Report: taletok.com

01

WHOIS & DNS

DNS records retrieved — SPF & DMARC present

· LOW

▾

// whois

// dns records

A                     185.113.11.31
www A                 185.113.11.31
MX 0                  mail.taletok.com

// ip whois (1)

185.113.11.31         SSL unavailable for this endpoint, order a key at https://members.ip-api.com/ whois ↗

// lookup on dnsarchive.net

same IP 185.113.11.31 ↗

same MX mail.taletok.com ↗

// email security

✓ SPF

v=spf1 mx include:relay.mailchannels.net ~all

✓ DMARC

v=DMARC1; p=none;

// findings (7)

✓ ok SPF record present
✓ ok DMARC record present
✓ ok 1 MX record(s) configured
· low No CAA records — any certificate authority can issue certs for this domain
· low No MTA-STS DNS record at _mta-sts — inbound mail can be downgraded
· low No TLS-RPT record at _smtp._tls — no visibility into TLS delivery failures
· low Certificate Transparency: 19 subdomain(s) ever issued certs — autodiscover.taletok.com, blog.taletok.com, cpanel.taletok.com, cpcalendars.taletok.com, cpcontacts.taletok.com, gardsten.taletok.com (+13 more)

// external references

DNS history on dnsarchive.net ↗

02

SSL / TLS Certificate

Valid certificate, expires in 47 days — TLSv1.3

· LOW

▾

// raw output

issuer                      R13
subject                     taletok.com
valid from                  Mar 19 06:55:04 2026 UTC
valid to                    Jun 17 06:55:03 2026 UTC
tls version                 TLSv1.3

// findings (3)

· low Certificate renews in 47 days — check auto-renewal
✓ ok TLS 1.3 in use — best available protocol
✓ ok HTTP redirects to HTTPS in 1 hop(s)

03

CMS Detection

WordPress detected — 1 plugins found

◐ MEDIUM

▾

// raw output

platform                    WordPress
theme                       generatepress
plugins                     1 detected
  plugin.01                 independent-analytics
xmlrpc.php                  exposed
login path                  /wp-login.php (default)
user enum                   protected

// findings (2)

◐ medium XML-RPC endpoint is publicly accessible
· low Login URL uses default path — consider hiding or rate-limiting

04

Security Headers

7 of 7 headers missing

▲ HIGH

▾

// raw output

HSTS                        MISSING
CSP                         MISSING
X-Frame-Options             MISSING
X-Content-Type-Options      MISSING
Referrer-Policy             MISSING
Permissions-Policy          MISSING
Cross-Origin-Opener         MISSING

// findings (8)

◐ medium HSTS not set — browsers may allow HTTP connections
▲ high X-Content-Type-Options missing — MIME-sniffing possible
▲ high X-Frame-Options missing — clickjacking attacks possible
◐ medium Referrer-Policy missing — leaking referrer data to third parties
◐ medium Content-Security-Policy missing — site exposed to XSS injection
◐ medium Permissions-Policy missing — browser features not restricted
· low Cross-Origin-Opener-Policy not set
· low No /.well-known/security.txt — researchers cannot find a contact for vulnerability reports

05

Raw HTTP Headers

HTTP/3 · 8 headers · LiteSpeed

▲ HIGH

▾

// detected

◉ LiteSpeed Web server: LiteSpeed

✖ PHP version exposed X-Powered-By leaks the PHP version: PHP/8.2.30 — strip this header (expose_php = Off or Header unset X-Powered-By)

⚡ HTTP/3 HTTP/3 (QUIC) in use — fastest available protocol, low latency and connection migration

// raw headers (8)

status                        HTTP/3 200
date                          Fri, 01 May 2026 13:05:00 GMT
vary                          Accept-Encoding, Cookie
server                        LiteSpeed
alt-svc                       h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-… 
content-type                  text/html; charset=UTF-8
x-powered-by                  PHP/8.2.30
cache-control                 max-age=3, must-revalidate

// findings (5)

✓ ok Web server: LiteSpeed
▲ high PHP version exposed via X-Powered-By: PHP/8.2.30
✓ ok HTTP/3 enabled — best available
· low No response compression detected — consider enabling GZIP or Brotli
✓ ok Cache-Control: max-age=3, must-revalidate

06

External JS Libraries

No external JS libraries detected

✓ OK

▾

// raw output

external scripts            0 detected

// findings (1)

✓ ok No third-party JavaScript files loaded

07

Malware & Blocklists

Clean — not present on any monitored blocklist

✓ OK

▾

// raw output

Google Safe Browsing        clean
VirusTotal                  clean
injected scripts            0 detected
malware patterns            0 matches

// findings (3)

✓ ok Google Safe Browsing — clean
✓ ok VirusTotal — clean
✓ ok No malware signatures found across monitored blocklists