agendatrad.org security report

Certificate, security headers, email authentication, DNS, registration, and exposed hosts — from public sources.

24risk

Low

Minor observations only.

0Critical

0High

3Medium

5Low

1Info

Collected 17 hours ago61.5sfrom cache

Headers—

unavailable

Certificate Transparency5
DNS resolution4
Network ownership0
CDN / WAF detection0
Exposed ports & CVEs12
Registration
DNS posture2
Email authentication2
Certificate
Security headers
Archived URLs
Analysis9

noteCertificate inspection is unavailable in this runtime.
noteNetwork ownership lookup is unavailable in this runtime; ASN and org are omitted.
noteCDN/WAF detection is unavailable in this runtime.
noteSecurity headers did not complete (20). Results below are partial.

FTP transmits credentials in cleartext.
What to do
Restrict 21/tcp to a VPN, bastion, or allow-listed source range.
asset: 146.59.152.17:21
Public SSH invites credential stuffing and key brute force.
What to do
Restrict 22/tcp to a VPN, bastion, or allow-listed source range.
asset: 146.59.152.17:22
Public SSH invites credential stuffing and key brute force.
What to do
Restrict 22/tcp to a VPN, bastion, or allow-listed source range.
asset: 162.19.24.229:22
146.59.152.17 (agendatrad.org) reports openssh 10.0p2. Publishing precise versions lets anyone match the host against a CVE feed without probing it, which is how targets get shortlisted for mass exploitation after a new advisory lands.
What to do
Suppress version tokens in server banners (for example `ServerTokens Prod` in Apache) and keep the packages current.
asset: 146.59.152.17
Check it is not an open relay.
What to do
Restrict 25/tcp to a VPN, bastion, or allow-listed source range.
asset: 146.59.152.17:25
162.19.24.229 (t.agendatrad.org) reports openssh 10.0p2. Publishing precise versions lets anyone match the host against a CVE feed without probing it, which is how targets get shortlisted for mass exploitation after a new advisory lands.
What to do
Suppress version tokens in server banners (for example `ServerTokens Prod` in Apache) and keep the packages current.
asset: 162.19.24.229
Check it is not an open relay.
What to do
Restrict 25/tcp to a VPN, bastion, or allow-listed source range.
asset: 162.19.24.229:25
Check it is not an open relay.
What to do
Restrict 25/tcp to a VPN, bastion, or allow-listed source range.
asset: 213.186.33.5:25
Mail to this domain can be downgraded to plaintext by an on-path attacker, because senders have no way to know TLS is required.
What to do
Publish an MTA-STS policy (a TXT record plus a small HTTPS-hosted file).
asset: agendatrad.org

✓Receives mail via 1 server
mail.phea.fr
!SPFends in ~all
v=spf1 include:_spf.phea.fr include:spf.relay.phea.fr include:spf.mailjet.com ~all
✓DMARCp=reject
v=DMARC1; p=reject; pct=100; rua=mailto:dmarc@phea-fr.uriports.com; ruf=mailto:dmarc@phea-fr.uriports.com; fo=1:d:s
!MTA-STSinbound mail can be downgraded to plaintext

✓DNSSECanswers are signed and validated
✓CAA
0 issue "letsencrypt.org"
✓IPv6 (AAAA)
✓2 nameservers
dns106.ovh.net ns106.ovh.net

✓Registered with OVH sas13.1 years old
agendatrad.org
✓Registration expiry342 days
2027-08-14
✓Transfer lock
client delete prohibited, client transfer prohibited
✓2 nameservers at registry
dns106.ovh.net ns106.ovh.net

Address	Ports	Edge	Network
146.59.152.17 agendatrad.org +9	21222580443995	direct	—
162.19.24.229 t.agendatrad.org +1	222580443	direct	—
213.186.33.5 preprod.agendatrad.org +3	2580	direct	—

Archived URLs

Endpoints the Wayback Machine has kept — config files, backups, scripts. Slow to fetch, so it is here on request.

agendatrad.org security report

Low

Findings

Email authentication

DNS

Registration

Hosts

Hostnames