| Domain | Risk Score | Redirect Info | SSL Info | Critical Findings | Compliance | Infrastructure |
|---|---|---|---|---|---|---|
|
blog.example-customer-10.com
Final URL:
https://blog.example-customer-10.com/
Final IP:
203.0.113.10
(Denmark)
🇩🇰 example-customer-08.com (Web hosting)
|
72
|
IP:
203.0.113.10
(Denmark)
HTTP→HTTPS
Same domain redirect
|
Certificate Validity
Issued:
2026-04-13 08:26
Expires:
2026-07-12 08:26
Duration:
89 days
Issuer:
Let's Encrypt
Subject Alternative Names
2
*.example-customer.se
example-customer-11.com
|
Web 58 / Scripts 0 / Beacons 0
Critical CVEs
Web evidence findings
|
GDPR
ePrivacy / PECR
|
80
443
|
|
www.example-customer-12.com
Final URL:
https://www.example-customer-12.com/
Final IP:
203.0.113.11
(Netherlands)
🇳🇱 Microsoft Azure
|
83
|
IP:
203.0.113.11
(Netherlands)
HTTP→HTTPS
Same domain redirect
|
Certificate Validity
Issued:
2026-04-14 04:49
Expires:
2026-07-13 04:49
Duration:
89 days
Issuer:
Let's Encrypt
Subject Alternative Names
4
example-customer-13.com
example-customer-14.com
www.example-customer-12.com
www.example-customer-15.com
|
Web 41 / Scripts 0 / Beacons 0
Web evidence findings
|
GDPR
ePrivacy / PECR
CLOUD Act
Conflict Detected
|
80
443
|
|
www.example-customer-16.com
Final URL:
http://www.example-customer-16.com/
Final IP:
203.0.113.12
(Sweden)
🇸🇪 Sweden
|
56
|
IP:
203.0.113.12
(Sweden)
Same-domain
Same domain redirect
|
Certificate Validity
Issued:
2026-02-17 20:29
Expires:
2027-03-21 20:29
Duration:
396 days
Issuer:
GlobalSign nv-sa
Subject Alternative Names
2
*.example-service.se
example-customer-17.com
|
Web 29 / Scripts 0 / Beacons 0
Critical CVEs
SSH Exposed
|
GDPR
ePrivacy / PECR
|
22
80
443
|
|
www.example-customer-18.com
Final URL:
http://www.example-customer-18.com/
Final IP:
203.0.113.10
(Denmark)
🇩🇰 example-customer-08.com (Web hosting)
|
85
|
IP:
203.0.113.10
(Denmark)
Same-domain
Same domain redirect
|
No SSL Certificate
|
No critical issues
|
GDPR
ePrivacy / PECR
|
No open ports
|
|
www.example-customer-19.com
Final URL:
https://www.example-customer-19.com/
Final IP:
203.0.113.13
(Sweden)
🇸🇪 Sweden
|
76
|
IP:
203.0.113.13
(Sweden)
HTTP→HTTPS
Same domain redirect
|
Certificate Validity
Issued:
2026-05-25 12:45
Expires:
2026-08-23 12:45
Duration:
89 days
Issuer:
Let's Encrypt
Subject Alternative Names
1
www.example-customer-19.com
|
Web 40 / Scripts 4 / Beacons 0
Web evidence findings
|
GDPR
ePrivacy / PECR
|
80
443
|
|
www.example-customer-20.com
Final IP:
unknown
(Unknown)
🌍 Unknown
|
N/A
|
IP:
unknown
(Unknown)
|
Offline
|
Offline
|
No major laws
|
Offline
|
This tab is now ordered by practical remediation value: confirmed CVE matches first, emerging/zero-day exposure second, then the broader security score context.
| Domain | CVE Score | Software/Service | Highest CVE | Latest CVE | Matched CVEs |
|---|---|---|---|---|---|
| blog.example-customer-10.com | 0 | PHP (8.5.6) |
CVE-2026-7261
🔺 Highest Score 9.8 CRITICAL In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, a ... |
CVE-2026-7568
📅 Most Recent 7.5 HIGH In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, a ... |
10
for this server/software/version |
| www.example-customer-16.com | 0 | OpenSSH (7.4) |
CVE-2016-10012
🔺 Highest Score 7.8 HIGH The shared memory manager (associated with pre-authentication compression) in ss ... |
CVE-2023-35812
📅 Most Recent 5.3 MEDIUM An issue was discovered in the Amazon Linux packages of OpenSSH 7.4 for Amazon L ... |
6
for this server/software/version |
| www.example-customer-16.com | 0 | Apache HTTP Server (2.4.52) |
CVE-2022-23943
🔺 Highest Score 9.8 CRITICAL Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an att ... |
CVE-2022-23943
📅 Most Recent 9.8 CRITICAL Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an att ... |
4
for this server/software/version |
| www.example-customer-16.com | 0 | PHP (7.4.26) |
CVE-2021-21707
🔺 Highest Score 5.3 MEDIUM In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, c ... |
CVE-2021-21707
📅 Most Recent 5.3 MEDIUM In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, c ... |
1
for this server/software/version |
| Domain | Overall Score | CVE Score | Infrastructure | DNS | Headers | Methods | Cookies | TLS | Compliance | Risk Level | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| blog.example-customer-10.com |
72
Grade: C
|
0 | 100 | 63 | 100 | 80 | 50 | 100 | 90 | 100 | CRITICAL |
| www.example-customer-12.com |
83
Grade: B
|
100 | 100 | 43 | 0 | 60 | 100 | 100 | 90 | 75 | LOW |
| www.example-customer-16.com |
56
Grade: F
|
0 | 85 | 17 | 0 | 30 | 100 | 100 | 50 | 60 | CRITICAL |
| www.example-customer-18.com |
85
Grade: B
|
100 | 100 | 63 | 100 | 0 | 100 | 100 | 100 | 85 | LOW |
| www.example-customer-19.com |
76
Grade: C
|
100 | 100 | 57 | 70 | 30 | 100 | 85 | 90 | 85 | MEDIUM |
This tab is a risk and evidence review, not a legal verdict. It helps identify where suppliers, cookies, tracking, email processing, DNS providers, nameservers or hosting location may need policy or legal review.
| Domain | Port | Score | Status | Consent Signals | Pre-consent Tracking | Issues / Recommendations |
|---|---|---|---|---|---|---|
| www.example-customer-19.com | HTTP 80 | 25 | HIGH RISK |
No CMP signature detected
Accept
ePrivacy/GDPR applicable context
|
1 signal(s)
JSESSIONID |
• Tracking or analytics cookies are set in the initial response before explicit consent can be verified.
• Accept control was detected, but no equally clear reject/necessary-only control was detected.
• Cookie/consent text was detected, but no manage/preferences control was found.
+1 more issue(s)
Next: Block analytics, advertising, replay and tracking cookies until the visitor actively accepts the relevant category.
|
| www.example-customer-19.com | HTTPS 443 | 25 | HIGH RISK |
No CMP signature detected
Accept
ePrivacy/GDPR applicable context
|
1 signal(s)
JSESSIONID |
• Tracking or analytics cookies are set in the initial response before explicit consent can be verified.
• Accept control was detected, but no equally clear reject/necessary-only control was detected.
• Cookie/consent text was detected, but no manage/preferences control was found.
+1 more issue(s)
Next: Block analytics, advertising, replay and tracking cookies until the visitor actively accepts the relevant category.
|
| blog.example-customer-10.com | HTTP 80 | 100 | VERIFY |
No CMP signature detected
No clear controls detected
ePrivacy/GDPR applicable context
|
None obvious in initial response |
• GDPR/ePrivacy context is likely, but no consent controls were visible in the passive HTML. Missing Reject, Manage choices and Withdrawal controls cannot be confirmed without browser execution.
Next: Use browser verification to confirm whether Reject/Necessary-only, Manage choices and withdrawal controls actually work. Scantide Observe can be used for this live browser verification.
|
| blog.example-customer-10.com | HTTPS 443 | 100 | VERIFY |
No CMP signature detected
No clear controls detected
ePrivacy/GDPR applicable context
|
None obvious in initial response |
• GDPR/ePrivacy context is likely, but no consent controls were visible in the passive HTML. Missing Reject, Manage choices and Withdrawal controls cannot be confirmed without browser execution.
Next: Use browser verification to confirm whether Reject/Necessary-only, Manage choices and withdrawal controls actually work. Scantide Observe can be used for this live browser verification.
|
| www.example-customer-12.com | HTTP 80 | 100 | VERIFY |
No CMP signature detected
No clear controls detected
ePrivacy/GDPR applicable context
|
None obvious in initial response |
• GDPR/ePrivacy context is likely, but no consent controls were visible in the passive HTML. Missing Reject, Manage choices and Withdrawal controls cannot be confirmed without browser execution.
Next: Use browser verification to confirm whether Reject/Necessary-only, Manage choices and withdrawal controls actually work. Scantide Observe can be used for this live browser verification.
|
| www.example-customer-12.com | HTTPS 443 | 100 | VERIFY |
No CMP signature detected
No clear controls detected
ePrivacy/GDPR applicable context
|
None obvious in initial response |
• GDPR/ePrivacy context is likely, but no consent controls were visible in the passive HTML. Missing Reject, Manage choices and Withdrawal controls cannot be confirmed without browser execution.
Next: Use browser verification to confirm whether Reject/Necessary-only, Manage choices and withdrawal controls actually work. Scantide Observe can be used for this live browser verification.
|
| www.example-customer-16.com | HTTP 80 | 100 | VERIFY |
No CMP signature detected
Manage
ePrivacy/GDPR applicable context
|
None obvious in initial response |
• Consent controls were detected in the returned page, but no known CMP signature was identified. A passive scan can see the control text but cannot verify whether the controls actually apply consent choices.
• Visible consent controls were detected. This passive scan cannot click Accept, Reject/Necessary-only, Manage choices or Withdrawal controls, so their behavior still requires browser verification.
Next: Use browser verification to confirm whether Reject/Necessary-only, Manage choices and withdrawal controls actually work. Scantide Observe can be used for this live browser verification.
|
| www.example-customer-16.com | HTTPS 443 | 100 | VERIFY |
No CMP signature detected
Manage
ePrivacy/GDPR applicable context
|
None obvious in initial response |
• Consent controls were detected in the returned page, but no known CMP signature was identified. A passive scan can see the control text but cannot verify whether the controls actually apply consent choices.
• Visible consent controls were detected. This passive scan cannot click Accept, Reject/Necessary-only, Manage choices or Withdrawal controls, so their behavior still requires browser verification.
Next: Use browser verification to confirm whether Reject/Necessary-only, Manage choices and withdrawal controls actually work. Scantide Observe can be used for this live browser verification.
|
| Domain | Server Location | Cloud Provider | Applicable Laws | Risk Score | Compliance Status | Key Issues |
|---|---|---|---|---|---|---|
| blog.example-customer-10.com | 🌍 Denmark |
example-customer-08.com (Web hosting)
Denmark (EU)
|
GDPR (EU)
ePrivacy Directive / Cookie Law
|
9 (MEDIUM) | COMPLIANT | No compliance issues |
| www.example-customer-12.com | 🇳🇱 Netherlands |
Microsoft Azure
United States (US)
|
GDPR (EU)
ePrivacy Directive / Cookie Law
US CLOUD Act (Corporate Control)
|
19 (HIGH) | VIOLATIONS |
• GDPR + CLOUD Act jurisdictional conflict...
• Cloud provider Microsoft Azure is US-hea...
