SSL POODLE Report

LAST UPDATED:  2021-11-12

This report identifies hosts that allow the use of SSL v3.0 with cipher-block chaining (CBC) mode ciphers, which are vulnerable to the POODLE (Padding Oracle On Downgraded Legacy Encryption) attack.

See US-CERT alert TA14-290A at: https://www.us-cert.gov/ncas/alerts/TA14-290A for more information on this vulnerability and exploit.

For more details behind the scan methodology and a daily update of global SSL POODLE scan statistics please visit our dedicated SSL POODLE scan page.

For more information on our scanning efforts, check out our Internet scanning summary page.

Filenames: scan_ssl_poodle, scan6_ssl_poodle

Fields

  • timestamp
    Time that the IP was probed in UTC+0
  • ip
    The IP address of the device in question
  • port
    Port that the SSL response came from
  • hostname
    Reverse DNS name of the device in question
  • tag
    Report tag (SSL)
  • handshake
    The highest SSL handshake that could be negotiated (TLSv1.2, TLSv1.1, TLSv1.0, SSLv3)
  • asn
    ASN of where the device in question resides
  • geo
    Country where the device in question resides
  • region
    State / Province / Administrative region where the device in question resides
  • city
    City in which the device in question resides
  • cipher_suite
    The highest CipherSuite that was able to be negotiated
  • ssl_poodle
    If "Y", then the device completed an SSLv3 handshake that used CBC (Cipher-Block Chaining) CipherSuites, which is vulnerable to a POODLE attack
  • cert_length
    Certificate Key Length (1024 bit, 2048 bit, etc)
  • subject_common_name
    The Common Name (CN) of the SSL certificate
  • issuer_common_name
    The Common Name of the entity that signed the SSL certificate
  • cert_issue_date
    Date when the SSL certificate became valid
  • cert_expiration_date
    Date when the SSL certificate expires

Sample

"timestamp","ip","port","hostname","tag","handshake","asn","geo","region","city","cipher_suite","ssl_poodle","cert_length","subject_common_name","issuer_common_name","cert_issue_date","cert_expiration_date"
"2014-11-16 03:13:52","87.228.223.89",443,"87-223-89.netrunf.cytanet.com.cy","ssl","TLSv1.0",6866,"CY",1,"NICOSIA","TLS_RSA_WITH_RC4_128_SHA","Y",1024,"Thomson TG585 v7","Thomson TG585 v7","Jan  1 00:00:00 2005 GMT","Dec 31 00:00:00 2024 GMT"
"2014-11-16 03:13:52","119.161.34.219",443,,"ssl","TLSv1.0",55455,"AU","NSW","NORTH RYDE","TLS_RSA_WITH_AES_128_CBC_SHA","Y",2048,"*.vmareturns.com.au","Go Daddy Secure Certification Authority","Jul  2 23:17:47 2013 GMT","Aug  1 22:28:50 2015 GMT"
"2014-11-16 03:13:52","201.212.8.219",443,"octodata2.jedy.com.ar","ssl","TLSv1.0",10481,"AR","C","BUENOS AIRES","TLS_RSA_WITH_RC4_128_SHA","Y",1024,"iDRAC6 default certificate","iDRAC6 default certificate","Sep 17 22:47:28 2009 GMT","Sep 15 22:47:28 2019 GMT"
"2014-11-16 03:13:52","2.34.252.97",443,"net-2-34-252-97.cust.vodafonedsl.it","ssl","TLSv1.0",30722,"IT","PD","PADOVA","TLS_RSA_WITH_RC4_128_SHA","Y",2048,"*.mynet.vodafone.it","Vodafone (Secure Networks)","May 16 09:07:08 2014 GMT","May 16 09:07:08 2017 GMT"
"2014-11-16 03:13:52","86.13.183.194",443,"cpc10-colc7-2-0-cust961.7-4.cable.virginm.net","ssl","TLSv1.0",5089,"UK","ESS","COLCHESTER","TLS_RSA_WITH_RC4_128_SHA","Y",1024,"*.device465170.wd2go.com","remotewd.com","Feb  8 22:14:03 2013 GMT","Feb  8 22:14:03 2023 GMT"
"2014-11-16 03:13:52","99.16.128.48",443,"99-16-128-48.lightspeed.crlkil.sbcglobal.net","ssl","TLSv1.0",7018,"US","IL","HINSDALE","TLS_RSA_WITH_RC4_128_SHA","Y",1024,,,"Oct 29 11:33:21 2009 GMT","Oct 29 11:33:21 2010 GMT"
"2014-11-16 03:13:52","103.11.19.76",443,"apps.moko04.com","ssl","TLSv1.2",23818,"JP",13,"TOKYO","TLS_RSA_WITH_RC4_128_SHA","Y",1024,"apps.zlpad04.com","apps.zlpad04.com","Jun 10 11:19:19 2014 GMT","Jun 10 11:19:19 2015 GMT"
"2014-11-16 03:13:52","150.101.206.116",443,"eth885.nsw.adsl.internode.on.net","ssl","TLSv1.2",4739,"AU","NSW","SYDNEY","TLS_RSA_WITH_RC4_128_SHA","Y",1024,"FWF40C3913009779","support","Sep 17 15:38:30 2013 GMT","Jan 19 03:14:07 2038 GMT"
"2014-11-16 03:13:52","93.200.56.232",443,"p5dc838e8.dip0.t-ipconnect.de","ssl","TLSv1.0",3320,"DE","NW","COLOGNE","TLS_RSA_WITH_RC4_128_SHA","Y",1024,"FirstCleanKoeln.homelinux.org","FirstCleanKoeln.homelinux.org","Jan  1 00:00:20 2000 GMT","Mar 18 00:00:20 2015 GMT"
"2014-11-16 03:13:52","99.66.112.150",443,"99-66-112-150.lightspeed.cicril.sbcglobal.net","ssl","TLSv1.0",7018,"US","IL","LINCOLNWOOD","TLS_RSA_WITH_RC4_128_SHA","Y",1024,,,"Oct 29 11:33:21 2009 GMT","Oct 29 11:33:21 2010 GMT"
"2014-11-16 03:13:52","188.66.80.115",443,"mail.ccsltd.co.uk","ssl","TLSv1.0",31655,"UK","BEN","WEMBLEY","TLS_RSA_WITH_AES_128_CBC_SHA","Y",2048,"remote.ccsukltd.co.uk","RapidSSL CA","Jan  6 05:14:19 2013 GMT","Feb  8 10:31:47 2015 GMT"

Our 134 Report Types

« Back to Network Reporting