Scan Report: docs.xquik.com

01

WHOIS & DNS

DNS records retrieved — SPF & DMARC present

· LOW

▸

// whois

registrar             Cloudflare, Inc.
registrar url         http://www.cloudflare.com ↗
created               2026-02-19
expires               2027-02-19
updated               2026-06-06
nameserver            gabe.ns.cloudflare.com
nameserver            lauryn.ns.cloudflare.com
status                client transfer prohibited

// dns records

A                     172.67.195.116
A                     104.21.84.178
AAAA                  2606:4700:3033::ac43:c374
AAAA                  2606:4700:3037::6815:54b2
www A                 172.67.195.116
www A                 104.21.84.178
www AAAA              2606:4700:3037::6815:54b2
www AAAA              2606:4700:3033::ac43:c374
MX 10                 inbound-smtp.eu-west-1.amazonaws.com
NS                    GABE.NS.CLOUDFLARE.COM
NS                    LAURYN.NS.CLOUDFLARE.COM

// ip whois (2)

104.21.84.178         SSL unavailable for this endpoint, order a key at https://members.ip-api.com/ whois ↗
172.67.195.116        SSL unavailable for this endpoint, order a key at https://members.ip-api.com/ whois ↗

// lookup on dnsarchive.net

same IP 172.67.195.116 ↗ 104.21.84.178 ↗

same MX inbound-smtp.eu-west-1.amazonaws.com ↗

same NS GABE.NS.CLOUDFLARE.COM ↗ LAURYN.NS.CLOUDFLARE.COM ↗

// email security

✓ SPF

v=spf1 include:amazonses.com ~all

✓ DMARC

v=DMARC1; p=reject; rua=mailto:[email protected]

// txt records (5)

txt.01                yandex-verification: 46a7550a9dcd1c77
txt.02                google-site-verification=smTKuZE2yyONGA-NvRTTHUuLaTdi6EIEcN9c0wcSgKY
txt.03                n7tquwapk6
txt.04                openai-domain-verification=dv-YTJAgz6miDFiU2iSOFP55fEl
txt.05                v=MCPv1; k=ed25519; p=Jb7XrBpKa/+b7V/zXtKIPkUt7tYA35GcUXZxQVQ9Rjg=

// findings (6)

✓ ok SPF record present
✓ ok DMARC record present
✓ ok 1 MX record(s) configured
· low No CAA records — any certificate authority can issue certs for this domain
· low No MTA-STS DNS record at _mta-sts — inbound mail can be downgraded
· low No TLS-RPT record at _smtp._tls — no visibility into TLS delivery failures

// external references

DNS history on dnsarchive.net ↗

// detected services (4)

Amazon SES

Cloudflare

Google Search Console

OpenAI

02

SSL / TLS Certificate

Valid certificate, EXPIRED — TLSv1.3

✖ CRITICAL

▾

// raw output

issuer                      E8
subject                     docs.xquik.com
valid from                  May 23 02:04:07 2026 UTC
valid to                    Aug 21 02:04:06 2026 UTC
tls version                 TLSv1.3

// findings (3)

✖ critical Certificate has expired
✓ ok TLS 1.3 in use — best available protocol
✓ ok HTTP redirects to HTTPS in 1 hop(s)

03

CMS Detection

No CMS detected

✓ OK

▸

04

Security Headers

4 of 7 headers missing

▲ HIGH

▾

// raw output

HSTS                        ok (max-age=63072000)
CSP                         ok (worker-src * blob: data: 'unsafe-eval' ')
X-Frame-Options             ok (DENY)
X-Content-Type-Options      MISSING
Referrer-Policy             MISSING
Permissions-Policy          MISSING
Cross-Origin-Opener         MISSING

// findings (9)

▲ high X-Content-Type-Options missing — MIME-sniffing possible
◐ medium Referrer-Policy missing — leaking referrer data to third parties
◐ medium Permissions-Policy missing — browser features not restricted
· low Cross-Origin-Opener-Policy not set
✓ ok X-Frame-Options is configured
✓ ok Content-Security-Policy is configured
✓ ok Strict-Transport-Security is configured
◐ medium CSP weakness — no default-src or script-src — falls back to permissive defaults
· low No /.well-known/security.txt — researchers cannot find a contact for vulnerability reports

05

Raw HTTP Headers

HTTP/3 · 27 headers · cloudflare

✓ OK

▸

// detected

✓ Cloudflare Site is fronted by Cloudflare — WAF, DDoS protection and CDN caching active

⚡ HTTP/3 HTTP/3 (QUIC) in use — fastest available protocol, low latency and connection migration

