binance.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

binance.com

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 4 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 11
Warn: 4
Fail: 0

What an auditor would flag first

medium
Security headers
6 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2
low
DMARC
p=quarantine — receivers send to spam
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7

Need this as an artifact your auditor can verify?

Your binance.com scan flagged 1 medium and 3 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=quarantine — receivers send to spam
DKIM1/6 DKIM selectors valid
TLS certificatecert valid for 231 days
Redirect chainHTTPS served correctly
Security headers6 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✗)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2027-04-01
Certificate Transparency17 subdomain(s) found in CT logs (1 wildcard cert(s))

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=60 13.192.229.97
ttl=60 54.95.99.215
ttl=60 3.113.40.92
AAAA: —
NS: ttl=7 ns-1319.awsdns-36.org.
ttl=7 ns-1701.awsdns-20.co.uk.
ttl=7 ns-234.awsdns-29.com.
ttl=7 ns-735.awsdns-27.net.
SOA: ttl=900 ns-735.awsdns-27.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
CAA: —
TXT: ttl=180 "0c095c37-7040-413b-8cf7-09dca0c85bf5=71fd4d87c99f04fd995b7aad459560824dc7b4039a8631ba4386ded49e47924f"
ttl=180 "6gr8gw6zgdmf1590qh3qzcnj3crq5f6x"
ttl=180 "DirectFedAuthUrl=https://binance-devops.okta.com/app/binance-devops_azure_1/exko7oeeoxYlABN6A4x7/sso/saml"
ttl=180 "DirectFedAuthUrl=https://binance.okta.com/app/binance_azureportal_1/exk1brl3su69WMFtd358/sso/saml"
ttl=180 "MS=D31FF5D988DDDB7153A115F1827B162A84C69F6B"
ttl=180 "brave-ledger-verification=81a47ec702afe8d8eeec47aadad537bd0086adf6dbce54466ad507721328a565"
ttl=180 "ca3-db034fa91a494d8da7d577e5cbae92c9"
ttl=180 "docusign=e41ac1a2-97ba-4a73-9ab4-80d67b03b838"
ttl=180 "fARyevT0IDAfLqRcPFTyHCyW"
ttl=180 "facebook-domain-verification=n2otwpnja9hvycz7vq72n7zcbsjczn"
ttl=180 "g161fcffczllxspkxcj215xnhg2ccy5c"
ttl=180 "google-site-verification=FbfML-3x7_Lw0ZNr0jiEpAGipS70RD76Gni7yrwp27c"
ttl=180 "google-site-verification=N-cLYfh9dATCmYDwP_yu_8hTUzNLEPs9GD8_V0gUmeg"
ttl=180 "google-site-verification=oAHlszxw85VnJAPSrnDedi0Bl_BZTY5G1X_ZTDVHSpM"
ttl=180 "google-site-verification=zUAcB1Xn4N69hl_cQSn3Mwj4TGaLSRi0U9VdKsJCfRQ"
ttl=180 "keybase-site-verification=BYsJCGB6nMaHAsZmwgOKRvsBBDUFkwWptpyNCvQxQms"
ttl=180 "mongodb-site-verification=T96XfgL8SO5MnMTaZ115HKHJ4io6nLH7"
ttl=180 "mongodb-site-verification=WUb0QnhXkP1bJNTZfiTdSgstUfq9WI8q"
ttl=180 "onetrust-domain-verification=96e9abfaee504c80833cbb93d913b1e8"
ttl=180 "v=spf1 include:_spf.google.com -all"
ttl=180 "wallet-connect-dns-verification=71fd4d87c99f04fd995b7aad459560824dc7b4039a8631ba4386ded49e47924f"

fetched 2026-05-23T09:22:54.007Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 aspmx.l.google.com.
pri=5 alt1.aspmx.l.google.com.
pri=5 alt2.aspmx.l.google.com.
pri=10 aspmx2.googlemail.com.
pri=10 aspmx3.googlemail.com.

