WE DO IT ALL! – We Do It All
HTTPS
TARGET_ANALYSIS
makofalltrades.us
IP: 192.0.78.24
ASN: AS2635
A comprehensive security and network analysis report for makofalltrades.us. Server: nginx. Hosted in US.
- Primary Port
- 443
- Scan Time
- Shareable Report Link
- https://sechttp.com/scan/makofalltrades.us
Detailed Security Analysis
Attack Path & DDoS Defense Analysis
Attacker
L4 Traffic
L7 Traffic
AS2635 (nginx POP)
L4 Defended
L7 Bypassed
L4 Blocked
L7 Traffic
Your Server
Defense Summary
While nginx provides robust protection against Layer 4 (network-level) attacks, your server remains potentially vulnerable to sophisticated Layer 7 (application-level) attacks that can bypass standard CDN defenses. Additional WAF rules and application-side security measures are recommended.
Layer 4 Defense
nginx provides robust SYN flood, UDP amplification, and volumetric attack protection at the network edge.
Layer 7 Vulnerabilities
Application-layer attacks targeting 1 exposed API endpoints require additional WAF rules and rate limiting.
Server Information Disclosure
LOWINFO-001
Description
The server is disclosing its software type: nginx. This can help attackers identify potential vulnerabilities.
Recommendation
Configure your web server to hide or modify the Server header to prevent information disclosure.
Missing X-Frame-Options Header
MEDIUMSEC-002
Description
The site is not protected against clickjacking attacks.
Recommendation
Add the X-Frame-Options header with value 'DENY' or 'SAMEORIGIN' to prevent clickjacking.
Sensitive Information Exposure in JavaScript
HIGHJS-001
Description
Found 23 potentially sensitive variables exposed in client-side JavaScript code.
Recommendation
Review and remove sensitive information from client-side code. Use environment variables and server-side processing for sensitive data.
root@sechttp: /var/log/fuzz
root@sechttp : ~ $
> [Code: 200]
/wp-admin/admin-ajax.php [SENSITIVE LEAK]
[+] Scan complete. Found 1 potential leaks.
root@sechttp : ~ $
Port Scan Results
| Port | Service | Status | Version |
|---|---|---|---|
| 80 | HTTP | CLOSED | - |
| 443 | HTTPS | OPEN | TLS 1.3 |
| 22 | SSH | FILTERED | - |
| 3306 | MySQL | CLOSED | - |
HTTP Headers Analysis
date:
Thu, 11 Sep 2025 16:34:52 GMT
link:
<https://wp.me/gh8B8>; rel=shortlink
vary:
Accept-Encoding, accept, content-type, cookie
x-ac:
20.bur _bur HIT
server:
nginx
alt-svc:
clear
x-hacker:
Want root? Visit join.a8c.com/hacker and mention this header.
connection:
keep-alive
host-header:
WordPress.com
content-type:
text/html; charset=UTF-8
server-timing:
a8c-cdn, dc;desc=bur, cache;desc=HIT;dur=1.0
transfer-encoding:
chunked
strict-transport-security:
max-age=31536000
ASN Information
ASN: AS2635
IP Address: 192.0.78.24
Network Prefix: 192.0.78.0/24
Organization: AUTOMATTIC
Country:
🇺🇸 US
Name: AUTOMATTIC
Upstream Providers (21)
AS3356
LEVEL3
Level 3 Parent, LLC
🇺🇸 US
upstream
AS1299
TWELVE99
Arelion, f/k/a Telia Carrier
🇸🇪 SE
upstream
AS2914
NTT-DATA-2914
NTT America, Inc.
🇺🇸 US
upstream
AS6939
HURRICANE
Hurricane Electric LLC
🇺🇸 US
upstream
AS30844
LIQUID-AS
Liquid Telecommunications Ltd
🇬🇧 GB
upstream
AS6461
ZAYO-6461
Zayo Bandwidth
🇺🇸 US
upstream
AS9583
SIFY-AS-IN
Sify Limited
🇮🇳 IN
upstream
AS7195
EDGEUNO S.A.S
EDGEUNO S.A.S
🇨🇴 CO
upstream
AS7922
COMCAST-7922
Comcast Cable Communications, LLC
🇺🇸 US
upstream
AS37100
SEACOM-AS
SEACOM Limited
🇲🇺 MU
upstream
AS133296
WEBWERKS-AS-IN
Web Werks India Pvt. Ltd.
🇮🇳 IN
upstream
AS4
ISI-AS
University of Southern California
🇺🇸 US
upstream
AS3356
LEVEL3
Level 3 Parent, LLC
🇺🇸 US
upstream
AS1299
TWELVE99
Arelion, f/k/a Telia Carrier
🇸🇪 SE
upstream
AS2914
NTT-DATA-2914
NTT America, Inc.
🇺🇸 US
upstream
AS6939
HURRICANE
Hurricane Electric LLC
🇺🇸 US
upstream
AS30844
LIQUID-AS
Liquid Telecommunications Ltd
🇬🇧 GB
upstream
AS9583
SIFY-AS-IN
Sify Limited
🇮🇳 IN
upstream
AS7195
EDGEUNO S.A.S
EDGEUNO S.A.S
🇨🇴 CO
upstream
AS37100
SEACOM-AS
SEACOM Limited
🇲🇺 MU
upstream
AS133296
WEBWERKS-AS-IN
Web Werks India Pvt. Ltd.
