Scan Report: xquik.com

01

WHOIS & DNS

DNS records retrieved — SPF & DMARC present

· LOW

▸

// whois

registrar             Cloudflare, Inc.
registrar url         http://www.cloudflare.com ↗
created               2026-02-19
expires               2027-02-19
updated               2026-06-06
nameserver            gabe.ns.cloudflare.com
nameserver            lauryn.ns.cloudflare.com
status                client transfer prohibited

// dns records

A                     104.21.84.178
A                     172.67.195.116
AAAA                  2606:4700:3037::6815:54b2
AAAA                  2606:4700:3033::ac43:c374
www A                 104.21.84.178
www A                 172.67.195.116
www AAAA              2606:4700:3033::ac43:c374
www AAAA              2606:4700:3037::6815:54b2
MX 10                 inbound-smtp.eu-west-1.amazonaws.com
NS                    GABE.NS.CLOUDFLARE.COM
NS                    LAURYN.NS.CLOUDFLARE.COM

// ip whois (2)

104.21.84.178         SSL unavailable for this endpoint, order a key at https://members.ip-api.com/ whois ↗
172.67.195.116        SSL unavailable for this endpoint, order a key at https://members.ip-api.com/ whois ↗

// lookup on dnsarchive.net

same IP 104.21.84.178 ↗ 172.67.195.116 ↗

same MX inbound-smtp.eu-west-1.amazonaws.com ↗

same NS GABE.NS.CLOUDFLARE.COM ↗ LAURYN.NS.CLOUDFLARE.COM ↗

// email security

✓ SPF

v=spf1 include:amazonses.com ~all

✓ DMARC

v=DMARC1; p=reject; rua=mailto:[email protected]

// txt records (5)

txt.01                google-site-verification=smTKuZE2yyONGA-NvRTTHUuLaTdi6EIEcN9c0wcSgKY
txt.02                n7tquwapk6
txt.03                openai-domain-verification=dv-YTJAgz6miDFiU2iSOFP55fEl
txt.04                v=MCPv1; k=ed25519; p=Jb7XrBpKa/+b7V/zXtKIPkUt7tYA35GcUXZxQVQ9Rjg=
txt.05                yandex-verification: 46a7550a9dcd1c77

// findings (6)

✓ ok SPF record present
✓ ok DMARC record present
✓ ok 1 MX record(s) configured
· low No CAA records — any certificate authority can issue certs for this domain
· low No MTA-STS DNS record at _mta-sts — inbound mail can be downgraded
· low No TLS-RPT record at _smtp._tls — no visibility into TLS delivery failures

// external references

DNS history on dnsarchive.net ↗

// detected services (4)

Amazon SES

Cloudflare

Google Search Console

OpenAI

02

SSL / TLS Certificate

Valid certificate, expires in 59 days — TLSv1.3

· LOW

▸

03

CMS Detection

No CMS detected

✓ OK

▸

04

Security Headers

All 7 security headers present

◐ MEDIUM

▸

// raw output

HSTS                        ok (max-age=31536000; includeSubDomains; pre)
CSP                         ok (default-src 'self'; script-src 'self' 'u)
X-Frame-Options             ok (DENY)
X-Content-Type-Options      ok (nosniff)
Referrer-Policy             ok (strict-origin-when-cross-origin)
Permissions-Policy          ok (camera=(), microphone=(), geolocation=())
Cross-Origin-Opener         ok (same-origin)

// findings (9)

✓ ok Referrer-Policy is configured
✓ ok X-Frame-Options is configured
✓ ok Permissions-Policy is configured
✓ ok X-Content-Type-Options is configured
✓ ok Content-Security-Policy is configured
✓ ok Strict-Transport-Security is configured
✓ ok Cross-Origin-Opener-Policy is configured
◐ medium CSP weakness — 'unsafe-inline' in script-src — defeats most XSS protection
✓ ok /.well-known/security.txt is present (RFC 9116)

05

Raw HTTP Headers

HTTP/3 · 23 headers · cloudflare

◐ MEDIUM

▸

// detected

✓ Cloudflare Site is fronted by Cloudflare — WAF, DDoS protection and CDN caching active

⚡ HTTP/3 HTTP/3 (QUIC) in use — fastest available protocol, low latency and connection migration

▲ Cookie flags missing 1 of 1 cookie(s) missing security flags

// raw headers (23)

status                        HTTP/3 200
nel                           {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
date                          Sat, 18 Jul 2026 10:00:48 GMT
link                          <https://xquik.com/en>; rel="alternate"; hreflang="en", <https://xquik.com/es>; … 
vary                          rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch,… 
cf-ray                        a1d0a434ffc8d2ec-ORD
server                        cloudflare
alt-svc                       h3=":443"; ma=86400
location                      https://xquik.com/en
report-to                     {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare… 
set-cookie                    NEXT_LOCALE=en; Path=/; Expires=Sun, 18 Jul 2027 10:00:48 GMT; Max-Age=31536000;… 
content-type                  text/html; charset=utf-8
x-powered-by                  Next.js
cache-control                 private, no-cache, no-store, max-age=0, must-revalidate
content-length                20
cf-cache-status               DYNAMIC
referrer-policy               strict-origin-when-cross-origin
x-frame-options               DENY
permissions-policy            camera=(), microphone=(), geolocation=()
x-content-type-options        nosniff
content-security-policy       default-src 'self'; script-src 'self' 'unsafe-inline' https://js.stripe.com http… 
strict-transport-security     max-age=31536000; includeSubDomains; preload
cross-origin-opener-policy    same-origin

// findings (5)

✓ ok Cloudflare detected (WAF + CDN)
✓ ok HTTP/3 enabled — best available
· low No response compression detected — consider enabling GZIP or Brotli
✓ ok Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate
◐ medium Cookie NEXT_LOCALE (missing: HttpOnly)

06

External JS Libraries

No external JS libraries detected

✓ OK

▸

07

Malware & Blocklists

Clean — not present on any monitored blocklist

✓ OK

▸