WE DO IT ALL! – We Do It All
HTTPS
DOEL_ANALYSE
makofalltrades.us
IP: 192.0.78.24
ASN: AS2635
Een uitgebreid beveiligings- en netwerkanalyserapport voor makofalltrades.us. Server: nginx. Gehost in US.
- Primaire Poort
- 443
- Scantijd
- Deelbare Rapportlink
- https://sechttp.com/scan/makofalltrades.us
Gedetailleerde Beveiligingsanalyse
Aanvalspad & DDoS-verdedigingsanalyse
Aanvaller
L4-verkeer
L7-verkeer
AS2635 (nginx POP)
L4 Verdedigd
L7 Omzeild
L4 Geblokkeerd
L7-verkeer
Uw Server
Verdedigingsoverzicht
Hoewel nginx robuuste bescherming biedt tegen Layer 4 (netwerklaag) aanvallen, blijft uw server mogelijk kwetsbaar voor geavanceerde Layer 7 (toepassingslaag) aanvallen die standaard CDN-verdedigingen kunnen omzeilen. Aanvullende WAF-regels en beveiligingsmaatregelen aan de applicatiekant worden aanbevolen.
Laag 4 Verdediging
nginx Biedt robuuste bescherming tegen SYN-flood, UDP-versterking en volumetrische aanvallen aan de netwerkrand.
Laag 7 Kwetsbaarheden
Aanvallen op de toepassingslaag die gericht zijn op 1 blootgestelde API-eindpunten vereisen aanvullende WAF-regels en snelheidsbeperking.
Openbaarmaking Serverinformatie
LOWINFO-001
Beschrijving
De server maakt zijn softwaretype bekend: nginx. Dit kan aanvallers helpen potentiële kwetsbaarheden te identificeren.
Aanbeveling
Configureer uw webserver om de Server-header te verbergen of aan te passen om openbaarmaking van informatie te voorkomen.
Ontbrekende X-Frame-Options Header
MEDIUMSEC-002
Beschrijving
De site is niet beschermd tegen clickjacking-aanvallen.
Aanbeveling
Voeg de X-Frame-Options header toe met de waarde 'DENY' of 'SAMEORIGIN' om clickjacking te voorkomen.
Blootstelling Gevoelige Informatie in JavaScript
HIGHJS-001
Beschrijving
Gevonden 23 mogelijk gevoelige variabelen blootgesteld in client-side JavaScript-code.
Aanbeveling
Controleer en verwijder gevoelige informatie uit client-side code. Gebruik omgevingsvariabelen en server-side verwerking voor gevoelige gegevens.
root@sechttp: /var/log/fuzz
root@sechttp : ~ $
> [Code: 200]
/wp-admin/admin-ajax.php [GEVOELIG LEK]
[+] Scan voltooid. Gevonden 1 potentiële lekken.
root@sechttp : ~ $
Poortscanresultaten
| Poort | Dienst | Status | Versie |
|---|---|---|---|
| 80 | HTTP | GESLOTEN | - |
| 443 | HTTPS | OPEN | TLS 1.3 |
| 22 | SSH | GEFILTERD | - |
| 3306 | MySQL | GESLOTEN | - |
HTTP Headers Analyse
date:
Thu, 11 Sep 2025 16:34:52 GMT
link:
<https://wp.me/gh8B8>; rel=shortlink
vary:
Accept-Encoding, accept, content-type, cookie
x-ac:
20.bur _bur HIT
server:
nginx
alt-svc:
clear
x-hacker:
Want root? Visit join.a8c.com/hacker and mention this header.
connection:
keep-alive
host-header:
WordPress.com
content-type:
text/html; charset=UTF-8
server-timing:
a8c-cdn, dc;desc=bur, cache;desc=HIT;dur=1.0
transfer-encoding:
chunked
strict-transport-security:
max-age=31536000
ASN Informatie
ASN: AS2635
IP Adres: 192.0.78.24
Netwerkprefix: 192.0.78.0/24
Organisatie: AUTOMATTIC
Land:
🇺🇸 US
Naam: AUTOMATTIC
Upstream Providers (21)
AS3356
LEVEL3
Level 3 Parent, LLC
🇺🇸 US
upstream
AS1299
TWELVE99
Arelion, f/k/a Telia Carrier
🇸🇪 SE
upstream
AS2914
NTT-DATA-2914
NTT America, Inc.