+2 more issues
|
| www.example-customer-16.com | 🇸🇪 Sweden | Traditional Hosting |
GDPR (EU)
ePrivacy Directive / Cookie Law
|
9 (MEDIUM) | COMPLIANT | No compliance issues |
| www.example-customer-18.com | 🌍 Denmark |
example-customer-08.com (Web hosting)
Denmark (EU)
|
GDPR (EU)
ePrivacy Directive / Cookie Law
|
9 (MEDIUM) | COMPLIANT | No compliance issues |
| www.example-customer-19.com | 🇸🇪 Sweden | Traditional Hosting |
GDPR (EU)
ePrivacy Directive / Cookie Law
|
9 (MEDIUM) | COMPLIANT | No compliance issues |
| Domain | Email Server Locations | Email Providers | Regulatory Frameworks | Compliance Risk | Key Issues | Recommendations |
|---|---|---|---|---|---|---|
| example-customer-17.com |
🌍 Ireland
|
Microsoft |
GDPR (EU)
CLOUD Act (US)
|
CRITICAL |
• US email provider subject to CLOUD Act -...
|
• Review Standard Contractual Clauses
• Consider EU-based email providers
|
| example-customer-13.com |
🌍 Ireland
|
Microsoft |
GDPR (EU)
CLOUD Act (US)
|
CRITICAL |
• US email provider subject to CLOUD Act -...
|
• Review Standard Contractual Clauses
• Consider EU-based email providers
|
| example-customer-21.com |
🇸🇪 Sweden
|
Independent/Unknown |
GDPR (EU)
|
LOW |
• Email processing in GDPR jurisdiction re...
|
• Monitor regulatory changes
|
| Domain | MX Server | Priority | IP Address | Geographic Location | Provider/ISP | Regulatory Risk |
|---|---|---|---|---|---|---|
| example-customer-11.com | host03.example-customer.com | 1 | 10.20.30.14 | Unknown | Unknown | UNKNOWN |
| example-customer-17.com | host02.example-customer.com | 0 | 203.0.113.15 | Dublin, Ireland | Microsoft Corporation | NORMAL |
| example-customer-13.com | host01.example-customer.com | 0 | 203.0.113.16 | Dublin, Ireland | Microsoft Corporation | NORMAL |
| example-customer-21.com | mx.example-customer-22.com | 5 | 203.0.113.17 | Umeå, Sweden | ATEA Sverige AB | NORMAL |
| Domain | Data Flow | Legal Framework | Conflict Risk | Recommendations |
|---|---|---|---|---|
| www.example-customer-12.com |
Netherlands (Server)
↓
United States (Microsoft Azure)
|
GDPR (EU)
ePrivacy Directive / Cookie Law
US CLOUD Act (Corporate Control)
|
HIGH CONFLICT |
• Implement Standard Contractual Clauses
• Consider EU-based alternatives
• Review adequacy decisions
|
| Domain | Privacy Risk | Risk Factors | Data Handling Recommendations |
|---|---|---|---|
|
www.example-customer-12.com
Microsoft Azure
|
MEDIUM |
• US cloud provider - FISA/CLOUD Act exposure
|
Monitor compliance status
|
| www.example-customer-19.com | MEDIUM |
• Insecure cookies on 2 services
|
• Implement secure cookie flags
|
This tab answers a simple question: what is reachable from the internet, who appears to host it, and which exposed services need an owner and business reason?
| Domain | Open Ports & Services | Risk Assessment | Security Recommendations |
|---|---|---|---|
| blog.example-customer-10.com |
80/tcp
OPEN
HTTP
No title found
443/tcp
OPEN
HTTPS
Red Cloud IT - Svenska molntjänster för företag och föreningar - ExampleCloud Office - Svenska molntj� ...
🔒 SSL Certificate:
*.example-customer.se
|
MEDIUM
2 Web
|
|
| www.example-customer-12.com |
80/tcp
OPEN
HTTP
I en föränderlig värld behövs flexibla IT-tjänster och pålitlig IT-drift
443/tcp
OPEN
HTTPS
I en föränderlig värld behövs flexibla IT-tjänster och pålitlig IT-drift
🔒 SSL Certificate:
www.example-customer-12.com
|
MEDIUM
2 Web
|
|
| www.example-customer-16.com |
22/tcp
OPEN
SSH
WARNING
SSH-2.0-OpenSSH_7.4
80/tcp
OPEN
HTTP
LIGHTS IN LINE AB – Performance Engineering
443/tcp
OPEN
HTTPS
LIGHTS IN LINE AB – Performance Engineering
🔒 SSL Certificate:
*.example-service.se
|
HIGH
1 Admin
2 Web
|
HIGH PRIORITY: Restrict admin access, implement VPN and bruteforce prevention
|
| www.example-customer-18.com |
No open ports detected
|
LOW
|
GOOD: No publicly exposed services detected
|
| www.example-customer-19.com |
80/tcp
OPEN
HTTP
Example Municipalitys kommun - example-customer-21.com
443/tcp
OPEN
HTTPS
Example Municipalitys kommun - example-customer-21.com
🔒 SSL Certificate:
www.example-customer-19.com
|
MEDIUM
2 Web
|
|
5 domain(s) checked - no blacklist entries found
This tab explains what browsers and visitors are exposed to: headers, cookies, redirects, TLS behavior, scripts, beacons and page-level trust boundaries.
| Domain | Server Details | Response | HTTP Methods | Cookies | HTTP Headers |
|---|---|---|---|---|---|
|
blog.example-customer-10.com
Port 80
No title found
|
Apache
Apache
CMS: WordPress
|
301
4.093s
text/html; char
|
⚠ Dangerous
PUT, DELETE
Total: 5 methods
|
0
cookies
|
Server: Apache Upgrade: h2c Location: https://blog.example-customer-10.com/ Cache-Control: max-age=2592000 +8 more headers... |
|
blog.example-customer-10.com
Port 443
Red Cloud IT - Svenska molntj�...
|
Apache
Apache
CMS: WordPress
|
200
4.093s
text/html; char
|
⚠ Dangerous
PUT, DELETE
Total: 5 methods
|
0
cookies
|
Server: Apache X-Powered-By: PHP/8.5.6 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff +25 more headers... |
|
www.example-customer-12.com
Port 80
I en föränderlig värld beh�...
|
Nginx
nginx
|
200
0.351s
text/html; char
|
✓ Safe Methods
Total: 3 methods
|
0
cookies
|
Server: nginx X-Frame-Options: SAMEORIGIN; SAMEORIGIN X-Content-Type-Options: nosniff; nosniff Strict-Transport-Security: max-age=15552001; includeSubDomains... +13 more headers... |
|
www.example-customer-16.com
Port 80
LIGHTS IN LINE AB – Performa...
|
Apache
2.4.52
Apache/2.4.52 () OpenSSL/1.0.2k-fip...
|
200
0.049s
text/html; char
|
✓ Safe Methods
Total: 3 methods
|
0
cookies
|
Server: Apache/2.4.52 () OpenSSL/1.0.2k-fip... X-Powered-By: PHP/7.4.26 Strict-Transport-Security: max-age=31536000 Link: <https://www.example-customer-16.com/wp-jso... +9 more headers... |
|
www.example-customer-16.com
Port 443
LIGHTS IN LINE AB – Performa...
|
Apache
2.4.52
Apache/2.4.52 () OpenSSL/1.0.2k-fip...
|
200
0.059s
text/html; char
|
✓ Safe Methods
Total: 3 methods
|
0
cookies
|
Server: Apache/2.4.52 () OpenSSL/1.0.2k-fip... X-Powered-By: PHP/7.4.26 Strict-Transport-Security: max-age=31536000 Link: <https://www.example-customer-16.com/wp-jso... +9 more headers... |
| Domain | Port | Score | Grade | Header | Description | Status | Recommendations |
|---|---|---|---|---|---|---|---|
| blog.example-customer-10.com | 80 | 80 | B | CSP | Defines allowed sources for content to mitigate Cross-Site Scripting (XSS). A critical header to reduce attack surface. | ⚠️ |
|
| Permissions-Policy | Restricts the use of powerful browser features, enhancing security by limiting access to sensitive APIs. | ⚠️ |
|
||||
| Cross-Origin-Opener-Policy | Protects against cross-origin attacks by isolating the browsing context from other windows and frames. | ⚠️ |
|
||||
| Cross-Origin-Embedder-Policy | Prevents loading resources from cross-origin sites to protect against attacks like Spectre. | ⚠️ |
|
||||
| X-XSS-Protection | Legacy XSS filter used by older browsers to prevent reflected XSS attacks. | ❌ |
|
||||
| Pragma | The Pragma header is used to control caching behavior, especially in HTTP/1.0 requests. It is often set to prevent caching of sensitive data. | ❌ |
|
||||
| Cache-Control | Controls the caching of resources by browsers and CDNs to reduce attack vectors and improve privacy. | ⚠️ |
|
||||
| X-Frame-Options | Prevents clickjacking attacks by controlling whether a browser can display the content in a frame. | ✅ | No recommendations | ||||
| X-Content-Type-Options | Prevents MIME type sniffing, which can lead to security vulnerabilities like executing malicious content. | ✅ | No recommendations | ||||
| Referrer-Policy | Controls the information sent in the "Referer" header when navigating from your site. Helps with privacy. | ✅ | No recommendations | ||||
| X-Permitted-Cross-Domain-Policies | Controls which cross-domain policies can be loaded by the browser, to prevent loading dangerous content. | ✅ | No recommendations | ||||
| Cross-Origin-Resource-Policy | This is a security header with no specific description in the analysis. | ✅ | No recommendations | ||||
| blog.example-customer-10.com | 443 | 80 | B | CSP | Defines allowed sources for content to mitigate Cross-Site Scripting (XSS). A critical header to reduce attack surface. | ⚠️ |
|
| Permissions-Policy | Restricts the use of powerful browser features, enhancing security by limiting access to sensitive APIs. | ⚠️ |
|
||||
| Cross-Origin-Opener-Policy | Protects against cross-origin attacks by isolating the browsing context from other windows and frames. | ⚠️ |
|
||||
| Cross-Origin-Embedder-Policy | Prevents loading resources from cross-origin sites to protect against attacks like Spectre. | ⚠️ |
|
||||
| X-XSS-Protection | Legacy XSS filter used by older browsers to prevent reflected XSS attacks. | ❌ |
|
||||
| Pragma | The Pragma header is used to control caching behavior, especially in HTTP/1.0 requests. It is often set to prevent caching of sensitive data. | ❌ |
|
||||
| Cache-Control | Controls the caching of resources by browsers and CDNs to reduce attack vectors and improve privacy. | ⚠️ |
|
||||
| HSTS | Enforces HTTPS for future requests, ensuring all traffic is encrypted. | ✅ |
|
||||
| X-Frame-Options | Prevents clickjacking attacks by controlling whether a browser can display the content in a frame. | ✅ | No recommendations | ||||
| X-Content-Type-Options | Prevents MIME type sniffing, which can lead to security vulnerabilities like executing malicious content. | ✅ | No recommendations | ||||
| Referrer-Policy | Controls the information sent in the "Referer" header when navigating from your site. Helps with privacy. | ✅ | No recommendations | ||||
| X-Permitted-Cross-Domain-Policies | Controls which cross-domain policies can be loaded by the browser, to prevent loading dangerous content. | ✅ | No recommendations | ||||
| Cross-Origin-Resource-Policy | This is a security header with no specific description in the analysis. | ✅ | No recommendations | ||||
| www.example-customer-12.com | 80 | 60 | D | CSP | Defines allowed sources for content to mitigate Cross-Site Scripting (XSS). A critical header to reduce attack surface. | ⚠️ |
|
| Permissions-Policy | Restricts the use of powerful browser features, enhancing security by limiting access to sensitive APIs. | ❌ |
|
||||
| Cross-Origin-Opener-Policy | Protects against cross-origin attacks by isolating the browsing context from other windows and frames. | ❌ |
|
||||
| Cross-Origin-Embedder-Policy | Prevents loading resources from cross-origin sites to protect against attacks like Spectre. | ❌ |
|
||||
| X-Permitted-Cross-Domain-Policies | Controls which cross-domain policies can be loaded by the browser, to prevent loading dangerous content. | ❌ |
|
||||
| Cache-Control | Controls the caching of resources by browsers and CDNs to reduce attack vectors and improve privacy. | ❌ |
|
||||
| Pragma | The Pragma header is used to control caching behavior, especially in HTTP/1.0 requests. It is often set to prevent caching of sensitive data. | ❌ |
|
||||
| Cross-Origin-Resource-Policy | This header is used to prevent cross-origin resource sharing, helping to prevent cross-origin information leakage. | ❌ |
|
||||
| X-Frame-Options | Prevents clickjacking attacks by controlling whether a browser can display the content in a frame. | ✅ | No recommendations | ||||
