download.fi

HTML metadata

Technology

jQuery

1.12.4 known XSS (<3.5)

Analytics

• Google Tag Manager

Third-party hosts loaded (6)

• cdn.afterdawn.fi×24
• ajax.googleapis.com×2
• cdn.onesignal.com×1
• lwadm.com×1
• s1.adform.net×1
• www.googletagmanager.com×1

Social

• facebook
• twitter
• instagram
• tiktok
• youtube

DNS records live

NS

• dns-2.upcloud.afterdawn.net
• dns.upcloud.afterdawn.net

MX

• 10 mail.afterdawn.com

Email authentication partial

SPF

v=spf1 a mx ip4:213.133.104.86 ip4:94.237.124.0/24 ip4:94.237.47.0/24 ip4:194.111.19.82 ip6:2a04:3544:1000:1510:309a:ecff:fee8:0/112 ~all

softfail (~all)

DMARC

v=DMARC1; p=none; sp=none; rua=mailto:dmarc@afterdawn.com,mailto:dmarc_agg@vali.email; adkim=r; aspf=r;

policy: none (monitoring only) · sp=none

DKIM

• k1: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC42uqUvCSszgdCEpj+sXbGz/muJsbxXevSuq8UULn7GXVWa6apehpl8Ko4fhB1vJtdspJwdXrX3RSkHveeMw…

selectors probed

Certificate (current)

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 30/100 Checked live page: https://www.download.fi/

findings

• missing HSTS
• missing Content Security Policy
• missing frame protection
• missing content type protection
• missing Referrer Policy
• missing Permissions Policy

Links to (15)

• youtube.com×1
• x2.fi×1
• upcloud.com×1
• twitter.com×1
• tiktok.com×1
• puhelinvertailu.com×1
• instagram.com×1
• high.fi×1
• hardware.fi×1
• facebook.com×1
• dawn.fi×1
• bsplayer.org×1
• afterdawn.fi×1
• afterdawn.dk×1
• afterdawn.com×1

Linked from (1)

• pystykorvakerho.fi×1