fetched 2026-05-23T09:22:54.006Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 include:_spf.google.com -all

v=spf1
include:_spf.google.com
-all

fetched 2026-05-23T09:22:54.003Z

spf

info

Open standalone →

resolving spf…

dmarc

low

Open standalone →

p=quarantine — receivers send to spam

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Upgrade to p=reject once your SPF and DKIM pass rates are consistently high

v=DMARC1; p=quarantine; rua=mailto:binance@rua.netcraft.com,mailto:dmarc@binance.com; ruf=mailto:binance@ruf.netcraft.com,mailto:dmarc@binance.com;

v=: DMARC1
p=: quarantine
rua=: mailto:binance@rua.netcraft.com,mailto:dmarc@binance.com
ruf=: mailto:binance@ruf.netcraft.com,mailto:dmarc@binance.com

fetched 2026-05-23T09:22:54.172Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPUoNjL0YQ5SMiN6Q0/SRr0HqAKG1lUvvGhHxsorCw2b+tipJwfPvLC05BqZ2PepIgsHDM2kv2jak8lxahjFs+MGqRfk5hAPz0yw3WlRVVQg4S9akJAVD8nVDRWhPLW3e69JWO0McPOibTjHI0AQY2DX1gBxS48W1sE90T0BWbLwIDAQAB
k1:: —
selector1:: —
selector2:: —
mxvault:: —

fetched 2026-05-23T09:22:54.181Z

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 231 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: *.binance.com
issuer:: GeoTrust TLS RSA CA G1 / DigiCert Inc
valid:: Dec 9 00:00:00 2025 GMT → Jan 9 23:59:59 2027 GMT
authorized:: yes
sha256:: B4:FC:8D:3D:AB:BE:3E:3B:A7:86:50:B8:92:3B:52:62:7C:FE:48:A9:1F:28:F2:45:AB:CC:DE:F7:68:0C:44:BB
sans: *.binance.com
binance.com

fetched 2026-05-23T09:22:54.284Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 202 · 2 hops

[301] https://binance.com/
[202] https://www.binance.com/

fetched 2026-05-23T09:22:54.457Z

redirects

info

Open standalone →

tracing redirects…

headers

medium

Open standalone →

6 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Strict-Transport-Security: max-age=15552000; includeSubDomains
Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.binance.com/

security headers

strict-transport-security: —
content-security-policy: —
x-frame-options: —
x-content-type-options: —
referrer-policy: —
permissions-policy: —

other headers

access-control-allow-methods: OPTIONS,GET,POST
access-control-allow-origin: *
access-control-expose-headers: x-amzn-waf-action
access-control-max-age: 86400
cache-control: no-store, max-age=0
connection: keep-alive
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 23 May 2026 09:22:54 GMT
server: CloudFront
via: 1.1 6f990c126ed1cb8a4cfc1686dbe736e8.cloudfront.net (CloudFront)
x-amz-cf-id: SQlDzJBnJ4GQSLbjKy_9V3v5dGARHowLij9F4swYbXZI6fe07TDt0A==
x-amz-cf-pop: IAD61-P12
x-amzn-waf-action: challenge
x-cache: Error from cloudfront

fetched 2026-05-23T09:22:54.448Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:22:54.426Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✗)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: Baiduspider
User-agent: Bingbot
User-agent: DuckDuckBot
User-agent: Slurp
User-agent: Googlebot
Allow: /
Disallow: */price*?hl=
Disallow: */how-to-buy*?hl=
Disallow: */price-prediction*?hl=
Disallow: */altcoins*?hl=
Disallow: *undefine*
Disallow: *UNDEFINE*
Disallow: */activity/challenge-competition/
Disallow: */activity/collect-and-win/
Disallow: */activity/referral-entry/
Disallow: *fbclid=
Disallow: */collected/undefined
Disallow: */advertiserDetail
Disallow: */funding-history
Disallow: */trading-rules
Disallow: */comments
Disallow: */feed/search
Disallow: */version.web
Disallow: */loan/data/
Disallow: */markets/spot-FIAT/
Disallow: */markets/spot-USDT/
Disallow: */OTC-Trading/
Disallow: */backtest/
Disallow: */buy-sell-crypto/referral/
Disallow: */chart-webview/
Disallow: */chat/
Disallow: */complaint-form/
Disallow: */compliance-confirm/
Disallow: */convert-modal-ui/
Disallow: */customindicator/
Disallow: */delivery/
Disallow: */crypto/recurring/
Disallow: */deposit/result/order-v3/
Disallow: */my/