| X-Content-Type-Options | Prevents MIME type sniffing, which can lead to security vulnerabilities like executing malicious content. | ✅ | No recommendations | ||||
| Referrer-Policy | Controls the information sent in the "Referer" header when navigating from your site. Helps with privacy. | ✅ | No recommendations | ||||
| X-XSS-Protection | Legacy XSS filter used by older browsers to prevent reflected XSS attacks. | ✅ | No recommendations | ||||
| www.example-customer-12.com | 443 | 60 | D | CSP | Defines allowed sources for content to mitigate Cross-Site Scripting (XSS). A critical header to reduce attack surface. | ⚠️ |
|
| Permissions-Policy | Restricts the use of powerful browser features, enhancing security by limiting access to sensitive APIs. | ❌ |
|
||||
| Cross-Origin-Opener-Policy | Protects against cross-origin attacks by isolating the browsing context from other windows and frames. | ❌ |
|
||||
| Cross-Origin-Embedder-Policy | Prevents loading resources from cross-origin sites to protect against attacks like Spectre. | ❌ |
|
||||
| X-Permitted-Cross-Domain-Policies | Controls which cross-domain policies can be loaded by the browser, to prevent loading dangerous content. | ❌ |
|
||||
| Cache-Control | Controls the caching of resources by browsers and CDNs to reduce attack vectors and improve privacy. | ❌ |
|
||||
| Pragma | The Pragma header is used to control caching behavior, especially in HTTP/1.0 requests. It is often set to prevent caching of sensitive data. | ❌ |
|
||||
| Cross-Origin-Resource-Policy | This header is used to prevent cross-origin resource sharing, helping to prevent cross-origin information leakage. | ❌ |
|
||||
| HSTS | Enforces HTTPS for future requests, ensuring all traffic is encrypted. | ✅ |
|
||||
| X-Frame-Options | Prevents clickjacking attacks by controlling whether a browser can display the content in a frame. | ✅ | No recommendations | ||||
| X-Content-Type-Options | Prevents MIME type sniffing, which can lead to security vulnerabilities like executing malicious content. | ✅ | No recommendations | ||||
| Referrer-Policy | Controls the information sent in the "Referer" header when navigating from your site. Helps with privacy. | ✅ | No recommendations | ||||
| X-XSS-Protection | Legacy XSS filter used by older browsers to prevent reflected XSS attacks. | ✅ | No recommendations | ||||
| www.example-customer-16.com | 80 | 30 | F | CSP | Defines allowed sources for content to mitigate Cross-Site Scripting (XSS). A critical header to reduce attack surface. | ❌ |
|
| X-Frame-Options | Prevents clickjacking attacks by controlling whether a browser can display the content in a frame. | ❌ |
|
||||
| X-Content-Type-Options | Prevents MIME type sniffing, which can lead to security vulnerabilities like executing malicious content. | ❌ |
|
||||
| Referrer-Policy | Controls the information sent in the "Referer" header when navigating from your site. Helps with privacy. | ❌ |
|
||||
| Permissions-Policy | Restricts the use of powerful browser features, enhancing security by limiting access to sensitive APIs. | ❌ |
|
||||
| Cross-Origin-Opener-Policy | Protects against cross-origin attacks by isolating the browsing context from other windows and frames. | ❌ |
|
||||
| Cross-Origin-Embedder-Policy | Prevents loading resources from cross-origin sites to protect against attacks like Spectre. | ❌ |
|
||||
| X-XSS-Protection | Legacy XSS filter used by older browsers to prevent reflected XSS attacks. | ❌ |
|
||||
| X-Permitted-Cross-Domain-Policies | Controls which cross-domain policies can be loaded by the browser, to prevent loading dangerous content. | ❌ |
|
||||
| Cache-Control | Controls the caching of resources by browsers and CDNs to reduce attack vectors and improve privacy. | ❌ |
|
||||
| Pragma | The Pragma header is used to control caching behavior, especially in HTTP/1.0 requests. It is often set to prevent caching of sensitive data. | ❌ |
|
||||
| Cross-Origin-Resource-Policy | This header is used to prevent cross-origin resource sharing, helping to prevent cross-origin information leakage. | ❌ |
|
||||
| www.example-customer-16.com | 443 | 30 | F | CSP | Defines allowed sources for content to mitigate Cross-Site Scripting (XSS). A critical header to reduce attack surface. | ❌ |
|
| X-Frame-Options | Prevents clickjacking attacks by controlling whether a browser can display the content in a frame. | ❌ |
|
||||
| X-Content-Type-Options | Prevents MIME type sniffing, which can lead to security vulnerabilities like executing malicious content. | ❌ |
|
||||
| Referrer-Policy | Controls the information sent in the "Referer" header when navigating from your site. Helps with privacy. | ❌ |
|
||||
| Permissions-Policy | Restricts the use of powerful browser features, enhancing security by limiting access to sensitive APIs. | ❌ |
|
||||
| Cross-Origin-Opener-Policy | Protects against cross-origin attacks by isolating the browsing context from other windows and frames. | ❌ |
|
||||
| Cross-Origin-Embedder-Policy | Prevents loading resources from cross-origin sites to protect against attacks like Spectre. | ❌ |
|
||||
| X-XSS-Protection | Legacy XSS filter used by older browsers to prevent reflected XSS attacks. | ❌ |
|
||||
| X-Permitted-Cross-Domain-Policies | Controls which cross-domain policies can be loaded by the browser, to prevent loading dangerous content. | ❌ |
|
||||
| Cache-Control | Controls the caching of resources by browsers and CDNs to reduce attack vectors and improve privacy. | ❌ |
|
||||
| Pragma | The Pragma header is used to control caching behavior, especially in HTTP/1.0 requests. It is often set to prevent caching of sensitive data. | ❌ |
|
||||
| Cross-Origin-Resource-Policy | This header is used to prevent cross-origin resource sharing, helping to prevent cross-origin information leakage. | ❌ |
|
||||
| HSTS | Enforces HTTPS for future requests, ensuring all traffic is encrypted. | ⚠️ |
|
||||
| www.example-customer-19.com | 80 | 30 | F | CSP | Defines allowed sources for content to mitigate Cross-Site Scripting (XSS). A critical header to reduce attack surface. | ❌ |
|
| X-Content-Type-Options | Prevents MIME type sniffing, which can lead to security vulnerabilities like executing malicious content. | ❌ |
|
||||
| Referrer-Policy | Controls the information sent in the "Referer" header when navigating from your site. Helps with privacy. | ❌ |
|
||||
| Permissions-Policy | Restricts the use of powerful browser features, enhancing security by limiting access to sensitive APIs. | ❌ |
|
||||
| Cross-Origin-Opener-Policy | Protects against cross-origin attacks by isolating the browsing context from other windows and frames. | ❌ |
|
||||
| Cross-Origin-Embedder-Policy | Prevents loading resources from cross-origin sites to protect against attacks like Spectre. | ❌ |
|
||||
| X-XSS-Protection | Legacy XSS filter used by older browsers to prevent reflected XSS attacks. | ❌ |
|
||||
| X-Permitted-Cross-Domain-Policies | Controls which cross-domain policies can be loaded by the browser, to prevent loading dangerous content. | ❌ |
|
||||
| Cross-Origin-Resource-Policy | This header is used to prevent cross-origin resource sharing, helping to prevent cross-origin information leakage. | ❌ |
|
||||
| X-Frame-Options | Prevents clickjacking attacks by controlling whether a browser can display the content in a frame. | ✅ | No recommendations | ||||
| Cache-Control | Controls the caching of resources by browsers and CDNs to reduce attack vectors and improve privacy. | ✅ | No recommendations | ||||
| Pragma | This is a security header with no specific description in the analysis. | ✅ | No recommendations | ||||
| www.example-customer-19.com | 443 | 30 | F | HSTS | Enforces HTTPS for future requests, ensuring all traffic is encrypted. | ❌ |
|
| CSP | Defines allowed sources for content to mitigate Cross-Site Scripting (XSS). A critical header to reduce attack surface. | ❌ |
|
||||
| X-Content-Type-Options | Prevents MIME type sniffing, which can lead to security vulnerabilities like executing malicious content. | ❌ |
|
||||
| Referrer-Policy | Controls the information sent in the "Referer" header when navigating from your site. Helps with privacy. | ❌ |
|
||||
| Permissions-Policy | Restricts the use of powerful browser features, enhancing security by limiting access to sensitive APIs. | ❌ |
|
||||
| Cross-Origin-Opener-Policy | Protects against cross-origin attacks by isolating the browsing context from other windows and frames. | ❌ |
|
||||
| Cross-Origin-Embedder-Policy | Prevents loading resources from cross-origin sites to protect against attacks like Spectre. | ❌ |
|
||||
| X-XSS-Protection | Legacy XSS filter used by older browsers to prevent reflected XSS attacks. | ❌ |
|
||||
| X-Permitted-Cross-Domain-Policies | Controls which cross-domain policies can be loaded by the browser, to prevent loading dangerous content. | ❌ |
|
||||
| Cross-Origin-Resource-Policy | This header is used to prevent cross-origin resource sharing, helping to prevent cross-origin information leakage. | ❌ |
|
||||
| X-Frame-Options | Prevents clickjacking attacks by controlling whether a browser can display the content in a frame. | ✅ | No recommendations | ||||
| Cache-Control | Controls the caching of resources by browsers and CDNs to reduce attack vectors and improve privacy. | ✅ | No recommendations | ||||
| Pragma | This is a security header with no specific description in the analysis. | ✅ | No recommendations |
| Domain | Port | Security Risk | Allowed Methods | Dangerous Methods | Recommendations |
|---|---|---|---|---|---|
| blog.example-customer-10.com | 80 | HIGH | GET, POST, HEAD, PUT, DELETE |
PUT, DELETE
|
Disable unused HTTP methods
|
| blog.example-customer-10.com | 443 | HIGH | GET, POST, HEAD, PUT, DELETE |
PUT, DELETE
|
Disable unused HTTP methods
|
| www.example-customer-12.com | 80 | LOW | GET, POST, HEAD | None detected |
Good security configuration
|
| www.example-customer-12.com | 443 | LOW | GET, POST, HEAD | None detected |
Good security configuration
|
| www.example-customer-16.com | 80 | LOW | GET, POST, HEAD | None detected |
Good security configuration
|
| www.example-customer-16.com | 443 | LOW | GET, POST, HEAD | None detected |
Good security configuration
|
| www.example-customer-19.com | 80 | LOW | GET, POST, HEAD, OPTIONS | None detected |
Good security configuration
|
| www.example-customer-19.com | 443 | LOW | GET, POST, HEAD, OPTIONS | None detected |
Good security configuration
|
| Domain | Port | Cookie Score | Count | Cookie Names | Security Issues | Status |
|---|---|---|---|---|---|---|
| www.example-customer-19.com | 80 | 48 | 3 | SiteVisionLTM, JSESSIONID, SiteVisionLTM |
• Cookie 'SiteVisionLTM' missing Secure fl...
• Cookie 'SiteVisionLTM' missing SameSite ...
• Cookie 'JSESSIONID': Low entropy (43/100...
+1 more issues
|
INSECURE |
| www.example-customer-19.com | 443 | 87 | 2 | JSESSIONID, SiteVisionLTM |
• Cookie 'JSESSIONID': Low entropy (47/100...
|
INSECURE |
| Domain | Port | Score | Status | Consent Signals | Pre-consent Tracking | Issues / Recommendations |
|---|---|---|---|---|---|---|
| www.example-customer-19.com | HTTP 80 | 25 | HIGH RISK |
No CMP signature detected
Accept
ePrivacy/GDPR applicable context
|
1 signal(s)
JSESSIONID |
• Tracking or analytics cookies are set in the initial response before explicit consent can be verified.