🇺🇸 US
upstream
AS6939
HURRICANE
Hurricane Electric LLC
🇺🇸 US
upstream
AS30844
LIQUID-AS
Liquid Telecommunications Ltd
🇬🇧 GB
upstream
AS6461
ZAYO-6461
Zayo Bandwidth
🇺🇸 US
upstream
AS9583
SIFY-AS-IN
Sify Limited
🇮🇳 IN
upstream
AS7195
EDGEUNO S.A.S
EDGEUNO S.A.S
🇨🇴 CO
upstream
AS7922
COMCAST-7922
Comcast Cable Communications, LLC
🇺🇸 US
upstream
AS37100
SEACOM-AS
SEACOM Limited
🇲🇺 MU
upstream
AS133296
WEBWERKS-AS-IN
Web Werks India Pvt. Ltd.
🇮🇳 IN
upstream
AS4
ISI-AS
University of Southern California
🇺🇸 US
upstream
AS3356
LEVEL3
Level 3 Parent, LLC
🇺🇸 US
upstream
AS1299
TWELVE99
Arelion, f/k/a Telia Carrier
🇸🇪 SE
upstream
AS2914
NTT-DATA-2914
NTT America, Inc.
🇺🇸 US
upstream
AS6939
HURRICANE
Hurricane Electric LLC
🇺🇸 US
upstream
AS30844
LIQUID-AS
Liquid Telecommunications Ltd
🇬🇧 GB
upstream
AS9583
SIFY-AS-IN
Sify Limited
🇮🇳 IN
upstream
AS7195
EDGEUNO S.A.S
EDGEUNO S.A.S
🇨🇴 CO
upstream
AS37100
SEACOM-AS
SEACOM Limited
🇲🇺 MU
upstream
AS133296
WEBWERKS-AS-IN
Web Werks India Pvt. Ltd.
🇮🇳 IN
upstream
Internet Exchange Punten (52)
🇺🇸
Equinix Dallas
US
100 Gbps
Bandwidth
🇺🇸
Equinix San Jose
US
20 Gbps
Bandwidth
🇩🇪
DE-CIX Frankfurt
DE
100 Gbps
Bandwidth
🇬🇧
LINX LON1
GB
100 Gbps
Bandwidth
🇺🇸
Equinix Ashburn
US
100 Gbps
Bandwidth
🇺🇸
Equinix Chicago
US
100 Gbps
Bandwidth
🇺🇸
Equinix New York
US
10 Gbps
Bandwidth
🇭🇰
Equinix Hong Kong
HK
10 Gbps
Bandwidth
🇳🇱
NL-ix
NL
20 Gbps
Bandwidth
🇳🇱
AMS-IX
NL
20 Gbps
Bandwidth
🇯🇵
Equinix Tokyo
JP
10 Gbps
Bandwidth
🇯🇵
BBIX Tokyo
JP
10 Gbps
Bandwidth
🇦🇺
MegaIX Sydney
AU
10 Gbps
Bandwidth
🇦🇺
MegaIX Melbourne
AU
10 Gbps
Bandwidth
🇦🇺
MegaIX Brisbane
AU
10 Gbps
Bandwidth
🇳🇿
MegaIX Auckland
NZ
10 Gbps
Bandwidth
🇺🇸
Equinix Miami
US
10 Gbps
Bandwidth
🇺🇸
SIX Seattle
US
100 Gbps
Bandwidth
🇺🇸
Any2West
US
10 Gbps
Bandwidth
🇧🇷
IX.br (PTT.br) São Paulo
BR
100 Gbps
Bandwidth
🇸🇬
Equinix Singapore
SG
100 Gbps
Bandwidth
🇸🇬
BBIX Singapore
SG
10 Gbps
Bandwidth
🇺🇸
Digital Realty Atlanta
US
20 Gbps
Bandwidth
🇺🇸
FL-IX
US
100 Gbps
Bandwidth
🇪🇸
ESpanix Madrid Lower LAN
ES
10 Gbps
Bandwidth
🇦🇹
VIX
AT
30 Gbps
Bandwidth
🇿🇦
NAPAfrica IX Johannesburg
ZA
100 Gbps
Bandwidth
🇪🇸
DE-CIX Madrid
ES
10 Gbps
Bandwidth
🇯🇵
JPNAP Tokyo
JP
10 Gbps
Bandwidth
🇯🇵
JPNAP Osaka
JP
10 Gbps
Bandwidth
🇸🇪
Netnod Stockholm GREEN -- MTU1500
SE
10 Gbps
Bandwidth
🇺🇸
DE-CIX New York
US
10 Gbps
Bandwidth
🇸🇪
Netnod Stockholm BLUE -- MTU1500
SE
10 Gbps
Bandwidth
🇺🇸
Any2Denver
US
10 Gbps
Bandwidth
🇫🇷
France-IX Paris
FR
100 Gbps
Bandwidth
🇮🇹
MIX-IT
IT
20 Gbps
Bandwidth
🇭🇰
HKIX
HK
10 Gbps
Bandwidth
🇨🇦
TorIX
CA
20 Gbps
Bandwidth
🇺🇸
NYIIX New York
US
10 Gbps
Bandwidth
🇺🇸
Equinix Ashburn
US
100 Gbps
Bandwidth
🇺🇸
Any2West
US
10 Gbps
Bandwidth
🇮🇳
DE-CIX Mumbai
IN
10 Gbps
Bandwidth
🇦🇺
NSW-IX
AU
10 Gbps
Bandwidth
🇺🇸
CIX-ATL
US
100 Gbps
Bandwidth
🇭🇺
BiX
HU
10 Gbps
Bandwidth
🇯🇵
JPIX OSAKA
JP
10 Gbps
Bandwidth
🇯🇵
JPIX TOKYO
JP
10 Gbps
Bandwidth
🇺🇸
ChIX
US
100 Gbps
Bandwidth
🇮🇳
WSNL-IX
IN
10 Gbps
Bandwidth
🇳🇱
Speed-IX
NL
10 Gbps
Bandwidth
🇺🇸
DE-CIX Dallas
US
