pueblo.us security report

Certificate, security headers, email authentication, DNS, registration, and exposed hosts — from public sources.

38risk

Moderate

Some surface to tighten, nothing urgent.

0Critical

1High

1Medium

3Low

2Info

Collected 11 hours ago31.7sfrom cache

Certificate Transparency5
DNS resolution7
Network ownership0
CDN / WAF detection0
Exposed ports & CVEs12
Registration
DNS posture2
Email authentication2
Certificate
Security headers1
Archived URLs
Analysis7

noteCertificate inspection is unavailable in this runtime.
noteNetwork ownership lookup is unavailable in this runtime; ASN and org are omitted.
noteCDN/WAF detection is unavailable in this runtime.
noteNo registration data: RDAP has no record at this level.

The site could not be loaded over HTTPS and answered only at http://pueblo.us/. Every visit — including any login or form — travels unencrypted and can be read or rewritten by anyone on the path. Browsers mark the page "Not secure".
What to do
Get a certificate (Let’s Encrypt is free), serve the site on 443, then redirect port 80 to it and add HSTS.
asset: http://pueblo.us/
CSP is the main defence that limits what an injected script can do. Without it, any XSS bug is fully exploitable.
What to do
Start with a report-only policy, tighten it against the reports, then enforce.
asset: http://pueblo.us/
Lets browsers guess content types, which turns some upload and text endpoints into script injection points.
What to do
Send `X-Content-Type-Options: nosniff` on every response.
asset: http://pueblo.us/
Full URLs — including any tokens or IDs in them — are sent to every third party the page links to.
What to do
Send `Referrer-Policy: strict-origin-when-cross-origin`.
asset: http://pueblo.us/
Answers for this domain are not signed, so a resolver cannot tell a forged response from a real one.
What to do
Enable DNSSEC at your DNS host and publish the DS record at the registrar.
asset: pueblo.us
Mail to this domain can be downgraded to plaintext by an on-path attacker, because senders have no way to know TLS is required.
What to do
Publish an MTA-STS policy (a TXT record plus a small HTTPS-hosted file).
asset: pueblo.us
Any public certificate authority may issue certificates for this domain. CAA lets you name the ones allowed to.
What to do
Add a CAA record naming your CA, e.g. `0 issue "letsencrypt.org"`.
asset: pueblo.us

final http://pueblo.us/status 403time 30435msstack cloudflare

✗http:// redirects to https://
✗Strict-Transport-Security
✗Content-Security-Policy
✓Clickjacking protection
SAMEORIGIN
✗X-Content-Type-Options
✗Referrer-Policy
–Permissions-Policyoptional
–security.txt publishedoptional — tells researchers where to report bugs

✓Receives mail via 2 servers
mxa-002fe301.gslb.pphosted.com mxb-002fe301.gslb.pphosted.com
✓SPFends in -all
v=spf1 ip4:208.82.107.129 ip4:208.82.107.130 ip4:208.82.107.131 ip4:208.82.107.135 ip4:50.198.211.61/27 ip4:147.136.248.50/28 ip4:52.238.107.37/24 include:spf.protection.outlook.com include:spf-002fe301.pphosted.com a:pueblo-us.mail.protection.outlook.com -all
✓DMARCp=reject
v=DMARC1; p=reject; rua=mailto:quarantine@pueblo.us
!MTA-STSinbound mail can be downgraded to plaintext

!DNSSECanswers can be forged
–CAAany CA may issue
–IPv6 (AAAA)IPv4 only
✓2 nameservers
ns11.domaincontrol.com ns12.domaincontrol.com

Address	Ports	Edge	Network
208.90.190.208 pueblo.us +3	80443	direct	—
100.49.0.246 pay.pueblo.us +4	80443	direct	—
100.49.110.141 pay.pueblo.us +4	80443	direct	—
3.31.3.176 engage.pueblo.us +3	80443	direct	—
3.30.76.196 engage.pueblo.us +3	80443	direct	—
52.222.14.14 engage.pueblo.us +2	80443	direct	—

Archived URLs

Endpoints the Wayback Machine has kept — config files, backups, scripts. Slow to fetch, so it is here on request.

pueblo.us security report

Moderate

Findings

Security headers

Email authentication

DNS

Hosts

Hostnames