• Accept control was detected, but no equally clear reject/necessary-only control was detected.
• Cookie/consent text was detected, but no manage/preferences control was found.
+1 more issue(s)
Next: Block analytics, advertising, replay and tracking cookies until the visitor actively accepts the relevant category.
|
| www.example-customer-19.com | HTTPS 443 | 25 | HIGH RISK |
No CMP signature detected
Accept
ePrivacy/GDPR applicable context
|
1 signal(s)
JSESSIONID |
• Tracking or analytics cookies are set in the initial response before explicit consent can be verified.
• Accept control was detected, but no equally clear reject/necessary-only control was detected.
• Cookie/consent text was detected, but no manage/preferences control was found.
+1 more issue(s)
Next: Block analytics, advertising, replay and tracking cookies until the visitor actively accepts the relevant category.
|
| blog.example-customer-10.com | HTTP 80 | 100 | VERIFY |
No CMP signature detected
No clear controls detected
ePrivacy/GDPR applicable context
|
None obvious in initial response |
• GDPR/ePrivacy context is likely, but no consent controls were visible in the passive HTML. Missing Reject, Manage choices and Withdrawal controls cannot be confirmed without browser execution.
Next: Use browser verification to confirm whether Reject/Necessary-only, Manage choices and withdrawal controls actually work. Scantide Observe can be used for this live browser verification.
|
| blog.example-customer-10.com | HTTPS 443 | 100 | VERIFY |
No CMP signature detected
No clear controls detected
ePrivacy/GDPR applicable context
|
None obvious in initial response |
• GDPR/ePrivacy context is likely, but no consent controls were visible in the passive HTML. Missing Reject, Manage choices and Withdrawal controls cannot be confirmed without browser execution.
Next: Use browser verification to confirm whether Reject/Necessary-only, Manage choices and withdrawal controls actually work. Scantide Observe can be used for this live browser verification.
|
| www.example-customer-12.com | HTTP 80 | 100 | VERIFY |
No CMP signature detected
No clear controls detected
ePrivacy/GDPR applicable context
|
None obvious in initial response |
• GDPR/ePrivacy context is likely, but no consent controls were visible in the passive HTML. Missing Reject, Manage choices and Withdrawal controls cannot be confirmed without browser execution.
Next: Use browser verification to confirm whether Reject/Necessary-only, Manage choices and withdrawal controls actually work. Scantide Observe can be used for this live browser verification.
|
| www.example-customer-12.com | HTTPS 443 | 100 | VERIFY |
No CMP signature detected
No clear controls detected
ePrivacy/GDPR applicable context
|
None obvious in initial response |
• GDPR/ePrivacy context is likely, but no consent controls were visible in the passive HTML. Missing Reject, Manage choices and Withdrawal controls cannot be confirmed without browser execution.
Next: Use browser verification to confirm whether Reject/Necessary-only, Manage choices and withdrawal controls actually work. Scantide Observe can be used for this live browser verification.
|
| www.example-customer-16.com | HTTP 80 | 100 | VERIFY |
No CMP signature detected
Manage
ePrivacy/GDPR applicable context
|
None obvious in initial response |
• Consent controls were detected in the returned page, but no known CMP signature was identified. A passive scan can see the control text but cannot verify whether the controls actually apply consent choices.
• Visible consent controls were detected. This passive scan cannot click Accept, Reject/Necessary-only, Manage choices or Withdrawal controls, so their behavior still requires browser verification.
Next: Use browser verification to confirm whether Reject/Necessary-only, Manage choices and withdrawal controls actually work. Scantide Observe can be used for this live browser verification.
|
| www.example-customer-16.com | HTTPS 443 | 100 | VERIFY |
No CMP signature detected
Manage
ePrivacy/GDPR applicable context
|
None obvious in initial response |
• Consent controls were detected in the returned page, but no known CMP signature was identified. A passive scan can see the control text but cannot verify whether the controls actually apply consent choices.
• Visible consent controls were detected. This passive scan cannot click Accept, Reject/Necessary-only, Manage choices or Withdrawal controls, so their behavior still requires browser verification.
Next: Use browser verification to confirm whether Reject/Necessary-only, Manage choices and withdrawal controls actually work. Scantide Observe can be used for this live browser verification.
|
| Domain | Port | Type | Hops | Original → Final | Response | IP Change | Security |
|---|---|---|---|---|---|---|---|
| blog.example-customer-10.com | 80 | HTTP→HTTPS | 1 |
FROM:
http://blog.example-customer-10.com
TO:
https://blog.example-customer-10.com/
|
301
4.093s
|
No | ✓ Secure |
| blog.example-customer-10.com | 443 | Same-domain | 1 |
FROM:
https://blog.example-customer-10.com
TO:
https://blog.example-customer-10.com/
|
200
4.093s
|
No | ✓ Normal |
| www.example-customer-12.com | 80 | HTTP→HTTPS | 1 |
FROM:
http://www.example-customer-12.com
TO:
https://www.example-customer-12.com/
|
200
0.351s
|
No | ✓ Secure |
| www.example-customer-12.com | 443 | Same-domain | 1 |
FROM:
https://www.example-customer-12.com
TO:
https://www.example-customer-12.com/
|
200
0.190s
|
No | ✓ Normal |
| www.example-customer-16.com | 80 | Same-domain | 1 |
FROM:
http://www.example-customer-16.com
TO:
http://www.example-customer-16.com/
|
200
0.049s
|
No | ✓ Normal |
| www.example-customer-16.com | 443 | Same-domain | 1 |
FROM:
https://www.example-customer-16.com
TO:
https://www.example-customer-16.com/
|
200
0.059s
|
No | ✓ Normal |
| www.example-customer-19.com | 80 | HTTP→HTTPS | 1 |
FROM:
http://www.example-customer-19.com
TO:
https://www.example-customer-19.com/
|
200
0.346s
|
No | ✓ Secure |
| www.example-customer-19.com | 443 | Same-domain | 1 |
FROM:
https://www.example-customer-19.com
TO:
https://www.example-customer-19.com/
|
200
1.113s
|
No | ✓ Normal |
| Domain | Port | Grade | Certificate Details | Expiration | Security Features |
|---|---|---|---|---|---|
|
blog.example-customer-10.com
🌟 Wildcard
|
443 | B |
CN:
*.example-customer.se
*.example-customer.se
example-customer-11.com
Issuer:
Let's Encrypt
|
2026-07-12
48 days
Valid
|
✓ Perfect Forward Secrecy
|
| www.example-customer-12.com | 443 | B |
CN:
www.example-customer-12.com
example-customer-13.com
example-customer-14.com
www.example-customer-12.com
www.example-customer-15.com
Issuer:
Let's Encrypt
|
2026-07-13
49 days
Valid
|
✓ Perfect Forward Secrecy
|
| www.example-customer-19.com | 443 | B |
CN:
www.example-customer-19.com
www.example-customer-19.com
Issuer:
Let's Encrypt
|
2026-08-23
90 days
Valid
|
✓ Perfect Forward Secrecy
|
|
www.example-customer-16.com
🌟 Wildcard
|
443 | B |
CN:
*.example-service.se
*.example-service.se
example-customer-17.com
Issuer:
GlobalSign nv-sa
|
2027-03-21
301 days
Valid
|
✓ Perfect Forward Secrecy
|
| Domain | Port | TLS Score | Security Score | Supported Versions | Vulnerable Versions | Status |
|---|---|---|---|---|---|---|
| blog.example-customer-10.com | 443 | 90 | 90/100 | TLSv1.2, TLSv1.3 | ✅ None | SECURE |
| www.example-customer-12.com | 443 | 90 | 90/100 | TLSv1.2, TLSv1.3 | ✅ None | SECURE |
| www.example-customer-16.com | 443 | 50 | 50/100 | TLSv1.2 | ✅ None | SECURE |
| www.example-customer-19.com | 443 | 90 | 90/100 | TLSv1.2, TLSv1.3 | ✅ None | SECURE |
CORS and CSP are HTTP/browser communication controls. This section shows the policy findings here, while the Web Evidence tab keeps the underlying scripts, styles, assets, and page-context evidence used for CSP-vs-assets validation.
| Domain | Port | CORS Findings | CSP / Asset Findings | Recommendations |
|---|---|---|---|---|
| blog.example-customer-10.com | HTTPS 443 |
CORS allows broad or sensitive request headers: Content-Type, Authorization |
CSP missing object-src directiveCSP missing base-uri directiveCSP missing frame-ancestors directiveObserved stylesheet host may not be covered by style-src: fonts.googleapis.comObserved stylesheet host may not be covered by style-src: maxcdn.bootstrapcdn.comInline scripts exist but CSP does not show unsafe-inline, nonce, or hash support |
Only allow the request headers required by the application. |
| www.example-customer-12.com | HTTP 80 | No CORS issue listed |
CSP missing frame-ancestors directiveCSP allows unsafe-inlineCSP allows unsafe-eval |
No recommendation listed |
| www.example-customer-12.com | HTTPS 443 | No CORS issue listed |
CSP missing frame-ancestors directiveCSP allows unsafe-inlineCSP allows unsafe-eval |
No recommendation listed |
| www.example-customer-19.com | HTTP 80 | No CORS issue listed |
No enforced CSP was available to compare against page assets |
No recommendation listed |
| www.example-customer-19.com | HTTPS 443 | No CORS issue listed |
No enforced CSP was available to compare against page assets |
No recommendation listed |
| www.example-customer-16.com | HTTP 80 | No CORS issue listed |
No enforced CSP was available to compare against page assets |
No recommendation listed |
| www.example-customer-16.com | HTTPS 443 | No CORS issue listed |
No enforced CSP was available to compare against page assets |
No recommendation listed |
These findings originate from returned page evidence, but they belong in Security Analysis because they can expose secrets, source structure, debug information, or JavaScript patterns that deserve manual review. Web Evidence keeps the raw page context.
This tab is the detailed evidence layer for front-end behavior. It helps explain which external hosts, trackers, forms, iframes, public files or debug artifacts were captured.
This section shows the raw webpage evidence captured during HTTP/HTTPS analysis: scripts, third-party assets, beacon endpoints, tracking signatures, sensitive forms, iframes, mixed-content resources, storage use and runtime indicators. CORS/CSP policy findings are also surfaced in Communications, while secrets/source maps/debug/DOM-review signals are also surfaced in Security Analysis. These findings are server-side HTML evidence; browser-only runtime requests may still require Scantide Observe for full live instrumentation.
| Domain | Port | Public metadata evidence | Client/payment/login evidence | CSP/cache/CDN evidence | Certificate surface |
|---|---|---|---|---|---|
| blog.example-customer-10.com | HTTPS 443 |
security.txt not found
Found public files:
/robots.txt
robots.txt · HTTP 200 · text/plain; charset=utf-8
/sitemap.xml
sitemap.xml · HTTP 200 · text/xml; charset=UTF-8
|
Client libraries:
Font Awesome 4.7.0
— <!DOCTYPE html>
<!--[if IE 7]>
<html class="ie ie7 no-js" lang="sv-SE">
<![endif]-->
<
WordPress asset path detected
— wp-content
|
CSP: WEAK (52/100)
• Missing default-src • Missing script-src • Missing object-src • Missing base-uri • Missing frame-ancestors CSP strengths: upgrade-insecure-requests present
No confirmed CDN/WAF edge evidence from provider-specific main-response headers.
