deloox.de security report

Certificate, security headers, email authentication, DNS, registration, and exposed hosts — from public sources.

39risk

Moderate

Some surface to tighten, nothing urgent.

0Critical

0High

9Medium

10Low

1Info

Collected 6 hours ago11.4sfrom cache

Certificate Transparency5
DNS resolution13
Network ownership0
CDN / WAF detection0
Exposed ports & CVEs48
Registration
DNS posture3
Email authentication2
Certificate
Security headers2
Archived URLs
Analysis20

noteCertificate inspection is unavailable in this runtime.
noteNetwork ownership lookup is unavailable in this runtime; ASN and org are omitted.
noteCDN/WAF detection is unavailable in this runtime.
noteNo registration data: RDAP has no record at this level.
note3 hosts were identified as CDN/edge infrastructure from ASN ownership rather than a cdncheck fingerprint.

CSP is the main defence that limits what an injected script can do. Without it, any XSS bug is fully exploitable.
What to do
Start with a report-only policy, tighten it against the reports, then enforce.
asset: https://www.deloox.de/
The browser will also send this cookie over plain http://, where it can be captured.
What to do
Add `Secure` to the cookie.
asset: https://www.deloox.de/
The browser will also send this cookie over plain http://, where it can be captured.
What to do
Add `Secure` to the cookie.
asset: https://www.deloox.de/
The browser will also send this cookie over plain http://, where it can be captured.
What to do
Add `Secure` to the cookie.
asset: https://www.deloox.de/
The browser will also send this cookie over plain http://, where it can be captured.
What to do
Add `Secure` to the cookie.
asset: https://www.deloox.de/
The browser will also send this cookie over plain http://, where it can be captured.
What to do
Add `Secure` to the cookie.
asset: https://www.deloox.de/
The browser will also send this cookie over plain http://, where it can be captured.
What to do
Add `Secure` to the cookie.
asset: https://www.deloox.de/
The browser will also send this cookie over plain http://, where it can be captured.
What to do
Add `Secure` to the cookie.
asset: https://www.deloox.de/
The browser will also send this cookie over plain http://, where it can be captured.
What to do
Add `Secure` to the cookie.
asset: https://www.deloox.de/
Lets browsers guess content types, which turns some upload and text endpoints into script injection points.
What to do
Send `X-Content-Type-Options: nosniff` on every response.
asset: https://www.deloox.de/
Full URLs — including any tokens or IDs in them — are sent to every third party the page links to.
What to do
Send `Referrer-Policy: strict-origin-when-cross-origin`.
asset: https://www.deloox.de/
Without HttpOnly, any injected script can read and exfiltrate this cookie.
What to do
Add `HttpOnly` unless client-side code genuinely needs to read it.
asset: https://www.deloox.de/
Without HttpOnly, any injected script can read and exfiltrate this cookie.
What to do
Add `HttpOnly` unless client-side code genuinely needs to read it.
asset: https://www.deloox.de/
Without HttpOnly, any injected script can read and exfiltrate this cookie.
What to do
Add `HttpOnly` unless client-side code genuinely needs to read it.
asset: https://www.deloox.de/
Without HttpOnly, any injected script can read and exfiltrate this cookie.
What to do
Add `HttpOnly` unless client-side code genuinely needs to read it.
asset: https://www.deloox.de/
Without HttpOnly, any injected script can read and exfiltrate this cookie.
What to do
Add `HttpOnly` unless client-side code genuinely needs to read it.
asset: https://www.deloox.de/
Without HttpOnly, any injected script can read and exfiltrate this cookie.
What to do
Add `HttpOnly` unless client-side code genuinely needs to read it.
asset: https://www.deloox.de/
Without HttpOnly, any injected script can read and exfiltrate this cookie.
What to do
Add `HttpOnly` unless client-side code genuinely needs to read it.
asset: https://www.deloox.de/
Without HttpOnly, any injected script can read and exfiltrate this cookie.
What to do
Add `HttpOnly` unless client-side code genuinely needs to read it.
asset: https://www.deloox.de/
Mail to this domain can be downgraded to plaintext by an on-path attacker, because senders have no way to know TLS is required.
What to do
Publish an MTA-STS policy (a TXT record plus a small HTTPS-hosted file).
asset: deloox.de

