25
低风险
2026-05-21 04:17:51
发现的安全问题
- ⚠️[LOW] 服务器信息泄露
- ⚠️[MEDIUM] 缺少 HTTP 安全头
修复建议
- 💡添加 DMARC 记录增强邮件安全
- 💡配置 Web 服务器添加这些安全头
- 💡移除或修改 Server/X-Powered-By 响应头
🌐域名信息
目标域名insighttimer.com
注册域名insighttimer.com
顶级域名.com
🛡️威胁情报 (7 platforms)
Blacklist未列入黑名单
Malware0
Phishing0
Abuse Score0/100
🐛发现的漏洞 (2)
MEDIUM缺少 HTTP 安全头
缺少以下安全头: X-XSS-Protection
修复建议: 配置 Web 服务器添加这些安全头
LOW服务器信息泄露
响应头泄露服务器信息: Server: Google Frontend, X-Powered-By: Express
修复建议: 移除或修改 Server/X-Powered-By 响应头
🔌开放端口 (2)
80
http
443
https
🌐DNS 记录
A: 151.101.1.195
A: 151.101.65.195
MX: 10 aspmx2.googlemail.com.
MX: 1 aspmx.l.google.com.
MX: 5 alt2.aspmx.l.google.com.
MX: 10 aspmx3.googlemail.com.
MX: 5 alt1.aspmx.l.google.com.
NS: ns-cloud-c4.googledomains.com.
NS: ns-cloud-c2.googledomains.com.
NS: ns-cloud-c3.googledomains.com.
NS: ns-cloud-c1.googledomains.com.
TXT: "stripe-verification=72b9b0c1f238dfd0e4ed05d1bf3e56560e8906d5561ce42de8aa878af9ec4be3"
TXT: "pinterest-site-verification=cb76fd4101d9cb23f26ed275eb2383e2"
TXT: "google-site-verification=4Kglbvh41sX-xj-NZx0F0HY5c1iw13e4P6kVIAjke7I"
TXT: "firebase=insight-timer-a1ac7"
TXT: "google-site-verification=lIi46xZ6EfA56VrRc1e2coz1yvw7t0lYzMBB_hiizak"
TXT: "google-site-verification=VF3I_MsbR26kxgRFubxZZItsg1OaTKcuvVI5JmFpKAQ"
TXT: "v=spf1 include:_spf.google.com include:sendgrid.com include:_spf.firebasemail.com ~all"
TXT: "google-site-verification=YTaFmwL1w3lYMLrpmLNcn8fagyvcUVuIfaqISMKJ_Nc"
TXT: "knowbe4-site-verification=2fd9823dba4766e4e3738f98b5e0637f"
TXT: "bchorv5hb3uh4tjepqjg8j3nbn"
TXT: "google-site-verification=vXVdfIl0VuRWvRkb2IkcGP2Vbc_mrbVg_blNlu_axco"
TXT: "figma-domain-verification=5d048440155d6126219b23ccfa6a674e4a284efa3857aaf959a48aad6442d238-1740981714"
TXT: "stripe-verification=3b8aa0d6ed08f46a9be0ba2896c93f1b7c3ad5b750202f7422dfdf5fd44fa00a"
TXT: "google-site-verification=DpaoO0dImzfimF4u4LCutvn3ldbw6RRH1b_4xtL0rV8"
TXT: "nuf10846hpo4lirjth9ssr1pog"
SOA: ns-cloud-c1.googledomains.com. cloud-dns-hostmaster.google.com. 2 21600 3600 259200 300
📋HTTP 响应头
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31556926
Content-Security-Policy: default-src https:; script-src https: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; style-src-elem ht
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(self "https://*.insighttimer.com"), microphone=(self "https://*.insighttimer.com"), fullscreen=(self "https://*.
Server: Google Frontend
X-Powered-By: Express