Evidence notes:
• Passive server-side evidence: confirmed from response headers, DNS/TLS/HTML/source where available; interactive browser behavior still needs Scantide Observe or browser verification. |
No HTTPS certificate evidence captured |
| www.example-customer-12.com | HTTP 80 |
security.txt found
Contact: mailto:contact1@example-customer-23.com
Found public files:
/.well-known/security.txt
security.txt · HTTP 200 · text/plain
/robots.txt
robots.txt · HTTP 200 · text/plain
• security.txt exists but has no Expires field
|
No client library/version evidence detected.
|
CSP: WEAK (51/100)
• Missing frame-ancestors • Missing form-action • Allows 'unsafe-inline' • Allows 'unsafe-eval' CSP strengths: default-src set, script-src set, object-src set
No confirmed CDN/WAF edge evidence from provider-specific main-response headers.
Evidence notes:
• Passive server-side evidence: confirmed from response headers, DNS/TLS/HTML/source where available; interactive browser behavior still needs Scantide Observe or browser verification. |
No HTTPS certificate evidence captured |
| www.example-customer-12.com | HTTPS 443 |
security.txt found
Contact: mailto:contact1@example-customer-23.com
Found public files:
/.well-known/security.txt
security.txt · HTTP 200 · text/plain
/robots.txt
robots.txt · HTTP 200 · text/plain
• security.txt exists but has no Expires field
|
No client library/version evidence detected.
|
CSP: WEAK (51/100)
• Missing frame-ancestors • Missing form-action • Allows 'unsafe-inline' • Allows 'unsafe-eval' CSP strengths: default-src set, script-src set, object-src set
No confirmed CDN/WAF edge evidence from provider-specific main-response headers.
Evidence notes:
• Passive server-side evidence: confirmed from response headers, DNS/TLS/HTML/source where available; interactive browser behavior still needs Scantide Observe or browser verification. |
No HTTPS certificate evidence captured |
| www.example-customer-16.com | HTTP 80 |
security.txt not found
Found public files:
/robots.txt
robots.txt · HTTP 200 · text/plain; charset=utf-8
/sitemap.xml
sitemap.xml · HTTP 200 · application/xml; charset=UTF-8
robots.txt path hints:
• robots.txt exposes admin/staging/private-looking path hints
|
No client library/version evidence detected.
Login/admin evidence:
• robots.txt path hint: /wp-admin/
|
CSP: MISSING (0/100)
• No enforced CSP was observed
No confirmed CDN/WAF edge evidence from provider-specific main-response headers.
Evidence notes:
• Passive server-side evidence: confirmed from response headers, DNS/TLS/HTML/source where available; interactive browser behavior still needs Scantide Observe or browser verification. |
No HTTPS certificate evidence captured |
| www.example-customer-16.com | HTTPS 443 |
security.txt not found
Found public files:
/robots.txt
robots.txt · HTTP 200 · text/plain; charset=utf-8
/sitemap.xml
sitemap.xml · HTTP 200 · application/xml; charset=UTF-8
robots.txt path hints:
• robots.txt exposes admin/staging/private-looking path hints
|
No client library/version evidence detected.
Login/admin evidence:
• robots.txt path hint: /wp-admin/
|
CSP: MISSING (0/100)
• No enforced CSP was observed
No confirmed CDN/WAF edge evidence from provider-specific main-response headers.
Evidence notes:
• Passive server-side evidence: confirmed from response headers, DNS/TLS/HTML/source where available; interactive browser behavior still needs Scantide Observe or browser verification. |
No HTTPS certificate evidence captured |
| www.example-customer-19.com | HTTP 80 |
security.txt found
Contact: mailto:contact2@example-customer-23.com Expires: 2026-06-25T13:37:00.000Z
Found public files:
/.well-known/security.txt
security.txt · HTTP 200 · text/plain
/security.txt
security.txt legacy · HTTP 200 · text/plain
/robots.txt
robots.txt · HTTP 200 · text/plain;charset=UTF-8
/sitemap.xml
sitemap.xml · HTTP 200 · application/xml;charset=UTF-8
Manifest reference(s):
|
No client library/version evidence detected.
|
CSP: MISSING (0/100)
• No enforced CSP was observed
No confirmed CDN/WAF edge evidence from provider-specific main-response headers.
Evidence notes:
• Passive server-side evidence: confirmed from response headers, DNS/TLS/HTML/source where available; interactive browser behavior still needs Scantide Observe or browser verification. |
No HTTPS certificate evidence captured |
| www.example-customer-19.com | HTTPS 443 |
security.txt found
Contact: mailto:contact2@example-customer-23.com Expires: 2026-06-25T13:37:00.000Z
Found public files:
/.well-known/security.txt
security.txt · HTTP 200 · text/plain
/security.txt
security.txt legacy · HTTP 200 · text/plain
/robots.txt
robots.txt · HTTP 200 · text/plain;charset=UTF-8
/sitemap.xml
sitemap.xml · HTTP 200 · application/xml;charset=UTF-8
Manifest reference(s):
|
No client library/version evidence detected.
|
CSP: MISSING (0/100)
• No enforced CSP was observed
No confirmed CDN/WAF edge evidence from provider-specific main-response headers.
Evidence notes:
• Passive server-side evidence: confirmed from response headers, DNS/TLS/HTML/source where available; interactive browser behavior still needs Scantide Observe or browser verification. |
No HTTPS certificate evidence captured |
blog.example-customer-10.comfonts.googleapis.comgmpg.orgmaxcdn.bootstrapcdn.com[][][]No HTML body was available for script/beacon analysisIf the site uses heavy JavaScript rendering, compare this server-side scan with Scantide Observe browser evidence.[][{"index":1,"length":102,"uses":[],"endpoint_count":0,"snippet":"(function(html){html.className = html.className.replace(\/\\bno-js\\b\/,'js')})(document.documentElement);"},{"index":2,"length":2112,"uses":[],"endpoint_count":0,"snippet":"{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"CollectionPage\",\"@id\":\"https:\\\/\\\/blog.example-customer-10.com\\\/\",\"url\":\"https:\\\/\\\/blog.example-customer-10.com\\\/\",\"name\":\"Red Cloud IT - Svenska moln"}][]CORS allows broad or sensitive request headers: Content-Type, AuthorizationCSP missing object-src directiveCSP missing base-uri directiveCSP missing frame-ancestors directiveObserved stylesheet host may not be covered by style-src: fonts.googleapis.comObserved stylesheet host may not be covered by style-src: maxcdn.bootstrapcdn.comInline scripts exist but CSP does not show unsafe-inline, nonce, or hash supportCSP quality is weak or incompleteThird-party stylesheets without Subresource Integrity (SRI) were foundOnly allow the request headers required by the application.Align CSP directives with observed scripts/styles, remove unsafe directives, and add object-src/base-uri/frame-ancestors.Consider publishing /.well-known/security.txt with a monitored vulnerability-reporting contact.Use SRI for stable third-party CSS, or self-host trusted stylesheet dependencies where practical.CORS allows broad or sensitive request headers: Content-Type, AuthorizationCSP missing object-src directiveCSP missing base-uri directiveCSP missing frame-ancestors directiveObserved stylesheet host may not be covered by style-src: fonts.googleapis.comObserved stylesheet host may not be covered by style-src: maxcdn.bootstrapcdn.comInline scripts exist but CSP does not show unsafe-inline, nonce, or hash supporthttps://fonts.googleapis.com/css?family=Fjalla+One:400%7CCantarell:400https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css?ver=ANONYMIZEDIDhttps://fonts.googleapis.comhttps://maxcdn.bootstrapcdn.comwww.example-customer-12.com[][{"index":1,"length":2167,"uses":[],"endpoint_count":0,"snippet":"\/* \"function\"==typeof InitializeEditor,callIfLoaded:function(o){return!(!gform.domLoaded||!gform.scriptsLoaded||!gform.themeScriptsLoaded&&!gform.isFormEditor()||(gform.isFormEdito"}][]CSP missing frame-ancestors directiveCSP allows unsafe-inlineCSP allows unsafe-evalsecurity.txt exists but has no Expires fieldCSP quality is weak or incompleteAlign CSP directives with observed scripts/styles, remove unsafe directives, and add object-src/base-uri/frame-ancestors.CSP missing frame-ancestors directiveCSP allows unsafe-inlineCSP allows unsafe-eval[][{"index":1,"length":2167,"uses":[],"endpoint_count":0,"snippet":"\/* \"function\"==typeof InitializeEditor,callIfLoaded:function(o){return!(!gform.domLoaded||!gform.scriptsLoaded||!gform.themeScriptsLoaded&&!gform.isFormEditor()||(gform.isFormEdito"}][]CSP missing frame-ancestors directiveCSP allows unsafe-inlineCSP allows unsafe-evalsecurity.txt exists but has no Expires fieldCSP quality is weak or incompleteAlign CSP directives with observed scripts/styles, remove unsafe directives, and add object-src/base-uri/frame-ancestors.CSP missing frame-ancestors directiveCSP allows unsafe-inlineCSP allows unsafe-evalhost24.example-customer.comhost25.example-customer.comhost26.example-customer.comwww.example-customer-16.com[][{"index":1,"length":2195,"uses":[],"endpoint_count":0,"snippet":"window._wpemojiSettings = {\"baseUrl\":\"https:\\\/\\\/s.w.org\\\/images\\\/core\\\/emoji\\\/14.0.0\\\/72x72\\\/\",\"ext\":\".png\",\"svgUrl\":\"https:\\\/\\\/s.w.org\\\/images\\\/core\\\/emoji\\\/14.0.0\\\/svg\\\/\",\"svgExt"}]["createElement(\"script\")"]robots.txt exposes admin/staging/private-looking path hintsCSP quality is weak or incompleteThird-party stylesheets without Subresource Integrity (SRI) were foundDynamic script execution/injection indicators were found: createElement("script")Review robots.txt for path disclosure. Do not rely on robots.txt to hide sensitive locations.Consider publishing /.well-known/security.txt with a monitored vulnerability-reporting contact.Review linked login/admin surfaces for MFA, rate limiting, SSO policy and exposure expectations.Use SRI for stable third-party CSS, or self-host trusted stylesheet dependencies where practical.Review dynamic script loading, eval/new Function use, and CSP compatibility.No enforced CSP was available to compare against page assetshttps://host24.example-customer.com/c/6.2.9/wp-includes/blocks/navigation/style.min.csshttp://host26.example-customer.comhttp://host25.example-customer.comhttp://host24.example-customer.com[][{"index":1,"length":2195,"uses":[],"endpoint_count":0,"snippet":"window._wpemojiSettings = {\"baseUrl\":\"https:\\\/\\\/s.w.org\\\/images\\\/core\\\/emoji\\\/14.0.0\\\/72x72\\\/\",\"ext\":\".png\",\"svgUrl\":\"https:\\\/\\\/s.w.org\\\/images\\\/core\\\/emoji\\\/14.0.0\\\/svg\\\/\",\"svgExt"}]["createElement(\"script\")"]robots.txt exposes admin/staging/private-looking path hintsCSP quality is weak or incompleteThird-party stylesheets without Subresource Integrity (SRI) were foundDynamic script execution/injection indicators were found: createElement("script")Review robots.txt for path disclosure. Do not rely on robots.txt to hide sensitive locations.Consider publishing /.well-known/security.txt with a monitored vulnerability-reporting contact.Review linked login/admin surfaces for MFA, rate limiting, SSO policy and exposure expectations.Use SRI for stable third-party CSS, or self-host trusted stylesheet dependencies where practical.Review dynamic script