Public security report
53/100
A means lowest risk and F means highest, like a school report card. How the score is calculated →
Scanned 2026-10-26 · 17 issue(s) found · 11 checks passed
CyberTrust assessed jd.com passively — using only information that is publicly visible on the internet: DNS records, certificates, response headers and reachable services. The result is 53/100, grade F, where A means lowest risk and F means highest, like a school report card.
Email spoofing is possible: a DMARC record exists for jd.com, but its policy is p=none — receivers are asked to report spoofed mail, not to reject it.
Strongest area: reputation and credential exposure (100/100). Weakest area: HTTP security headers (0/100).
17 issue(s) need attention (7 medium, 10 low), while 11 checks passed.
Infrastructure observed: the web server identifies as nginx.
61 subdomain(s) of jd.com resolve publicly.
| Area | Score | Grade | Issues |
|---|---|---|---|
| DNS hygiene | 84 | B | 2 |
| email spoofing defences (SPF/DKIM/DMARC) | 64 | D | 3 |
| external attack surface | 55 | F | 2 |
| IP threat intelligence | — | — | 0 |
| reputation and credential exposure | 100 | A | 0 |
| TLS encryption and certificates | 24 | F | 3 |
| HTTP security headers | 0 | F | 7 |
Grafana/Node on 119.147.159.135:3000 (hosts: e.jd.com, jr.jd.com) faces constant credential stuffing and exploit attempts; weak or default passwords often hand over full access in one try.
Versions TLSv1.0, TLSv1.1 are formally deprecated, fail PCI DSS requirements and are no longer supported by modern browsers; they also enable downgrade attacks and fail compliance audits.
Allowing any origin together with credentials can expose logged-in user data to any website.
Without it, an attacker can strip SSL on the first HTTP request and keep the user on plaintext (SSL stripping), a common attack on public Wi-Fi.
p=none does not stop anything - forged mail still reaches the inbox. It is only meant as an observation phase.
BGP on 119.147.159.135:179 leaks configuration, topology or credentials (SNMP community strings are often 'public') and can be abused for internal pivoting.
64-bit block ciphers are vulnerable to SWEET32 after enough data on one connection, and 3DES is no longer accepted by compliance standards.
The server does not staple the certificate revocation status. Every revocation check becomes an extra round trip to the CA, which slows the first visit and, if the CA endpoint is unreachable or the visitor's network blocks it, leaves the browser without a usable revocation status.
Without it, any injected script runs: session theft, fake payment forms, or card-skimming scripts on compromised pages. CSP limits the damage even when something else fails.
Without it a file uploaded as an image can be executed as HTML/JavaScript on your domain, stealing same-site cookies and sessions.
Without it, attackers overlay a transparent frame of your page and trick users into clicking real actions such as transfers or password changes (clickjacking).
At 90 days the protection expires between visits, periodically reopening the window for SSL stripping.
At 1024 bits (selector k1) the key is considered weak; 1024-bit keys can be broken cheaply, letting attackers sign mail that passes DKIM.
Without it an attacker on the network path can force a downgrade to plaintext and read or modify mail such as contracts and payment details.
Without it any CA may issue certificates for your domain, enabling a lookalike site with a valid padlock.
Without it, attackers can poison caches or forge answers and send visitors to a lookalike server that harvests credentials.
Missing Secure lets cookies travel in plaintext; missing HttpOnly lets injected scripts steal sessions; missing SameSite enables CSRF. Affected: _jdbgray.
Everything above is what anyone can observe from the internet. Domain owners who verify ownership additionally get the full asset inventory — every subdomain with its open ports and running services — look-alike and typosquatting domains registered against the brand, credential-exposure monitoring, and copy-paste fixes for each finding.
Verify ownership of jd.com (free) → Open the live interactive report →