100 Gbps
Bandwidth
🇺🇸
DE-CIX Chicago
US
10 Gbps
Bandwidth
JavaScript Analyse
Security Analysis Alert
Client-side code analysis has identified potential security vulnerabilities and information disclosure risks.
Blootgestelde JavaScript Variabelen
Variables exposed in client-side code that may contain sensitive information
# Security Assessment: Variable Exposure Analysis
LEAK
key
t
Risk: Information disclosure via client-side exposure
LEAK
url
t
Risk: Information disclosure via client-side exposure
LEAK
code
n
Risk: Information disclosure via client-side exposure
LEAK
email
l
Risk: Information disclosure via client-side exposure
LEAK
token
t
Risk: Information disclosure via client-side exposure
LEAK
domain
+o)}var r,i;return o},i=function(t,e,n){var o=encodeURIComponent(
Risk: Information disclosure via client-side exposure
LEAK
mailto
+r;case
Risk: Information disclosure via client-side exposure
LEAK
signal
l
Risk: Information disclosure via client-side exposure
LEAK
e.email
icons/mail.svg
Risk: Information disclosure via client-side exposure
LEAK
avatarUrl
d
Risk: Information disclosure via client-side exposure
LEAK
cell_phone
l
Risk: Information disclosure via client-side exposure
LEAK
home_phone
l
Risk: Information disclosure via client-side exposure
LEAK
profileUrl
n
Risk: Information disclosure via client-side exposure
LEAK
work_phone
l
Risk: Information disclosure via client-side exposure
LEAK
recordEvent
function
Risk: Information disclosure via client-side exposure
LEAK
e.cell_phone
icons/mobile-phone.svg
Risk: Information disclosure via client-side exposure
LEAK
e.home_phone
icons/home-phone.svg
Risk: Information disclosure via client-side exposure
LEAK
e.work_phone
icons/work-phone.svg
Risk: Information disclosure via client-side exposure
LEAK
onMissingKey
null
Risk: Information disclosure via client-side exposure
LEAK
onKeyDownTextarea
a
Risk: Information disclosure via client-side exposure
LEAK
handleNumberKeyPress
a
Risk: Information disclosure via client-side exposure
LEAK
generateStyleVariables
t
Risk: Information disclosure via client-side exposure
LEAK
signalAliasUserGeneral
function
Risk: Information disclosure via client-side exposure
Total: 23 exposed variables found
API Domein Analyse
External API domains discovered in client-side code
EXTERNAL_API_DOMAIN
s.gravatar.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
api.gravatar.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
gravatar.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
0.gravatar.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
pixel.wp.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
github.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
Ontdekte API Eindpunten
API endpoints identified through static analysis of client-side code
GET
/wp-admin/admin-ajax.php
Active
Endpoint discovered via client-side code analysis
JavaScript Bronnen
JavaScript files loaded by the application
JS
