Free analysis
See what anyone can see of your company online
We check your email, your domain, your website and your servers from the outside, the way an attacker would. No sign-up, in a couple of minutes.
Passive recon of your domain: DNS, email, certificates, website, exposed services and leaks. Public sources only, no sign-up.
- We only look at what is in plain sight. We do not get into or test anything on your systems.
- The full report is free too: it goes to an email address at your company.
- Each domain is analyzed once a day.If someone already analyzed your domain today, you see that same result. That way nobody can use the analyzer to check someone else’s domain over and over.
taruma-pagos.exampleexample
- MediumAnyone can send email in the name of taruma-pagos.example
- LowThe domain's DNS answers are not signed (DNSSEC)
- LowEmail the company receives can travel without encryption
only someone at the company sees
Sniffing taruma-pagos.example
The Lop is checking 10 areas
Checking email
- Company emailEmail: SPF, DMARC and MTA-STS
- Domain settingsDNS: DNSSEC and CAA
- Domain details and expiryDomain registration (RDAP)
- Issued certificatesCertificate Transparency
- Forgotten subdomainsDangling subdomains (CNAME)
- WebsiteSite: TLS, headers and cookies
- Servers in plain sightExposed services (public indexes)
- Leaked passwordsInfostealers and leaks
- Domains that copy yoursLookalike domains (typosquatting)
- BlocklistsReputation (Google Web Risk)
It takes 1 to 3 minutes. You can leave this tab open: the result shows up here.
What anyone can see
taruma-pagos.example
Analyzed Oct 28, 202610 areas checkedUpdated once a day
Example data: Tarumá Pagos is a made-up company. Its findings come from real analyses.
- Medium
Anyone can send email in the name of taruma-pagos.example
Someone can send email in your company's name and have it land in your customers' inbox.
- Low
The domain's DNS answers are not signed (DNSSEC)
Someone could send people who type your website's address somewhere else. It is rare and one setting prevents it.
- Low
Email the company receives can travel without encryption
Email sent to you could be read along the way.
- Low
The website hands out cookies without the basic protections
If another flaw shows up, your users' sessions are more exposed.
- Low
The website is missing its basic security headers
The browser does not get the instructions that stop common attacks.
- Informational
Nothing restricts who can issue certificates for the domain
Any certificate company can issue one in your domain's name, not only the one you use.
- Informational
Nobody receives the reports on who uses the domain's name
If someone sends email pretending to be your company, nobody at the company finds out.
- Informational
The website announces which software and version it runs
It saves work for anyone looking for known flaws in that version.
- Informational
There is no published contact for reporting security flaws
If someone finds a flaw, they do not know who to tell.
- +5
only someone at the company sees.
Full report, free
Do you work at taruma-pagos.example?
We send the full report only to someone at the company. That way your flaws do not end up with a stranger.
My company has no @taruma-pagos.example email
This happens if you use Gmail or another free email. Then you prove it by adding one entry to your domain settings. Only whoever runs the domain can do that, which is why it works as proof.It is in the panel of the company where you bought or renew the domain (for example GoDaddy, Hostinger, Namecheap or Cloudflare), in a section called DNS or DNS zone. If you do not know who runs it, it is usually whoever built your website.
- Type
- TXT
- NameSome panels ask for the full name: _lop-verify.taruma-pagos.example. Others add the domain themselves.
- _lop-verify
- ValueIt is a code just for your domain. It gives nobody access to anything: it only proves someone at the company added it. Copy it exactly, with no spaces.
- lop-verify=7f3k-9q2m-xa41
- Go to the DNS section of your domain panel. If you do not run it, tap "Copy the instructions" and send them to whoever built your site.
- Add a new record with these three values. Do not delete or change the ones already there.
- Come back here and tap "I added it". It usually shows up in minutes; sometimes it takes up to an hour.
- Once we see it, we ask which email to send the report to. That one can be Gmail or any other.
Once the verification is done, you can delete the record.
Can’t get into the DNS? There is another way
Upload a text file to your website with the same code as its only content, at this address:
taruma-pagos.example/.well-known/lop-verify.txt
Whoever built your site can do it in a couple of minutes. Then come back here and tap "I added it".
Verified · ana@taruma-pagos.example
Everything we found at taruma-pagos.example
14 findings5 that were hidden beforeWe sent you a link to come back for 30 days
Example data: Tarumá Pagos is a made-up company. Its findings come from real analyses.
Findings and fixes
For whoever does the fixes: every finding with its steps. PDF, 20 pages
Download PDF
Leadership brief
For whoever decides: what it can cost the company and what the law asks for. PDF, 14 pages
Download PDF
- High
There are subdomains pointing to services that no longer exist · new
Someone can take over those services and publish whatever they want under your company's name.
How to fix it: Delete the records that point to retired services.
- High
3 employee computers are infected with password-stealing programs · new
Their work passwords are already passed around among attackers.
How to fix it: Clean those computers and change their passwords today.
- Medium
The website loads libraries with known flaws · new
There are published attacks that work against those versions.
How to fix it: Update the flagged libraries.
- Medium
There are domains almost identical to the company's, ready to send and receive email · new
They are used to fool your customers with emails that look like yours.
How to fix it: Check who owns each one and tell your customers you never change bank details by email.
- Medium
There are services open to the internet besides the website · new
Every open door is one more place to try to get in.
How to fix it: Close whatever does not need to face the internet.
- Medium
Anyone can send email in the name of taruma-pagos.example
Someone can send email in your company's name and have it land in your customers' inbox.
How to fix it: Publish a DMARC policy that rejects email that does not come from your servers.
- Low
The domain's DNS answers are not signed (DNSSEC)
Someone could send people who type your website's address somewhere else. It is rare and one setting prevents it.
How to fix it: Turn on DNSSEC in the domain's control panel.
- Low
Email the company receives can travel without encryption
Email sent to you could be read along the way.
How to fix it: Require encryption when receiving email (MTA-STS).
- Low
The website hands out cookies without the basic protections
If another flaw shows up, your users' sessions are more exposed.
How to fix it: Mark cookies as Secure, HttpOnly and SameSite.
- Low
The website is missing its basic security headers
The browser does not get the instructions that stop common attacks.
How to fix it: Add the security headers on the server.
- Informational
Nothing restricts who can issue certificates for the domain
Any certificate company can issue one in your domain's name, not only the one you use.
How to fix it: Add a CAA record with your certificate provider.
- Informational
Nobody receives the reports on who uses the domain's name
If someone sends email pretending to be your company, nobody at the company finds out.
How to fix it: Set a mailbox to receive the DMARC reports.
- Informational
The website announces which software and version it runs
It saves work for anyone looking for known flaws in that version.
How to fix it: Hide the version in the server's responses.
- Informational
There is no published contact for reporting security flaws
If someone finds a flaw, they do not know who to tell.
How to fix it: Publish a security.txt file with a contact email.