Netcore/Netis Router Vulnerability Scan Report

This report identifies hosts that are running a vulnerable or backdoored Netis Router with service open (port 53413/udp) and accessible from the Internet.

A writeup regarding the issue by Trend Micro can be found here. In short — if any of these devices are on your network, you most likely want to replace them.

For more details behind the scan methodology and a daily update of global Netis scan statistics please visit our dedicated Netis scan page.

For more information on our scanning efforts, check out our Internet scanning summary page.



  • timestamp
    Time that the IP was probed in UTC+0
  • ip
    The IP address of the device in question
  • port
    Port that the Netis router response came from
  • hostname
    Reverse DNS name of the device in question
  • tag
    Tag describing the type of issue — always 'netis_vulnerability'
  • response
    Response received from the device in question — always 'Login:'
  • asn
    ASN of where the device in question resides
  • geo
    Country where the device in question resides
  • region
    State / Province / Administrative region where the device in question resides
  • city
    City in which the device in question resides


"2014-08-27 16:40:17","",53413,,"netis_vulnerability","Login:",4837,"CN","HEILONGJIANG","HARBIN"
"2014-08-27 16:40:17","",53413,,"netis_vulnerability","Login:",17638,"CN","TIANJIN","TIANJIN"
"2014-08-27 16:40:17","",53413,,"netis_vulnerability","Login:",4134,"CN","CHONGQING","CHONGQING"
"2014-08-27 16:40:17","",53413,,"netis_vulnerability","Login:",4837,"CN","SHANDONG","JINAN"
"2014-08-27 16:40:17","",53413,,"netis_vulnerability","Login:",4837,"CN","HEBEI","SHIJIAZHUANG"
"2014-08-27 16:40:17","",53413,,"netis_vulnerability","Login:",4134,"CN","GUANGDONG","GUANGZHOU"
"2014-08-27 16:40:17","",53413,,"netis_vulnerability","Login:",4837,"CN","CHONGQING","CHONGQING"
"2014-08-27 16:40:17","",53413,,"netis_vulnerability","Login:",4134,"CN","SHAANXI","XI'AN"
"2014-08-27 16:40:17","",53413,,"netis_vulnerability","Login:",4134,"CN","JIANGXI","NANCHANG"

Our 125 Report Types