✓ GZIP compression Response is GZIP-compressed — reduces bandwidth usage

// raw headers (27)

status                        HTTP/3 200
age                           7832
date                          Sat, 18 Jul 2026 10:01:22 GMT
link                          </llms.txt>; rel="llms-txt", </llms-full.txt>; rel="llms-full-txt", </.well-know… 
vary                          rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch,… 
cf-ray                        a1d0a5099fff125f-ORD
pragma                        no-cache
server                        cloudflare
expires                       0
location                      https://docs.xquik.com/api-reference/overview
x-version                     dpl_7XJVrS6XwhvnXLKutpbpJWypuPG9
x-llms-txt                    /llms.txt
x-vercel-id                   cle1::iad1::qnt8l-1784361048656-a714e3d56881
content-type                  text/html; charset=utf-8
cache-control                 no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
last-modified                 Sat, 18 Jul 2026 07:50:49 GMT
x-matched-path                /_sites/[subdomain]/[[...slug]]
x-vercel-cache                MISS
cf-cache-status               HIT
x-frame-options               DENY
content-encoding              gzip
x-served-version              dpl_7XJVrS6XwhvnXLKutpbpJWypuPG9
x-vercel-project-id           prj_NdMUpHpUIb41Po1H8c6hrChv2bgr
x-mint-proxy-version          1.0.0-prod
content-security-policy       worker-src * blob: data: 'unsafe-eval' 'unsafe-inline'; object-src data: ; base-… 
strict-transport-security     max-age=63072000
x-mintlify-client-version     0.0.3278

// findings (4)

✓ ok Cloudflare detected (WAF + CDN)
✓ ok HTTP/3 enabled — best available
✓ ok GZIP compression active
✓ ok Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0

06

External JS Libraries

No external JS libraries detected

✓ OK

▸

07

Malware & Blocklists

Threats detected — 1 suspicious indicator(s)

◐ MEDIUM

▸

// raw output

Google Safe Browsing        clean
VirusTotal                  clean
injected scripts            1 detected
malware patterns            1 matches

// findings (3)

✓ ok Google Safe Browsing — clean
✓ ok VirusTotal — clean

▲ high Malware pattern detected: Suspicious setTimeout with redirect

setTimeout(()=\u003e{document.head.removeChild(a)},1)}}();(\"requestAnimationFrame\"in globalThis?requestAnimationFrame:setTimeout)(()=\u003e{let a;a=!1,a=window.scrollY\u003e50,document.getElementById(g)?.setAttribute(\"data-is-opaque\",`${!!a}`),l()})})(\n  true,\n  (function l(a,b,c){let d=document.documentElement.getAttribute(\"data-banner-state\"),e=2.5*!!(null!=d?\"visible\"===d:b),f=3*!!a,g=4,h=e+g+f;switch(c){case\"mint\":case\"palm\":break;case\"aspen\":f=2.5*!!a,g=3.5,h=e+f+g;break;case\"luma\":g=3,h=e+g;break;case\"linden\":g=4,h=e+g;break;case\"almond\":g=3.5,h=e+g;break;case\"sequoia\":f=3*!!a,g=3,h=e+g+f}return h})(true, true, \"maple\"),\n  \"maple\",\n)","id":"_mintlify-scroll-top-script"}])</script><script>(self.__next_s=self.__next_s||[]).push([0,{"suppressHydrationWarning":true,"children":"(function () {\n  var measure = function(){let a=document.querySelectorAll(\"[id='navbar'], [data-top-chrome]\"),b=0;a.forEach(a=\u003e{let c=a.getBoundingClientRect();c.height\u003e0\u0026\u0026(b=Math.max(b,c.bottom))});let c=0,d=document.getElementById(\"content-container\");if(d){let{overflowY:a}=getComputedStyle(d);(\"auto\"===a||\"scroll\"===a)\u0026\u0026(c=Math.max(0,d.getBoundingClientRect().top))}let e=Math.round(Math.max(0,b-c))+40;document.documentElement.style.setProperty(\"--scroll-mt\",`${e}px`)};\n  (function(a){let b=[],c=0,d=\"undefined\"==typeof ResizeObserver?null:new ResizeObserver(f);function e(){let c=Array.from(document.querySelectorAll(\"[id='navbar'], [data-top-chrome]\"));(c.length!==b.length||c.some((a,c)=\u003ea!==b[c]))\u0026\u0026d\u0026\u0026(d.disconnect(),c.forEach(a=\u003ed.observe(a))),b=c,a()}function f(){c||(c=requestAnimationFrame(()=\u003e{c=0,e()}))}new MutationObserver(f).observe(document.documentElement,{childList:!0,subtree:!0}),window.addEventListener(\"resize\",f),\"loading\"===document.readyState\u0026\u0026document.addEventListener(\"DOMContentLoaded\",e),e()})(measure);\n  (function(a){let b=window.location