loading, eval/new Function use, and CSP compatibility.No enforced CSP was available to compare against page assetshttps://host24.example-customer.com/c/6.2.9/wp-includes/blocks/navigation/style.min.csshttps://host26.example-customer.comhttps://host25.example-customer.comhttps://host24.example-customer.comwww.example-customer-19.com[{"src":"https:\/\/www.example-customer-19.com\/example-cms\/system-resource\/ANONYMIZEDID\/js\/jquery.js","host":"www.example-customer-19.com","third_party":false,"has_sri":false,"async":false,"defer":false,"tracker_matches":[]},{"src":"https:\/\/www.example-customer-19.com\/download\/18.ANONYMIZEDID\/1598865178090\/jquery.flexslider-min.2.7.2.js","host":"www.example-customer-19.com","third_party":false,"has_sri":false,"async":false,"defer":false,"tracker_matches":[]}][{"index":1,"length":87,"uses":[],"endpoint_count":0,"snippet":"(function(c){c.add('sv-js');c.remove('sv-no-js');})(document.documentElement.classList)"},{"index":2,"length":683,"uses":[],"endpoint_count":0,"snippet":"!function(t,e){t=t||\"docReady\",e=e||window;var n=[],o=!1,c=!1;function d(){if(!o){o=!0;for(var t=0;t"},{"index":5,"length":54,"uses":[],"endpoint_count":0,"snippet":""},{"index":6,"length":71,"uses":[],"endpoint_count":0,"snippet":"(function(html){html.className += ' lp-js'})(document.documentElement);"},{"index":7,"length":880,"uses":[],"endpoint_count":0,"snippet":"\/\/ When window has finished loading window.addEventListener(\"load\", function () { \/\/ This is the \"accept all\" cookie button var vizzitAcceptAll = document.querySelector(\"#cc-b-acce"},{"index":8,"length":431,"uses":[],"endpoint_count":0,"snippet":"window.sv = window.sv || {}; sv.UNSAFE_MAY_CHANGE_AT_ANY_GIVEN_TIME_webAppExternals = {}; sv.PageContext = { pageId: '4.ANONYMIZEDID', siteId: '2.ANONYMIZEDID"}][]Tracking or analytics cookies are set in the initial response before explicit consent can be verified.Accept control was detected, but no equally clear reject/necessary-only control was detected.Cookie/consent text was detected, but no manage/preferences control was found.No clear withdrawal/change-consent control was detected in the returned page.CSP quality is weak or incompleteHTTP mixed-content references were found on an HTTPS pageService worker or PWA capability signals were foundBlock analytics, advertising, replay and tracking cookies until the visitor actively accepts the relevant category.Add a Reject all / Necessary only option on the first banner layer.Expose a Manage choices / Cookie settings control.Add a persistent Cookie settings or Privacy settings link in the footer or privacy area.Move all active/passive resources to HTTPS.Review service-worker scope, cache behavior, update strategy, push permissions, and sensitive data caching.No enforced CSP was available to compare against page assets[{"src":"https:\/\/www.example-customer-19.com\/example-cms\/system-resource\/ANONYMIZEDID\/js\/jquery.js","host":"www.example-customer-19.com","third_party":false,"has_sri":false,"async":false,"defer":false,"tracker_matches":[]},{"src":"https:\/\/www.example-customer-19.com\/download\/18.ANONYMIZEDID\/1598865178090\/jquery.flexslider-min.2.7.2.js","host":"www.example-customer-19.com","third_party":false,"has_sri":false,"async":false,"defer":false,"tracker_matches":[]}][{"index":1,"length":87,"uses":[],"endpoint_count":0,"snippet":"(function(c){c.add('sv-js');c.remove('sv-no-js');})(document.documentElement.classList)"},{"index":2,"length":683,"uses":[],"endpoint_count":0,"snippet":"!function(t,e){t=t||\"docReady\",e=e||window;var n=[],o=!1,c=!1;function d(){if(!o){o=!0;for(var t=0;t"},{"index":5,"length":54,"uses":[],"endpoint_count":0,"snippet":""},{"index":6,"length":71,"uses":[],"endpoint_count":0,"snippet":"(function(html){html.className += ' lp-js'})(document.documentElement);"},{"index":7,"length":880,"uses":[],"endpoint_count":0,"snippet":"\/\/ When window has finished loading window.addEventListener(\"load\", function () { \/\/ This is the \"accept all\" cookie button var vizzitAcceptAll = document.querySelector(\"#cc-b-acce"},{"index":8,"length":431,"uses":[],"endpoint_count":0,"snippet":"window.sv = window.sv || {}; sv.UNSAFE_MAY_CHANGE_AT_ANY_GIVEN_TIME_webAppExternals = {}; sv.PageContext = { pageId: '4.ANONYMIZEDID', siteId: '2.ANONYMIZEDID"}][]Tracking or analytics cookies are set in the initial response before explicit consent can be verified.Accept control was detected, but no equally clear reject/necessary-only control was detected.Cookie/consent text was detected, but no manage/preferences control was found.No clear withdrawal/change-consent control was detected in the returned page.CSP quality is weak or incompleteHTTP mixed-content references were found on an HTTPS pageService worker or PWA capability signals were foundBlock analytics, advertising, replay and tracking cookies until the visitor actively accepts the relevant category.Add a Reject all / Necessary only option on the first banner layer.Expose a Manage choices / Cookie settings control.Add a persistent Cookie settings or Privacy settings link in the footer or privacy area.Move all active/passive resources to HTTPS.Review service-worker scope, cache behavior, update strategy, push permissions, and sensitive data caching.No enforced CSP was available to compare against page assetsThis tab focuses on domain impersonation and trusted senders: SPF, DKIM, DMARC, mail providers and external services authorized to send mail for the domain.
| Domain | SPF Status | SPF Policy | DKIM Status | DKIM Selectors | DMARC Status | DMARC Policy | Email Protection |
|---|---|---|---|---|---|---|---|
| example-customer-11.com | PRESENT |
STRICT (-all)
2 external senders / legal review
|
PRESENT (1) |
s1
|
PRESENT |
REJECT
2 external senders / legal review
|
EXCELLENT |
| example-customer-17.com | PRESENT |
STRICT (-all)
1 external sender / legal review
|
MISSING | N/A | MISSING |
N/A
1 external sender / legal review
|
MINIMAL |
| example-customer-13.com | PRESENT |
STRICT (-all)
4 external senders / legal review
|
MISSING | N/A | PRESENT |
REJECT
4 external senders / legal review
|
BASIC |
| example-customer-21.com | PRESENT |
STRICT (-all)
3 external senders / legal review
|
PRESENT (1) |
selector1
|
PRESENT |
REJECT
3 external senders / legal review
|
EXCELLENT |
| Domain | Record Type | Raw Record | Analysis | Issues | Recommendations |
|---|---|---|---|---|---|
| example-customer-11.com | SPF | v=spf1 ip4:203.0.113.18 ip4:203.0.113.19 include:example-customer-27.com include:_custspf.one.com -all |
Policy: Fail (-all) - Strict policy
Mechanisms: 5
External SPF: 2 authorized senders
External SPF authorization (Unknown) via example-customer-27.com
External SPF authorization (Unknown) via _custspf.one.com
|
• SPF authorizes external mail sender(s); review legal/data-transfer implications.
|
• External SPF authorization via include:example-customer-27.com — SPF authorizes a third-party sender. Review legal role, DPA, subprocessors and data-transfer terms.
• External SPF authorization via include:_custspf.one.com — SPF authorizes a third-party sender. Review legal role, DPA, subprocessors and data-transfer terms.
• Verify each SPF include/redirect against current contracts, DPA/SCC terms, subprocessors and selected processing region.
|
| example-customer-11.com | DMARC | v=DMARC1; p=reject; rua=mailto:contact3@example-customer-23.com; |
Policy:
REJECT
Percentage: 100%
Reports: Enabled
|
• No subdomain policy (sp) specified
|
DMARC configuration is optimal
|
| example-customer-11.com | DKIM |
Selector: s1
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlqIBsKuvpeCqSoNq3q ... |
Key Type: rsa
Key Length: 2048 bits
Version: DKIM1
|
No issues detected |
DKIM configuration looks good
|
| example-customer-17.com | SPF | v=spf1 include:host28.example-customer.com a:mta.example-customer-29.com a:mail.example-customer-30.com a:orion.starse ... |
Policy: Fail (-all) - Strict policy
Mechanisms: 8
External SPF: 1 authorized sender
Microsoft 365 / Exchange Online (US) via host28.example-customer.com
|
• SPF authorizes external mail sender(s); review legal/data-transfer implications.
|
• Microsoft 365 / Exchange Online via include:host28.example-customer.com — US provider; CLOUD Act/FISA exposure may be relevant for EU/EEA data-transfer reviews.
• Verify each SPF include/redirect against current contracts, DPA/SCC terms, subprocessors and selected processing region.
|
| example-customer-17.com | DMARC | Record not found | Missing DMARC policy | No email authentication enforcement | Add DMARC record with appropriate policy |
| example-customer-13.com | SPF | v=spf1 ip4:203.0.113.20 ip4:203.0.113.21 include:_spf.ungapped.io include:_spf.marketing.example-providero ... |
Policy: Fail (-all) - Strict policy
Mechanisms: 7
External SPF: 4 authorized senders
External SPF authorization (Unknown) via _spf.ungapped.io
External SPF authorization (Unknown) via _spf.marketing.example-provideronline.se
External SPF authorization (Unknown) via _spf.example-tech.net
|
• SPF authorizes external mail sender(s); review legal/data-transfer implications.
|
• External SPF authorization via include:_spf.ungapped.io — SPF authorizes a third-party sender. Review legal role, DPA, subprocessors and data-transfer terms.
• External SPF authorization via include:_spf.marketing.example-provideronline.se — SPF authorizes a third-party sender. Review legal role, DPA, subprocessors and data-transfer terms.
• External SPF authorization via include:_spf.example-tech.net — SPF authorizes a third-party sender. Review legal role, DPA, subprocessors and data-transfer terms.
• Verify each SPF include/redirect against current contracts, DPA/SCC terms, subprocessors and selected processing region.
|
| example-customer-13.com | DMARC | v=DMARC1; p=reject; sp=none; rua=mailto:contact4@example-customer-23.com,mailto:contact5@example-customer-23.com; ruf=ma ... |
Policy:
REJECT
Percentage: 100%
Reports: Enabled
|
No issues detected |
DMARC configuration is optimal
|
| example-customer-21.com | SPF | v=spf1 a:mail.example-customer-31.com a:webmail.example-customer-32.com include:host28.example-customer.com include: ... |
Policy: Fail (-all) - Strict policy
Mechanisms: 21
External SPF: 3 authorized senders
Microsoft 365 / Exchange Online (US) via host28.example-customer.com
External SPF authorization (Unknown) via mail.example-customer-33.com
External SPF authorization (Unknown) via host34.example-customer.com
|
• SPF authorizes external mail sender(s); review legal/data-transfer implications.
|
• Microsoft 365 / Exchange Online via include:host28.example-customer.com — US provider; CLOUD Act/FISA exposure may be relevant for EU/EEA data-transfer reviews.
• External SPF authorization via include:mail.example-customer-33.com — SPF authorizes a third-party sender. Review legal role, DPA, subprocessors and data-transfer terms.
• External SPF authorization via include:host34.example-customer.com — SPF authorizes a third-party sender. Review legal role, DPA, subprocessors and data-transfer terms.
