Public security report
32/100
A means lowest risk and F means highest, like a school report card. How the score is calculated →
Scanned 2026-10-26 · 28 issue(s) found · 10 checks passed
CyberTrust assessed hoyu.edu.hk passively — using only information that is publicly visible on the internet: DNS records, certificates, response headers and reachable services. The result is 32/100, grade F, where A means lowest risk and F means highest, like a school report card.
Email spoofing is possible: no DMARC record was found for hoyu.edu.hk, so anyone can send mail that appears to come from @hoyu.edu.hk.
Strongest area: reputation and credential exposure (100/100). Weakest area: TLS encryption and certificates (0/100).
28 issue(s) need attention (2 critical, 6 high, 7 medium, 13 low), while 10 checks passed.
Infrastructure observed: mail is hosted by google, DNS is served by godaddy, the web server identifies as apache.
21 subdomain(s) of hoyu.edu.hk resolve publicly.
| Area | Score | Grade | Issues |
|---|---|---|---|
| DNS hygiene | 84 | B | 2 |
| email spoofing defences (SPF/DKIM/DMARC) | 44 | F | 3 |
| external attack surface | 0 | F | 5 |
| IP threat intelligence | — | — | 0 |
| reputation and credential exposure | 100 | A | 0 |
| TLS encryption and certificates | 0 | F | 8 |
| HTTP security headers | 0 | F | 10 |
Automated bots continuously scan for MySQL on 103.11.101.95:3306 (hosts: hoyu.edu.hk, www.hoyu.edu.hk, mobilelab.hoyu.edu.hk) and try weak passwords or known exploits; the usual outcome is a full data exfiltration or ransomware wiping.
2 actively exploited vulnerabilities (CVE-2021-40438, CVE-2024-38475) match versions seen on 210.3.239.138; working exploits exist and attackers scan for them at scale.
RC4 is prohibited by standard and has practical attacks that recover plaintext such as cookies.
SSLv3 suffers from POODLE, which can recover plaintext such as cookies and credentials; it is prohibited by standard and offers no compatibility benefit today.
It expired 847 days ago (2024-07-01): browsers show a full-page warning, most visitors leave, and API or app integrations fail without a clear reason.
Without it, spoofed mail is usually delivered as normal and you receive no visibility at all; bulk senders are also required by major mailbox providers to publish DMARC.
356 known vulnerabilities are inferred on 210.3.239.138; even un-weaponised ones leave the system open to every published technique. Version-based inference - treat as a patch-currency signal.
Without it, an attacker can strip SSL on the first HTTP request and keep the user on plaintext (SSL stripping), a common attack on public Wi-Fi.
Visitors who type the bare domain land on an unencrypted connection and submit data in plaintext, with nothing on screen to warn them.
Software php 7.4.11, openssl 1.0.2k appears unsupported: new vulnerabilities will never be patched. (Version-based inference; some distributions backport fixes - confirm with your vendor.)
This certificate is issued for www.hoyu.edu.hk, so browsers warn; typical causes are missing the bare domain, a stale name, or an incomplete SAN list.
This certificate cannot be chained (self-signed), so visitors get a warning - and repeated warnings teach people to click through, which defeats warnings during real attacks.
64-bit block ciphers are vulnerable to SWEET32 after enough data on one connection, and 3DES is no longer accepted by compliance standards.
Versions TLSv1.0, TLSv1.1 are formally deprecated, fail PCI DSS requirements and are no longer supported by modern browsers; they also enable downgrade attacks and fail compliance audits.
FTP on 103.11.101.95:21 (hosts: hoyu.edu.hk, www.hoyu.edu.hk, mobilelab.hoyu.edu.hk) enables ransomware spread (as WannaCry did via SMB), arbitrary file downloads and a pivot into the internal network.
The server does not staple the certificate revocation status. Every revocation check becomes an extra round trip to the CA, which slows the first visit and, if the CA endpoint is unreachable or the visitor's network blocks it, leaves the browser without a usable revocation status.
Without it, any injected script runs: session theft, fake payment forms, or card-skimming scripts on compromised pages. CSP limits the damage even when something else fails.
Exact versions let attackers look up ready-made exploits instead of probing - most intrusions start with a version scan.
Without it a file uploaded as an image can be executed as HTML/JavaScript on your domain, stealing same-site cookies and sessions.
Without it, attackers overlay a transparent frame of your page and trick users into clicking real actions such as transfers or password changes (clickjacking).
POP3 on 103.11.101.95:110 exposes mailbox credentials to anyone capturing traffic; one compromised mailbox is usually used to reset other accounts and phish contacts.
Missing Secure lets cookies travel in plaintext; missing HttpOnly lets injected scripts steal sessions; missing SameSite enables CSRF. Affected: MRBS_SESSID.
Without it any CA may issue certificates for your domain, enabling a lookalike site with a valid padlock.
Without it, attackers can poison caches or forge answers and send visitors to a lookalike server that harvests credentials.
Without it an attacker on the network path can force a downgrade to plaintext and read or modify mail such as contracts and payment details.
Without an enforcing DMARC policy most receivers still deliver forged mail to the inbox.
The policy is too permissive (object-src not restricted), so injected scripts still run while giving a false sense of security.
6 script(s)/stylesheet(s) load over HTTP and can be replaced in transit, letting an attacker act inside a page that looks secure; browsers also hide the padlock.
Everything above is what anyone can observe from the internet. Domain owners who verify ownership additionally get the full asset inventory — every subdomain with its open ports and running services — look-alike and typosquatting domains registered against the brand, credential-exposure monitoring, and copy-paste fixes for each finding.
Verify ownership of hoyu.edu.hk (free) → Open the live interactive report →