🇮🇳 IN
upstream
Internet Exchange Points (52)
🇺🇸
Equinix Dallas
US
100 Gbps
Bandwidth
🇺🇸
Equinix San Jose
US
20 Gbps
Bandwidth
🇩🇪
DE-CIX Frankfurt
DE
100 Gbps
Bandwidth
🇬🇧
LINX LON1
GB
100 Gbps
Bandwidth
🇺🇸
Equinix Ashburn
US
100 Gbps
Bandwidth
🇺🇸
Equinix Chicago
US
100 Gbps
Bandwidth
🇺🇸
Equinix New York
US
10 Gbps
Bandwidth
🇭🇰
Equinix Hong Kong
HK
10 Gbps
Bandwidth
🇳🇱
NL-ix
NL
20 Gbps
Bandwidth
🇳🇱
AMS-IX
NL
20 Gbps
Bandwidth
🇯🇵
Equinix Tokyo
JP
10 Gbps
Bandwidth
🇯🇵
BBIX Tokyo
JP
10 Gbps
Bandwidth
🇦🇺
MegaIX Sydney
AU
10 Gbps
Bandwidth
🇦🇺
MegaIX Melbourne
AU
10 Gbps
Bandwidth
🇦🇺
MegaIX Brisbane
AU
10 Gbps
Bandwidth
🇳🇿
MegaIX Auckland
NZ
10 Gbps
Bandwidth
🇺🇸
Equinix Miami
US
10 Gbps
Bandwidth
🇺🇸
SIX Seattle
US
100 Gbps
Bandwidth
🇺🇸
Any2West
US
10 Gbps
Bandwidth
🇧🇷
IX.br (PTT.br) São Paulo
BR
100 Gbps
Bandwidth
🇸🇬
Equinix Singapore
SG
100 Gbps
Bandwidth
🇸🇬
BBIX Singapore
SG
10 Gbps
Bandwidth
🇺🇸
Digital Realty Atlanta
US
20 Gbps
Bandwidth
🇺🇸
FL-IX
US
100 Gbps
Bandwidth
🇪🇸
ESpanix Madrid Lower LAN
ES
10 Gbps
Bandwidth
🇦🇹
VIX
AT
30 Gbps
Bandwidth
🇿🇦
NAPAfrica IX Johannesburg
ZA
100 Gbps
Bandwidth
🇪🇸
DE-CIX Madrid
ES
10 Gbps
Bandwidth
🇯🇵
JPNAP Tokyo
JP
10 Gbps
Bandwidth
🇯🇵
JPNAP Osaka
JP
10 Gbps
Bandwidth
🇸🇪
Netnod Stockholm GREEN -- MTU1500
SE
10 Gbps
Bandwidth
🇺🇸
DE-CIX New York
US
10 Gbps
Bandwidth
🇸🇪
Netnod Stockholm BLUE -- MTU1500
SE
10 Gbps
Bandwidth
🇺🇸
Any2Denver
US
10 Gbps
Bandwidth
🇫🇷
France-IX Paris
FR
100 Gbps
Bandwidth
🇮🇹
MIX-IT
IT
20 Gbps
Bandwidth
🇭🇰
HKIX
HK
10 Gbps
Bandwidth
🇨🇦
TorIX
CA
20 Gbps
Bandwidth
🇺🇸
NYIIX New York
US
10 Gbps
Bandwidth
🇺🇸
Equinix Ashburn
US
100 Gbps
Bandwidth
🇺🇸
Any2West
US
10 Gbps
Bandwidth
🇮🇳
DE-CIX Mumbai
IN
10 Gbps
Bandwidth
🇦🇺
NSW-IX
AU
10 Gbps
Bandwidth
🇺🇸
CIX-ATL
US
100 Gbps
Bandwidth
🇭🇺
BiX
HU
10 Gbps
Bandwidth
🇯🇵
JPIX OSAKA
JP
10 Gbps
Bandwidth
🇯🇵
JPIX TOKYO
JP
10 Gbps
Bandwidth
🇺🇸
ChIX
US
100 Gbps
Bandwidth
🇮🇳
WSNL-IX
IN
10 Gbps
Bandwidth
🇳🇱
Speed-IX
NL
10 Gbps
Bandwidth
🇺🇸
DE-CIX Dallas
US
100 Gbps
Bandwidth
🇺🇸
DE-CIX Chicago
US
10 Gbps
Bandwidth
JavaScript Analysis
Security Analysis Alert
Client-side code analysis has identified potential security vulnerabilities and information disclosure risks.
