Report: phoenix-cia.com

01

WHOIS & DNS

DNS records retrieved — SPF & DMARC present

· LOW

▾

// whois

registrar             NameCheap, Inc.
registrar url         http://www.namecheap.com ↗
created               2024-02-29
expires               2027-02-28
updated               2026-01-29
nameserver            dns1.registrar-servers.com
nameserver            dns2.registrar-servers.com
status                client transfer prohibited

// dns records

A                     151.101.2.159
www A                 151.101.2.159
MX 10                 phoenixcia-com01i.mail.protection.outlook.com
NS                    DNS1.REGISTRAR-SERVERS.COM
NS                    DNS2.REGISTRAR-SERVERS.COM

// ip whois (1)

151.101.2.159         SSL unavailable for this endpoint, order a key at https://members.ip-api.com/ whois ↗

// lookup on dnsarchive.net

same IP 151.101.2.159 ↗

same MX phoenixcia-com01i.mail.protection.outlook.com ↗

same NS DNS1.REGISTRAR-SERVERS.COM ↗ DNS2.REGISTRAR-SERVERS.COM ↗

// email security

✓ SPF

v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net -all

✓ DMARC

v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected]; sp=quarantine; fo=1

// txt records (1)

txt.01                google-site-verification=DHOk_ToIEu2cdgP4D5h6oxRsHxM_9chqLDatNG8dA3o

// findings (7)

✓ ok SPF record present
✓ ok DMARC record present
✓ ok 1 MX record(s) configured
· low No CAA records — any certificate authority can issue certs for this domain
· low No MTA-STS DNS record at _mta-sts — inbound mail can be downgraded
· low No TLS-RPT record at _smtp._tls — no visibility into TLS delivery failures
· low Certificate Transparency: 1 subdomain(s) ever issued certs — phoenix-cia.com

// external references

DNS history on dnsarchive.net ↗

// detected services (4)

Google Search Console

Mailchimp

Microsoft 365

Namecheap

02

SSL / TLS Certificate

Valid certificate, expires in 52 days — TLSv1.3

· LOW

▾

// raw output

issuer                      YR1
subject                     phoenix-cia.com
valid from                  Sep 04 21:02:31 2026 UTC
valid to                    Dec 03 21:02:30 2026 UTC
tls version                 TLSv1.3

// findings (3)

· low Certificate renews in 52 days — check auto-renewal
✓ ok TLS 1.3 in use — best available protocol
✓ ok HTTP redirects to HTTPS in 1 hop(s)

03

CMS Detection

WordPress detected — 2 plugins found

◐ MEDIUM

▾

// raw output

platform                    WordPress
theme                       hello-biz
plugins                     2 detected
  plugin.01                 elementor
  plugin.02                 elementor-pro
xmlrpc.php                  not accessible
login path                  /wp-login.php
user enum                   possible (3 users exposed)
  user.01                   Ingrid · @ingrid (id:8)
  user.02                   Phoenix Author · @phoenix (id:3)
  user.03                   SEO · @seo (id:11)

// findings (1)

◐ medium User enumeration possible via REST API — 3 user(s) exposed: Ingrid, Phoenix Author, SEO

04

Security Headers

5 of 7 headers missing

▲ HIGH

▾

// raw output

HSTS                        MISSING
CSP                         MISSING
X-Frame-Options             MISSING
X-Content-Type-Options      ok (nosniff)
Referrer-Policy             ok (no-referrer-when-downgrade)
Permissions-Policy          MISSING
Cross-Origin-Opener         MISSING

// findings (8)

◐ medium HSTS not set — browsers may allow HTTP connections
▲ high X-Frame-Options missing — clickjacking attacks possible
◐ medium Content-Security-Policy missing — site exposed to XSS injection
◐ medium Permissions-Policy missing — browser features not restricted
· low Cross-Origin-Opener-Policy not set
✓ ok Referrer-Policy is configured
✓ ok X-Content-Type-Options is configured
· low No /.well-known/security.txt — researchers cannot find a contact for vulnerability reports

05

Raw HTTP Headers

HTTP/3 · 25 headers · Flywheel/5.1.0

◐ MEDIUM

▾

// detected

▲ Server version exposed Server header reveals version info (Flywheel/5.1.0) — remove or mask the version string

⚡ HTTP/3 HTTP/3 (QUIC) in use — fastest available protocol, low latency and connection migration

✓ GZIP compression Response is GZIP-compressed — reduces bandwidth usage

// raw headers (25)

status                        HTTP/3 200
date                          Mon, 12 Oct 2026 15:16:22 GMT
link                          <https://phoenix-cia.com/>; rel=shortlink
vary                          Accept-Encoding
server                        Flywheel/5.1.0
x-cache                       MISS, HIT
x-timer                       S1791818183.518002,VS0,VE2
x-fw-hash                     9if73zoxja
x-fw-type                     VISIT
x-fw-serve                    TRUE
x-cacheable                   YES
x-fw-server                   Flywheel/5.1.0
x-fw-static                   NO
x-served-by                   cache-chi-klot8100069-CHI, cache-chi-kigq8000038-CHI
content-type                  text/html; charset=UTF-8
x-cache-hits                  0, 0
x-fw-dynamic                  TRUE
x-fw-version                  5.0.0
accept-ranges                 bytes
content-length                30381
fastly-restarts               1
referrer-policy               no-referrer-when-downgrade
content-encoding              gzip
x-xss-protection              1
x-content-type-options        nosniff

// findings (3)

◐ medium Server header exposes version: Flywheel/5.1.0
✓ ok HTTP/3 enabled — best available
✓ ok GZIP compression active

06

External JS Libraries

No external JS libraries detected

✓ OK

▾

// raw output

external scripts            0 detected

// findings (1)

✓ ok No third-party JavaScript files loaded

07

Malware & Blocklists

Clean — not present on any monitored blocklist

✓ OK

▾

// raw output

Google Safe Browsing        clean
VirusTotal                  clean
injected scripts            0 detected
malware patterns            0 matches

// findings (3)

✓ ok Google Safe Browsing — clean
✓ ok VirusTotal — clean
✓ ok No malware signatures found across monitored blocklists