Scan Report: djihane621.wpchef.site

01

WHOIS & DNS

DNS records retrieved — SPF & DMARC present

· LOW

▸

// whois

registrar             NameCheap, Inc.
registrar url         https://rdap.radix.host/rdap/entity/1068 ↗
created               2019-04-06
expires               2029-04-06
updated               2026-03-07
nameserver            ns1.o2switch.net
nameserver            ns2.o2switch.net
status                client transfer prohibited

// dns records

A                     109.234.165.150
www A                 109.234.165.150
MX 0                  mail.wpchef.site
NS                    ns1.o2switch.net
NS                    ns2.o2switch.net

// ip whois (1)

109.234.165.150       SSL unavailable for this endpoint, order a key at https://members.ip-api.com/ whois ↗

// lookup on dnsarchive.net

same IP 109.234.165.150 ↗

same MX mail.wpchef.site ↗

same NS ns1.o2switch.net ↗ ns2.o2switch.net ↗

// email security

✓ SPF

v=spf1 +a +mx +ip4:109.234.165.150 +include:spf.jabatus.fr ~all

✓ DMARC

v=DMARC1; p=none;

// findings (7)

✓ ok SPF record present
✓ ok DMARC record present
✓ ok 1 MX record(s) configured
· low No CAA records — any certificate authority can issue certs for this domain
· low No MTA-STS DNS record at _mta-sts — inbound mail can be downgraded
· low No TLS-RPT record at _smtp._tls — no visibility into TLS delivery failures
· low Certificate Transparency: 1117 subdomain(s) ever issued certs — abassemayousse.wpchef.site, abaudino.wpchef.site, abettinger.wpchef.site, abironneau.wpchef.site, abladou.wpchef.site, aborto.wpchef.site (+1111 more)

// external references

DNS history on dnsarchive.net ↗

02

SSL / TLS Certificate

Valid certificate, expires in 82 days — TLSv1.3

✓ OK

▸

03

CMS Detection

WordPress detected — 3 plugins found

✓ OK

▸

04

Security Headers

All 7 security headers present

◐ MEDIUM

▸

// raw output

HSTS                        ok (max-age=63072000; includeSubDomains; pre)
CSP                         ok (upgrade-insecure-requests;)
X-Frame-Options             ok (SAMEORIGIN)
X-Content-Type-Options      ok (nosniff)
Referrer-Policy             ok (strict-origin-when-cross-origin)
Permissions-Policy          ok (accelerometer=(), autoplay=(), camera=())
Cross-Origin-Opener         ok (unsafe-none)

// findings (12)

✓ ok Referrer-Policy is configured
✓ ok X-Frame-Options is configured
✓ ok Permissions-Policy is configured
✓ ok X-Content-Type-Options is configured
✓ ok Content-Security-Policy is configured
✓ ok Strict-Transport-Security is configured
✓ ok Cross-Origin-Opener-Policy is configured
◐ medium CSP weakness — no default-src or script-src — falls back to permissive defaults
◐ medium CSP weakness — no frame-ancestors — clickjacking only protected by X-Frame-Options
◐ medium CSP weakness — no object-src — should be set to 'none'
◐ medium CSP weakness — no base-uri — base tag injection unrestricted
· low No /.well-known/security.txt — researchers cannot find a contact for vulnerability reports

05

Raw HTTP Headers

HTTP/3 · 18 headers · o2switch-PowerBoost-v3

✓ OK

▸

// detected

⚡ HTTP/3 HTTP/3 (QUIC) in use — fastest available protocol, low latency and connection migration

✓ Brotli compression Response is Brotli-compressed — best compression ratio for text content

// raw headers (18)

status                        HTTP/3 200
date                          Mon, 14 Sep 2026 14:05:42 GMT
link                          <https://djihane621.wpchef.site/wp-json/>; rel="https://api.w.org/", <https://dj… 
vary                          Accept-Encoding
server                        o2switch-PowerBoost-v3
content-type                  text/html; charset=UTF-8
referrer-policy               strict-origin-when-cross-origin
x-frame-options               SAMEORIGIN
content-encoding              br
permissions-policy            accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capt… 
x-content-type-options        nosniff
content-security-policy       upgrade-insecure-requests;
strict-transport-security     max-age=63072000; includeSubDomains; preload
cross-origin-opener-policy    unsafe-none
access-control-allow-headers  Content-Type, Authorization
access-control-allow-methods  GET,POST
cross-origin-resource-policy  cross-origin
x-permitted-cross-domain-policiesnone

// findings (2)

✓ ok HTTP/3 enabled — best available
✓ ok Brotli (br) compression active

06

External JS Libraries

No external JS libraries detected

✓ OK

▸

07

Malware & Blocklists

Clean — not present on any monitored blocklist

✓ OK

▸