maxxim.de security report

Certificate, security headers, email authentication, DNS, registration, and exposed hosts — from public sources.

5risk

Low

Minor observations only.

0Critical

0High

0Medium

2Low

1Info

Collected 3 hours ago5.7sfrom cache

noteCertificate inspection is unavailable in this runtime.
noteNetwork ownership lookup is unavailable in this runtime; ASN and org are omitted.
noteCDN/WAF detection is unavailable in this runtime.
noteNo registration data: RDAP has no record at this level.

Full URLs — including any tokens or IDs in them — are sent to every third party the page links to.
What to do
Send `Referrer-Policy: strict-origin-when-cross-origin`.
asset: https://www.maxxim.de/
Answers for this domain are not signed, so a resolver cannot tell a forged response from a real one.
What to do
Enable DNSSEC at your DNS host and publish the DS record at the registrar.
asset: maxxim.de
Mail to this domain can be downgraded to plaintext by an on-path attacker, because senders have no way to know TLS is required.
What to do
Publish an MTA-STS policy (a TXT record plus a small HTTPS-hosted file).
asset: maxxim.de

final https://www.maxxim.de/status 200time 3114msstack cloudflare

✓http:// redirects to https://
✓Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
✓Content-Security-Policy
default-src 'self'; object-src 'self' https://pts.maxxim.de/p.swf; base-uri 'self'; media-src 'self' https://imagepool.maxxim.de; img-src https: data:; font-src…
✓Clickjacking protection
via CSP frame-ancestors
✓X-Content-Type-Options
nosniff
✗Referrer-Policy
–Permissions-Policyoptional
–security.txt publishedoptional — tells researchers where to report bugs

✓Receives mail via 2 servers
mxint01.1and1.com mxint02.1and1.com
✓SPFends in -all
v=spf1 include:_spf.drillisch.net include:_spf.1und1.de include:_spf.zimpel.de -all
✓DMARCp=reject
v=DMARC1; p=reject; pct=100; rua=mailto:re+y4vmt7on2jm@dmarc.postmarkapp.com; sp=none; aspf=r;
!MTA-STSinbound mail can be downgraded to plaintext

!DNSSECanswers can be forged
✓CAA
0 issuewild "comodoca.com" · 0 issue "comodoca.com" · 0 issue "globalsign.com" · 0 iodef "mailto:postmaster@maxxim.de" · 0 issue "digicert.com" · 0 issuewild "globalsign.com"
–IPv6 (AAAA)IPv4 only
✓4 nameservers
ns-anyslv.ui-dns.biz ns-anyslv.ui-dns.com ns-anyslv.ui-dns.de ns-anyslv.ui-dns.org

Address	Ports	Edge	Network
212.227.177.31 maxxim.de +3	80443	direct	—
212.227.177.32 service.maxxim.de +2	80443	direct	—
63.140.48.217 stats.maxxim.de	80443	direct	—
63.140.48.110 stats.maxxim.de	80443	direct	—
63.140.48.235 stats.maxxim.de	80443	direct	—
51.254.41.51 pts.maxxim.de +1	80443	direct	—
93.191.162.150 mt6.maxxim.de +7	80443	direct	—

Archived URLs

Endpoints the Wayback Machine has kept — config files, backups, scripts. Slow to fetch, so it is here on request.