Disallow: */buy-sell-crypto/buy-sell/result/buy/
Disallow: */buy-sell-crypto/buy-sell/result/sell/
Disallow: */survey/
Disallow: */mp-cms/app/
Disallow: */kyc-ui/
Disallow: */sitemap_.xml
Disallow: */my/user-support/feedback/
Disallow: */fiat/deposit/result/order
Disallow: */bapi/
Disallow: */api/
Disallow: */fapi/
Disallow: */fvideo/
Disallow: */en-AU/square
Disallow: */en-GB/square
Disallow: */square/creator-center/
Disallow: */square/notification
Disallow: */square/bookmark
Disallow: */square/settings
Disallow: /*?sqb=
Allow: */bapi/fe/
Allow: */sitemap_output/
Allow: */feed/sitemap/
Allow: */funding-history/perpetual/
Allow: */funding-history/quarterly/

User-agent: Yandex
Disallow: /*ref=
Disallow: /*symbol=
Disallow: /*version=
Disallow: /*theme=
Disallow: /*contract=
Disallow: /*code=
Disallow: /*tab=
Disallow: /*poolId=
Disallow: /*type=
Disallow: /*layout=
Disallow: /*navId=
Disallow: /*contract=
Disallow: /*channel=
Disallow: /*utm_source=
Disallow: /*source=
Disallow: /*utm=

Clean-param: layout
Clean-param: callback
Clean-param: fiat
Clean-param: from
Clean-param: _escaped_fragment_
Clean-param: type
Clean-param: r&return_to&productid
Clean-param: asset
Clean-param: packetId
Clean-param: shareCode

User-agent: *
Allow: */activity/challenge-competition/
Allow: */activity/collect-and-win/
Allow: */activity/referral-entry/
Disallow: */feed/sitemap/
Host: https://www.binance.com
Sitemap: https://www.binance.com/sitemap_output/domain=www.binance.com/sitemap_Trade_index.xml
Sitemap: https://www.binance.com/sitemap_output/domain=www.binance.com/sitemap_Price_index.xml
Sitemap: https://www.binance.com/sitemap_output/domain=www.binance.com/sitemap_Buy_index.xml
Sitemap: https://www.binance.com/sitemap_output/domain=www.binance.com/sitemap_Blog_index.xml
Sitemap: https://www.binance.com/sitemap_output/domain=www.binance.com/sitemap_Nft_index.xml
Sitemap: https://www.binance.com/sitemap_output/domain=www.binance.com/sitemap_SupportAndAnnouncement_index.xml
Sitemap: https://www.binance.com/sitemap_output/domain=www.binance.com/sitemap_PricePrediction_index.xml
Sitemap: https://www.binance.com/sitemap_output/domain=www.binance.com/sitemap_Futures_index.xml
Sitemap: https://www.binance.com/sitemap_output/domain=www.binance.com/sitemap_Earn_index.xml
Sitemap: https://www.binance.com/sitemap_output/domain=www.binance.com/sitemap_Loan_index.xml
Sitemap: https://www.binance.com/sitemap_output/domain=www.binance.com/sitemap_Market_index.xml
Sitemap: https://www.binance.com/sitemap_output/domain=www.binance.com/sitemap_Default_index.xml
Sitemap: https://www.binance.com/sitemap_output/domain=www.binance.com/sitemap_Fiat_index.xml
Sitemap: https://www.binance.com/sitemap_output/domain=www.binance.com/sitemap_Live_index.xml
Sitemap: https://www.binance.com/sitemap_output/domain=www.binance.com/sitemap_Crypto_index.xml
Sitemap: https://www.binance.com/sitemap_output/domain=www.binance.com/sitemap_Square_index.xml
Sitemap: https://www.binance.com/sitemap_output/domain=www.binance.com/sitemap_Academy_index.xml
Sitemap: htt

sitemap.xml

absent

head

title: —
description: —

social

no OpenGraph or Twitter meta tags found

fetched 2026-05-23T09:22:54.600Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:22:54.005Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2027-04-01

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: MarkMonitor Inc.
created: 2017-04-01T16:48:33Z
expires: 2027-04-01T16:48:33Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited, serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited, serverTransferProhibited https://icann.org/epp#serverTransferProhibited, serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited

fetched 2026-05-23T09:22:54.174Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: AbortError: This operation was aborted; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: AbortError: This operation was aborted; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.