• Verify each SPF include/redirect against current contracts, DPA/SCC terms, subprocessors and selected processing region.
|
| example-customer-21.com | DMARC | v=DMARC1; p=reject; |
Policy:
REJECT
Percentage: 100%
|
• No subdomain policy (sp) specified
|
DMARC configuration is optimal
|
| example-customer-21.com | DKIM |
Selector: selector1
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDDnjSO0sjgZGxX5WXnLupkQ6 ... |
Key Type: rsa
Key Length: 1024 bits
Version: DKIM1
|
• RSA valid but short: 1024 bits
|
Consider upgrading to 2048+ bit key
|
| Domain | SPF | DKIM | DMARC | MTA-STS | TLS-RPT | BIMI | DANE | DNSSEC | CAA | Score |
|---|---|---|---|---|---|---|---|---|---|---|
| example-customer-11.com | ✓ | ✓ | ✓ | - | - | ✓ | - | ✓ | ✓ | 115 |
|
BIMI:
Logo: https://example-customer-11.com/wp-content/uploads/Example CustomerIT.svg
|
||||||||||
| example-customer-17.com | ✓ | ✗ | ✗ | - | - | - | - | ✓ | ✗ | 25 |
| example-customer-13.com | ✓ | ✗ | ✓ | - | - | - | - | ✓ | ✗ | 50 |
| example-customer-21.com | ✓ | ✓ | ✓ | - | - | - | - | ✓ | ✗ | 95 |
This tab reviews domain-control signals: DNSSEC, CAA, nameservers, DNS service exposure and mail-related DNS records. It is about governance as much as technical configuration.
| Domain | SPF | DKIM | DMARC | MTA-STS | TLS-RPT | BIMI | DANE | DNSSEC | CAA |
|---|---|---|---|---|---|---|---|---|---|
| example-customer-11.com | ✓ | ✓ | ✓ | - | - | ✓ | - | ✓ | ✓ |
|
BIMI:
Logo: https://example-customer-11.com/wp-content/uploads/Example CustomerIT.svg
|
|||||||||
| example-customer-17.com | ✓ | ✗ | ✗ | - | - | - | - | ✓ | ✗ |
| example-customer-13.com | ✓ | ✗ | ✓ | - | - | - | - | ✓ | ✗ |
| example-customer-21.com | ✓ | ✓ | ✓ | - | - | - | - | ✓ | ✗ |
| Domain | Registrar | Domain Age | Status | Days Until Expiry | Privacy | Registration Details |
|---|---|---|---|---|---|---|
| example-customer-11.com | example-customer-08.com | 17y |
HEALTHY
active
|
361 days | PUBLIC |
Expires: May 22, 2027
Created: May 22, 2009
Updated: May 20, 2026
Age: 18 years
Last updated: 5 days ago
|
| example-customer-17.com | Loopia AB | 20.5y |
HEALTHY
active
|
169 days | PUBLIC |
Expires: Nov 11, 2026
Created: Nov 11, 2005
Updated: Oct 1, 2025
Age: 21 years
Last updated: 236 days ago
|
| example-customer-13.com | NMU Group | 11.2y |
HEALTHY
active
|
282 days | PUBLIC |
Expires: Mar 4, 2027
Created: Mar 4, 2015
Updated: Mar 4, 2026
Age: 12 years
Last updated: 82 days ago
|
| example-customer-21.com | Loopia AB | 31.2y |
HEALTHY
active
|
219 days | PUBLIC |
Expires: Dec 31, 2026
Created: Feb 23, 1995
Updated: Dec 2, 2025
Age: 31.9 years
Last updated: 174 days ago
|
| Domain | Nameserver | ASN / ISP | Provider Type | Port 53 Status | Geographic Location | Regulatory Zone | Risk Assessment |
|---|---|---|---|---|---|---|---|
| example-customer-21.com | host35.example-customer.com |
Not checked during render Unknown |
TRUSTED |
NOT CHECKED
|
Unknown Unknown |
Unknown |
LOW RISK
2 NS
|
| example-customer-21.com | host36.example-customer.com |
Not checked during render Unknown |
TRUSTED |
NOT CHECKED
|
Unknown Unknown |
Unknown |
LOW RISK
2 NS
|
| example-customer-13.com | host06.example-customer.com |
Not checked during render Unknown |
CUSTOM |
NOT CHECKED
|
Unknown Unknown |
Unknown |
REVIEW
Custom provider, 3 NS
|
| example-customer-13.com | host37.example-customer.com |
Not checked during render Unknown |
CUSTOM |
NOT CHECKED
|
Unknown Unknown |
Unknown |
REVIEW
Custom provider, 3 NS
|
| example-customer-13.com | host38.example-customer.com |
Not checked during render Unknown |
CUSTOM |
NOT CHECKED
|
Unknown Unknown |
Unknown |
REVIEW
Custom provider, 3 NS
|
| example-customer-17.com | ns.example-customer-39.com |
Not checked during render Unknown |
CUSTOM |
NOT CHECKED
|
Unknown Unknown |
Unknown |
STANDARD
Custom provider, 2 NS
|
| example-customer-17.com | ns.example-customer-40.com |
Not checked during render Unknown |
CUSTOM |
NOT CHECKED
|
Unknown Unknown |
Unknown |
STANDARD
Custom provider, 2 NS
|
| example-customer-11.com | ns.example-customer-04.com |
Not checked during render Unknown |
CUSTOM |
NOT CHECKED
|
Unknown Unknown |
Unknown |
STANDARD
Custom provider, 2 NS
|
| example-customer-11.com | ns.example-customer-05.com |
Not checked during render Unknown |
CUSTOM |
NOT CHECKED
|
Unknown Unknown |
Unknown |
STANDARD
Custom provider, 2 NS
|
| Domain | DNSSEC Status | Algorithm | Key Tag | Validation | Records Found | CAA Status |
|---|---|---|---|---|---|---|
| example-customer-11.com | ENABLED | ECDSAP256SHA256 | 45820 |
VALID
2 external senders / legal review
|
DS: 1, DNSKEY: 2, RRSIG: 0 | PRESENT (2) |
| example-customer-17.com | DISABLED | N/A | N/A |
N/A
1 external sender / legal review
|
DS: 0, DNSKEY: 0, RRSIG: 0 | MISSING |
| example-customer-13.com | DISABLED | N/A | N/A |
N/A
4 external senders / legal review
|
DS: 0, DNSKEY: 0, RRSIG: 0 | MISSING |
| example-customer-21.com | ENABLED | ECDSAP256SHA256 | 2371 |
VALID
3 external senders / legal review
|
DS: 1, DNSKEY: 2, RRSIG: 0 | MISSING |
| Domain | SPF Status | SPF Policy | DKIM Status | DKIM Selectors | DMARC Status | DMARC Policy | MTA-STS | TLS-RPT | Email Protection |
|---|---|---|---|---|---|---|---|---|---|
| example-customer-11.com | PRESENT |
STRICT (-all)
2 external senders / legal review
|
PRESENT (1) |
s1 |
PRESENT |
REJECT
2 external senders / legal review
|
MISSING | MISSING | EXCELLENT |
| example-customer-17.com | PRESENT |
STRICT (-all)
1 external sender / legal review
|
MISSING | N/A | MISSING |
N/A
1 external sender / legal review
|
MISSING | MISSING | MINIMAL |
| example-customer-13.com | PRESENT |
STRICT (-all)
4 external senders / legal review
|
MISSING | N/A | PRESENT |
REJECT
4 external senders / legal review
|
MISSING | MISSING | BASIC |
| example-customer-21.com | PRESENT |
STRICT (-all)
3 external senders / legal review
|
PRESENT (1) |
selector1 |
PRESENT |
REJECT
3 external senders / legal review
|
MISSING | MISSING | EXCELLENT |
| Domain | Record Type | Severity | Issue | Security Impact | Recommendation |
|---|---|---|---|---|---|
| example-customer-11.com | MTA-STS | LOW | No MTA-STS policy configured | No TLS enforcement for email delivery - potential for downgrade attacks on SMTP connections |
Optional Enhancement:
Add MTA-STS DNS record at _mta-sts.example-customer.se and publish policy file at https://mta.example-customer-41.com/.well-known/mta-sts.txt
|
| example-customer-11.com | TLS-RPT | LOW | No TLS-RPT record configured | No visibility into TLS connection failures - cannot monitor email delivery security issues |
Optional Enhancement:
Add TLS-RPT record: "v=TLSRPTv1; rua=mailto:contact6@example-customer-23.com" for TLS failure monitoring
|
| example-customer-11.com | DANE | LOW | No DANE/TLSA records configured | No certificate pinning for email servers - cannot prevent certificate-based MITM attacks on email delivery |
Optional Enhancement:
Add TLSA records for each MX host (e.g., _25._tcp.mail.example-customer.se). Requires valid DNSSEC to be effective.
|
| example-customer-17.com | DMARC | CRITICAL | No DMARC record found | No email authentication policy enforcement - cannot protect against domain spoofing |
Action Required:
Add DMARC record: "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com" (start with p=none for monitoring)
|
| example-customer-17.com | DKIM | HIGH | No DKIM records found | Emails lack cryptographic signatures - reduced deliverability and trust |
Action Required:
Configure DKIM with your email provider and publish public key DNS records (typically at selector._domainkey.yourdomain.com)
|
| example-customer-17.com | DNSSEC | HIGH | DNSSEC not enabled | DNS cache poisoning vulnerability - attackers can redirect users to malicious sites |
Action Required:
Enable DNSSEC at your domain registrar and add DS records to parent zone
|
| example-customer-17.com | CAA | MEDIUM | No CAA records found | No certificate authority restrictions - any CA can issue certificates for your domain |
Action Required:
Add CAA records to specify authorized CAs: "0 issue letsencrypt.org" or "0 issue pki.goog"
|
| example-customer-17.com | MTA-STS | LOW | No MTA-STS policy configured | No TLS enforcement for email delivery - potential for downgrade attacks on SMTP connections |
Optional Enhancement:
Add MTA-STS DNS record at _mta-sts.example-service.se and publish policy file at https://mta.example-customer-42.com/.well-known/mta-sts.txt
|
| example-customer-17.com | TLS-RPT | LOW | No TLS-RPT record configured | No visibility into TLS connection failures - cannot monitor email delivery security issues |
Optional Enhancement:
Add TLS-RPT record: "v=TLSRPTv1; rua=mailto:contact7@example-customer-23.com" for TLS failure monitoring
|
| example-customer-17.com | BIMI | LOW | No BIMI record configured | Brand logo not displayed in email clients - reduced brand recognition and trust signals |
Optional Enhancement:
Add BIMI record at default._bimi.example-service.se with logo URL and optionally VMC. Requires DMARC policy of quarantine or reject.
|
| example-customer-17.com | DANE | LOW | No DANE/TLSA records configured | No certificate pinning for email servers - cannot prevent certificate-based MITM attacks on email delivery |
Optional Enhancement:
Add TLSA records for each MX host (e.g., _25._tcp.mail.example-service.se). Requires valid DNSSEC to be effective.
|
| example-customer-13.com | DKIM | HIGH | No DKIM records found | Emails lack cryptographic signatures - reduced deliverability and trust |
Action Required:
Configure DKIM with your email provider and publish public key DNS records (typically at selector._domainkey.yourdomain.com)
|
| example-customer-13.com | DNSSEC | HIGH | DNSSEC not enabled | DNS cache poisoning vulnerability - attackers can redirect users to malicious sites |
Action Required:
Enable DNSSEC at your domain registrar and add DS records to parent zone
|
| example-customer-13.com | CAA | MEDIUM | No CAA records found | No certificate authority restrictions - any CA can issue certificates for your domain |
Action Required:
Add CAA records to specify authorized CAs: "0 issue letsencrypt.org" or "0 issue pki.goog"
|
| example-customer-13.com | MTA-STS | LOW | No MTA-STS policy configured | No TLS enforcement for email delivery - potential for downgrade attacks on SMTP connections |
Optional Enhancement:
Add MTA-STS DNS record at _mta-sts.example-provider.se and publish policy file at https://mta.example-customer-43.com/.well-known/mta-sts.txt
|
| example-customer-13.com | TLS-RPT | LOW | No TLS-RPT record configured | No visibility into TLS connection failures - cannot monitor email delivery security issues |
Optional Enhancement:
Add TLS-RPT record: "v=TLSRPTv1; rua=mailto:contact8@example-customer-23.com" for TLS failure monitoring
|
| example-customer-13.com | BIMI | LOW | No BIMI record configured | Brand logo not displayed in email clients - reduced brand recognition and trust signals |
Optional Enhancement:
Add BIMI record at default._bimi.example-provider.se with logo URL and optionally VMC. Requires DMARC policy of quarantine or reject.
|
| example-customer-13.com | DANE | LOW | No DANE/TLSA records configured | No certificate pinning for email servers - cannot prevent certificate-based MITM attacks on email delivery |
Optional Enhancement:
Add TLSA records for each MX host (e.g., _25._tcp.mail.example-provider.se). Requires valid DNSSEC to be effective.
