indexo.dev

jhf.nl

.nl crawl

First seen 2026-06-01 · Last seen 2026-06-02 · ok HTTP/1.1 200 457 ms crawled 2026-06-02

BE · 188.208.37.105 · AS34762 Combell NV

Reputation 94/100 dmarc monitor-only

Classifying

HTML metadata

Title
The Dutch Jewish Humanitarian Fund | JHF
Description
enhances Jewish Life in Central and Eastern Europe (CEE)
Language
en
Generator
Craft CMS

Open Graph

url
https://jhf.nl/
title
The Dutch Jewish Humanitarian Fund
site name
JHF
description
enhances Jewish Life in Central and Eastern Europe (CEE)

Technology

Server
nginx
jQuery
2.2.4 known XSS (<3.5)
Analytics
  • Google Tag Manager

Third-party hosts loaded (1)

  • www.googletagmanager.com×1

Social

Contact

Email
Phone

DNS records live

NS
  • ns1.european-server.eu
  • ns3.european-server.com
  • ns4.european-server.com
MX
  • 0 jhf-nl.mail.protection.outlook.com
Verified for
  • Microsoft 365

Email authentication partial

SPF
v=spf1 include:_spf.mailersend.net mx a ip4:40.107.0.67 include:_spf.relay.mailprotect.be include:spf.protection.outlook.com ip4:185.190.86.75 ~all
softfail (~all)
DMARC
v=DMARC1; p=none; sp=none;
policy: none (monitoring only) · sp=none
DKIM
no key found at common selectors

Certificate (current)

R13
from 2026-04-11 to 2026-07-10
Expires in 38 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 90/100 Checked live page: https://jhf.nl/

present
  • strict-transport-security
  • content-security-policy
  • x-frame-options
  • x-content-type-options
  • referrer-policy
  • permissions-policy
findings
  • CSP allows unsafe inline scripts/styles
  • CSP uses wildcard sources
Header values
referrer-policy
origin
x-frame-options
SAMEORIGIN
permissions-policy
geolocation=(self)
x-content-type-options
nosniff
content-security-policy
default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; img-src 'self' data: www.google-analytics.com www.googletagmanager.com cdn.jsdelivr.net; font-src 'self' data: fonts.gstatic.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com cdn.jsdelivr.net; script-src https 'self' 'unsafe-eval' 'unsafe-inline' cdn.jsdelivr.net www.googletagmanager.com www.google-analytics.com; worker-src blob:; frame-src 'self'; connect-src 'self' www.google-analytics.com analytics.google.com *.google-analytics.com *.analytics.google.com
strict-transport-security
max-age=63072000; includeSubDomains; preload

Links to (4)

Linked from (1)