https://s0.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build/hooks/index.min.js?m=1744959081i&ver=84e753e2b66eb7028d38
JS
https://s0.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build/i18n/index.min.js?m=1744959081i&ver=bd5a2533e717a1043151
JS
https://s1.wp.com/wp-content/js/rlt-proxy.js?m=1720530689i
JS
https://s1.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build-module/block-library/navigation/view.min.js?ver=38dd13322236f359c8a9
JS
https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/jetpack_vendor/automattic/jetpack-forms/dist/modules/form/view.js?ver=15.1-a.0
JS
//0.gravatar.com/js/hovercards/hovercards.min.js?ver=202536924dcd77a86c6f1d3698ec27fc5da92b28585ddad3ee636c0397cf312193b2a1
JS
https://s2.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1610363240i
JS
https://s1.wp.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?m=1744646400i
JS
https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/jetpack_vendor/automattic/jetpack-forms/dist/blocks/view.js?m=1757006095i&minify=false&ver=5082ee0cbdcde811f7c1
JS
https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/_inc/blocks/business-hours/view.js?m=1725888675i&minify=false&ver=15.1-a.0
JS
//stats.wp.com/w.js?68
JS
/wp-content/js/bilmur.min.js?i=15&m=202536
JS
"https://s0.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build/hooks/index.min.js?m=1744959081i&ver=84e753e2b66eb7028d38"
JS
"https://s0.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build/i18n/index.min.js?m=1744959081i&ver=bd5a2533e717a1043151"
JS
'https://s1.wp.com/wp-content/js/rlt-proxy.js?m=1720530689i'
JS
"https://s1.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build-module/block-library/navigation/view.min.js?ver=38dd13322236f359c8a9"
JS
"https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/jetpack_vendor/automattic/jetpack-forms/dist/modules/form/view.js?ver=15.1-a.0"
JS
"//0.gravatar.com/js/hovercards/hovercards.min.js?ver=202536924dcd77a86c6f1d3698ec27fc5da92b28585ddad3ee636c0397cf312193b2a1"
JS
'https://s2.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1610363240i'
JS
'https://s1.wp.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?m=1744646400i'
JS
"https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/jetpack_vendor/automattic/jetpack-forms/dist/blocks/view.js?m=1757006095i&minify=false&ver=5082ee0cbdcde811f7c1"
JS
"https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/_inc/blocks/business-hours/view.js?m=1725888675i&minify=false&ver=15.1-a.0"
JS
"//stats.wp.com/w.js?68"
JS
"/wp-content/js/bilmur.min.js?i=15&m=202536"
Beveiligingsaanbevelingen
- • Avoid exposing sensitive variables in client-side code
- • Implement proper API authentication and rate limiting
- • Use environment variables for sensitive configuration
- • Regularly audit client-side code for information leaks
- • Minimize the amount of sensitive data processed on the client side
Historische Scanrecords (1)
We Do It All
65/100
4 issues