final https://www.deloox.de/status 200time 2950msstack cloudflare

✓http:// redirects to https://
✓Strict-Transport-Security
max-age=31536000
✗Content-Security-Policy
✓Clickjacking protection
sameorigin
✗X-Content-Type-Options
✗Referrer-Policy
–Permissions-Policyoptional
–security.txt publishedoptional — tells researchers where to report bugs

✗Cookie cookieAccept
no Secure · no HttpOnly · no SameSite
✗Cookie PHPSESSID
no Secure · no HttpOnly · no SameSite
✗Cookie country
no Secure · no HttpOnly · no SameSite
✓Cookie salId
Secure · HttpOnly · no SameSite
✓Cookie ship_id
Secure · HttpOnly · no SameSite
✗Cookie consent_set
no Secure · no HttpOnly · no SameSite
✓Cookie consent_set
Secure · HttpOnly · no SameSite
✗Cookie cookie_analysis
no Secure · no HttpOnly · no SameSite
✓Cookie cookie_analysis
Secure · HttpOnly · no SameSite
✗Cookie cookie_functional
no Secure · no HttpOnly · no SameSite
✓Cookie cookie_functional
Secure · HttpOnly · no SameSite
✗Cookie cookie_marketing
no Secure · no HttpOnly · no SameSite
✓Cookie cookie_marketing
Secure · HttpOnly · no SameSite
✗Cookie _ga
no Secure · no HttpOnly · no SameSite

✓Receives mail via 1 server
deloox-de.mail.protection.outlook.com
✓SPFends in -all
v=spf1 ip6:2001:9a8:f9::138:134 ip6:2001:9a8:f9::138:135 ip6:2001:9a8:f9:0:87:233:138:147 ip6:2001:9a8:f9:0:87:233:138:148 ip4:87.233.138.134 ip4:87.233.138.135 ip4:87.233.138.147 ip4:87.233.138.148 include:spf.protection.outlook.com include:spf.mandrillapp.com include:mailgun.org -all
✓DMARCp=quarantine
v=DMARC1; p=quarantine; pct=100; rua=mailto:postmaster@deloox.de; ruf=mailto:postmaster@deloox.de; adkim=r; aspf=r;
!MTA-STSinbound mail can be downgraded to plaintext

✓DNSSECanswers are signed and validated
✓CAA
0 iodef "mailto:abuse@deloox.com" · 0 issue "pki.goog; cansignhttpexchanges=yes" · 0 issue "sectigo.com"
–IPv6 (AAAA)IPv4 only
✓3 nameservers
ns0.transip.net ns1.transip.nl ns2.transip.eu

Address	Ports	Edge	Network
104.26.9.124 c.deloox.de +1	80443205220532082208320862087+5	Cloudflare~	—
172.67.72.42 c.deloox.de +2	80443205220532082208320862087+5	Cloudflare~	—
104.26.8.124 c.deloox.de +1	80443205220532082208320862087+5	Cloudflare~	—
151.101.1.91 email.deloox.de +3	80443	direct	—
151.101.65.91 email.deloox.de +4	80443	direct	—
151.101.129.91 email.deloox.de +3	80443	direct	—
151.101.193.91 email.deloox.de +8	80443	direct	—
87.233.198.107 deloox.de +2	80	direct	—

Archived URLs

Endpoints the Wayback Machine has kept — config files, backups, scripts. Slow to fetch, so it is here on request.

deloox.de security report

Moderate

Findings

Security headers

Email authentication

DNS

Hosts

Hostnames