active credentials and sessions, enforce MFA, and remove malware where confirmed.
Evidence and check scope
How exposed email records are matched:
Only email addresses whose domain exactly matches this website
Collection refresh status:
completed
Matching exposed email records:
27
The actual record count may be higher:
No
Estimated infostealer-infected devices:
8
Device count is estimated:
Yes
How to interpret this evidence:
Matched records contain an email address whose domain exactly matches the assessed website's registrable domain. Credential records are intelligence observations, not proof that an account is still active. Estimated victim devices are infostealer infection devices associated with matched records; they are not evidence that those devices are owned or operated by the assessed organization.
Evidence samples available:
Yes
Evidence samples shown:
10
Evidence sample limit:
10
8 additional evidence fields are not shown here.
What to do
Correct unreachable or outdated MX hosts, or publish a Null MX if the domain is not intended to receive email.
What to do
Publish valid MX records for the intended mail servers, or a Null MX if the domain never accepts email.
What to do
Publish CAA records that allow only the certificate providers your organization actually uses.
Industry
Updated at 
Vietnam