Exposed JavaScript Variables
Variables exposed in client-side code that may contain sensitive information
# Security Assessment: Variable Exposure Analysis
LEAK
key
t
Risk: Information disclosure via client-side exposure
LEAK
url
t
Risk: Information disclosure via client-side exposure
LEAK
code
n
Risk: Information disclosure via client-side exposure
LEAK
email
l
Risk: Information disclosure via client-side exposure
LEAK
token
t
Risk: Information disclosure via client-side exposure
LEAK
domain
+o)}var r,i;return o},i=function(t,e,n){var o=encodeURIComponent(
Risk: Information disclosure via client-side exposure
LEAK
mailto
+r;case
Risk: Information disclosure via client-side exposure
LEAK
signal
l
Risk: Information disclosure via client-side exposure
LEAK
e.email
icons/mail.svg
Risk: Information disclosure via client-side exposure
LEAK
avatarUrl
d
Risk: Information disclosure via client-side exposure
LEAK
cell_phone
l
Risk: Information disclosure via client-side exposure
LEAK
home_phone
l
Risk: Information disclosure via client-side exposure
LEAK
profileUrl
n
Risk: Information disclosure via client-side exposure
LEAK
work_phone
l
Risk: Information disclosure via client-side exposure
LEAK
recordEvent
function
Risk: Information disclosure via client-side exposure
LEAK
e.cell_phone
icons/mobile-phone.svg
Risk: Information disclosure via client-side exposure
LEAK
e.home_phone
icons/home-phone.svg
Risk: Information disclosure via client-side exposure
LEAK
e.work_phone
icons/work-phone.svg
Risk: Information disclosure via client-side exposure
LEAK
onMissingKey
null
Risk: Information disclosure via client-side exposure
LEAK
onKeyDownTextarea
a
Risk: Information disclosure via client-side exposure
LEAK
handleNumberKeyPress
a
Risk: Information disclosure via client-side exposure
LEAK
generateStyleVariables
t
Risk: Information disclosure via client-side exposure
LEAK
signalAliasUserGeneral
function
Risk: Information disclosure via client-side exposure
Total: 23 exposed variables found
API Domain Analysis
External API domains discovered in client-side code
EXTERNAL_API_DOMAIN
s.gravatar.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
api.gravatar.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
gravatar.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
0.gravatar.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
pixel.wp.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
github.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
Discovered API Endpoints
API endpoints identified through static analysis of client-side code
GET
/wp-admin/admin-ajax.php
Active
Endpoint discovered via client-side code analysis
JavaScript Resources
JavaScript files loaded by the application
JS
https://s0.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build/hooks/index.min.js?m=1744959081i&ver=84e753e2b66eb7028d38
JS
https://s0.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build/i18n/index.min.js?m=1744959081i&ver=bd5a2533e717a1043151
JS
https://s1.wp.com/wp-content/js/rlt-proxy.js?m=1720530689i
JS
https://s1.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build-module/block-library/navigation/view.min.js?ver=38dd13322236f359c8a9
JS
https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/jetpack_vendor/automattic/jetpack-forms/dist/modules/form/view.js?ver=15.1-a.0
JS
//0.gravatar.com/js/hovercards/hovercards.min.js?ver=202536924dcd77a86c6f1d3698ec27fc5da92b28585ddad3ee636c0397cf312193b2a1
JS
https://s2.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1610363240i
JS
https://s1.wp.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?m=1744646400i
JS
https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/jetpack_vendor/automattic/jetpack-forms/dist/blocks/view.js?m=1757006095i&minify=false&ver=5082ee0cbdcde811f7c1
JS
https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/_inc/blocks/business-hours/view.js?m=1725888675i&minify=false&ver=15.1-a.0
JS
//stats.wp.com/w.js?68
JS
/wp-content/js/bilmur.min.js?i=15&m=202536
JS
"https://s0.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build/hooks/index.min.js?m=1744959081i&ver=84e753e2b66eb7028d38"
JS
"https://s0.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build/i18n/index.min.js?m=1744959081i&ver=bd5a2533e717a1043151"
JS
'https://s1.wp.com/wp-content/js/rlt-proxy.js?m=1720530689i'
JS
"https://s1.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build-module/block-library/navigation/view.min.js?ver=38dd13322236f359c8a9"
JS
"https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/jetpack_vendor/automattic/jetpack-forms/dist/modules/form/view.js?ver=15.1-a.0"
JS
"//0.gravatar.com/js/hovercards/hovercards.min.js?ver=202536924dcd77a86c6f1d3698ec27fc5da92b28585ddad3ee636c0397cf312193b2a1"
JS
'https://s2.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1610363240i'
JS
'https://s1.wp.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?m=1744646400i'
JS
"https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/jetpack_vendor/automattic/jetpack-forms/dist/blocks/view.js?m=1757006095i&minify=false&ver=5082ee0cbdcde811f7c1"
JS
"https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/_inc/blocks/business-hours/view.js?m=1725888675i&minify=false&ver=15.1-a.0"
JS
"//stats.wp.com/w.js?68"
JS
"/wp-content/js/bilmur.min.js?i=15&m=202536"
Security Recommendations
- • Avoid exposing sensitive variables in client-side code
- • Implement proper API authentication and rate limiting
- • Use environment variables for sensitive configuration
- • Regularly audit client-side code for information leaks
- • Minimize the amount of sensitive data processed on the client side
Historical Scan Records (1)
We Do It All
65/100
4 issues