|
| example-customer-21.com | CAA | MEDIUM | No CAA records found | No certificate authority restrictions - any CA can issue certificates for your domain |
Action Required:
Add CAA records to specify authorized CAs: "0 issue letsencrypt.org" or "0 issue pki.goog"
|
| example-customer-21.com | MTA-STS | LOW | No MTA-STS policy configured | No TLS enforcement for email delivery - potential for downgrade attacks on SMTP connections |
Optional Enhancement:
Add MTA-STS DNS record at _mta-sts.example-municipality.se and publish policy file at https://mta.example-customer-44.com/.well-known/mta-sts.txt
|
| example-customer-21.com | TLS-RPT | LOW | No TLS-RPT record configured | No visibility into TLS connection failures - cannot monitor email delivery security issues |
Optional Enhancement:
Add TLS-RPT record: "v=TLSRPTv1; rua=mailto:contact9@example-customer-23.com" for TLS failure monitoring
|
| example-customer-21.com | BIMI | LOW | No BIMI record configured | Brand logo not displayed in email clients - reduced brand recognition and trust signals |
Optional Enhancement:
Add BIMI record at default._bimi.example-municipality.se with logo URL and optionally VMC. Requires DMARC policy of quarantine or reject.
|
| example-customer-21.com | DANE | LOW | No DANE/TLSA records configured | No certificate pinning for email servers - cannot prevent certificate-based MITM attacks on email delivery |
Optional Enhancement:
Add TLSA records for each MX host (e.g., _25._tcp.mail.example-municipality.se). Requires valid DNSSEC to be effective.
|
| Domain | Type | Raw Record Data | Status | Analysis & Recommendations |
|---|---|---|---|---|
| example-customer-11.com | SPF |
v=spf1 ip4:203.0.113.18 ip4:203.0.113.19 include:example-customer-27.com include:_custspf.one.com -all
|
OPTIMAL |
|
| example-customer-11.com | DMARC |
v=DMARC1; p=reject; rua=mailto:contact3@example-customer-23.com;
|
OPTIMAL |
|
| example-customer-11.com | DKIM |
s1._domainkey: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlqIBsKuvpeCqSoNq3qUodolBdrOtcCzirohlsD...
|
OPTIMAL |
|
| example-customer-11.com | DNSSEC |
Algorithm: ECDSAP256SHA256, DS Records: 1, DNSKEY Records: 2
|
OPTIMAL |
|
| example-customer-11.com | CAA |
0 iodef "mailto:contact10@example-customer-23.com"
|
OPTIMAL |
|
| example-customer-11.com | CAA |
0 issuewild "letsencrypt.org"
|
OPTIMAL |
|
| example-customer-11.com | BIMI |
v=BIMI1;l=https://example-customer-11.com/wp-content/uploads/Example CustomerIT.svg
|
REVIEW |
|
| example-customer-17.com | SPF |
v=spf1 include:host28.example-customer.com a:mta.example-customer-29.com a:mail.example-customer-30.com a:host45.example-customer.com a:smtp.example-customer-46.com a:smtp.example-customer-47.com a:host48.example-customer.com -all
|
OPTIMAL |
|
| example-customer-13.com | SPF |
v=spf1 ip4:203.0.113.20 ip4:203.0.113.21 include:_spf.ungapped.io include:_spf.marketing.example-provideronline.se include:_spf.example-tech.net include:host28.example-customer.com -all
|
OPTIMAL |
|
| example-customer-13.com | DMARC |
v=DMARC1; p=reject; sp=none; rua=mailto:contact4@example-customer-23.com,mailto:contact5@example-customer-23.com; ruf=mailto:contact5@example-customer-23.com; pct=100; fo=1
|
CRITICAL |
|
| example-customer-21.com | SPF |
v=spf1 a:mail.example-customer-31.com a:webmail.example-customer-32.com include:host28.example-customer.com include:mail.example-customer-33.com include:host34.example-customer.com ip4:203.0.113.22 ip4:203.0.113.17 ip4:203.0.113.23 ip4:203.0.113.24/26 ip4:203.0.113.25 ip4:203.0.113.26 ip4:203.0.113.27 ip4:203.0.113.28/26 ip4:203.0.113.29/25 ip4:203.0.113.30/25 ip4:203.0.113.31/21 ip4:203.0.113.32/22 ip4:203.0.113.33/22 ip4:203.0.113.34 ip4:203.0.113.35/22 -all
|
OPTIMAL |
|
| example-customer-21.com | DMARC |
v=DMARC1; p=reject;
|
OPTIMAL |
|
| example-customer-21.com | DKIM |
selector1._domainkey: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDDnjSO0sjgZGxX5WXnLupkQ6Z3RZNPNjA8pUKa3b0aN7...
|
REVIEW |
|
| example-customer-21.com | DNSSEC |
Algorithm: ECDSAP256SHA256, DS Records: 1, DNSKEY Records: 2
|
OPTIMAL |
|
This tab turns the technical findings into a management action plan. It should be readable by non-specialists while still pointing technical teams toward the evidence tabs.
Generated May 25, 2026 at 1:46 PM • 6 domains analyzed
CVE-2026-7261
CVSS: 9.8
CVE-2022-23943
CVSS: 9.8
CVE-2016-10012
7.8
CVE-2021-21707
5.3
No enforced CSP was observed
No enforced CSP was observed
No enforced CSP was observed
No enforced CSP was observed
Missing default-src
Missing script-src
Missing object-src
Missing base-uri
Missing frame-ancestors
+1 more
Missing frame-ancestors
Missing form-action
Allows 'unsafe-inline'
Allows 'unsafe-eval'
Missing frame-ancestors
Missing form-action
Allows 'unsafe-inline'
Allows 'unsafe-eval'
/wp-admin/
robots.txt path hint: /wp-admin/
/wp-admin/
robots.txt path hint: /wp-admin/
/.well-known/security.txt
/security.txt
/.well-known/security.txt
/security.txt
/.well-known/security.txt
/security.txt
A perfect security score (100) does not mean your systems are fully protected. This automated scan detects common vulnerabilities but cannot identify all security risks. Results may contain false positives or miss certain vulnerabilities. Always verify findings manually and implement additional security measures.
Important: this is not a claim that Scantide found an unknown zero-day. A true zero-day may not have a CVE or stable signature yet. This section highlights exposed products, management surfaces and uncertainty signals that become important when new vendor advisories or fast-moving attacks appear.
This automated scanner focuses on visible internet-facing evidence: infrastructure vulnerabilities, exposed services, certificates, headers, DNS/email signals, third-party web evidence and configuration issues. It is valuable for prioritization, but it is not a complete security audit. Many important risks require authenticated testing, internal visibility, code review, staff process review or specialist tools.
Review MFA, admin accounts, service accounts, password resets, stale users and privileged access. Public scans cannot see whether the right people have the right access.
Every exposed system, supplier, DNS record and mail sender should have an owner, business reason and review date. Unknown ownership is a real risk even when the technology looks clean.
Business-logic flaws, authorization bypasses, payment manipulation and workflow abuse usually require authenticated manual testing and cannot be proven by passive scanning alone.
Hosting, mail, analytics, CDN, CRM and support tools can create privacy, availability and legal exposure. Review contracts, data location, subprocessors and exit plans.
This report mainly shows what is visible from the internet. Use Scantide Auditor on local networks to find internal devices, forgotten servers, exposed services, weak banners, certificate issues and unmanaged assets that external scanning cannot see.
Use Scantide Observe for everyday browsing awareness. It helps users see website risk signals, privacy/tracking behavior, certificate trust, third-party services and compliance clues while they browse, turning security awareness into something visible and practical.
Antivirus is NOT optional. Even with perfect network security, one infected USB drive, malicious email attachment, or compromised website can introduce malware. Modern threats include trojans, keyloggers, spyware, cryptominers, and fileless malware that traditional scanners miss.
A developer spins up a test server, forgets about it after project ends. Server runs outdated software with default passwords. Attackers find it, use it as entry point to internal network. This happens more often than you think.
Attackers register domains like "yourcompany-secure.com" or "yourcompany-login.com" for phishing campaigns. Your customers receive emails from these lookalike domains and enter credentials. Monitor tools: DomainTools, DNSTwist, or manual searches.
Network printers running outdated firmware are often exploited to access internal networks. One casino was breached through a connected fish tank thermometer. Old routers with unpatched vulnerabilities provide persistent backdoor access. These "insignificant" devices are prime targets because they're rarely monitored or updated.
Install enterprise endpoint protection on all devices. Consider EDR solutions like CrowdStrike, Microsoft Defender for Endpoint, or SentinelOne.
Use secure DNS services: Quad9 (203.0.113.36), Cloudflare for Families (203.0.113.37), Cisco Umbrella, or CleanBrowsing to block malicious domains.
Use professional penetration testing after major changes and on a regular risk-based schedule.
Conduct static and dynamic application security testing (SAST/DAST).
Implement SIEM, IDS/IPS, and continuous security monitoring.
Develop and regularly test your incident response and disaster recovery plans.
Provide regular security awareness training for all employees.
Regular audits for GDPR, PCI-DSS, HIPAA, NIS2 or other applicable standards. Review vendors too: where they store/process data, who their subprocessors are, and whether "EU hosted" also means EU-controlled and contractually protected.
Run Scantide Auditor inside trusted networks to discover internal systems, printers, appliances, forgotten services, certificate problems, open ports and local exposure that an internet-facing scan cannot reach.
Deploy Scantide Observe for general browsing so users can see website trust, privacy and third-party risk signals in context. This supports security awareness without relying only on annual training.
Track vendor advisories, CISA KEV-style known exploitation signals and fast-moving security news for exposed products. This is especially important for VPNs, gateways, CMS/admin portals, file-transfer tools and internet-facing management systems.
This report gives a strong external view, but good security also needs internal visibility and user awareness. Use the wider Scantide toolset to cover what this scan cannot fully see by itself.
Use Scantide Auditor from inside the network to identify unmanaged devices, exposed local services, open ports, certificate problems, printer/appliance exposure, old banners and systems that may never appear in an external internet scan.
Use Scantide Observe during normal browsing to show users understandable website risk signals: HTTPS and certificate trust, security headers, trackers, third-party scripts, jurisdiction clues and privacy/compliance indicators. This makes awareness continuous instead of theoretical.
DNS filtering blocks access to malicious domains before connections are made. Configure these at your router, firewall, or individual devices:
203.0.113.36 - Blocks malware and phishing, privacy-focused, no logs
203.0.113.37 - Blocks malware and adult content options
203.0.113.38 - Multiple filtering levels available
Enterprise-grade with reporting and policy controls
203.0.113.39 - Customizable content filtering
Customizable blocklists with analytics and logging
Implementation: Configure these DNS servers in your router/firewall for network-wide protection, or set them on individual devices. Many services offer deployment guides for various platforms.
Automated scanners can produce false positives or miss vulnerabilities due to network conditions, security controls, or scanner limitations. Manually verify critical findings before taking action. When in doubt, consult with cybersecurity professionals.
No security scan can prevent ransomware. Your survival depends on preparation.
⚠️ CRITICAL REALITY CHECK: Ransomware attacks are not "if" but "when." Even with perfect security scores, attackers find ways in through phishing, compromised credentials, or zero-day exploits. The only guaranteed defense is having tested, immutable backups and a solid recovery plan.
Your last line of defense. Without these, ransomware wins.
Ransomware encrypts or deletes your backups before encrypting production systems. You have no recovery option except paying ransom (which often fails anyway).
Backups are useless without the ability to restore them.
Organizations discover their backup encryption keys were stored on encrypted servers, or documentation was outdated. Result: Backups exist but are inaccessible.
Keep business running during and after an attack.
Average ransomware downtime: 21 days. Average cost including ransom, lost revenue, and recovery: $4.54M. Good planning reduces both dramatically.
⏰ Don't wait until you're facing a ransom demand to prepare.
Test your backups and recovery plans TODAY.