Does petrochina.com.cn have DMARC protection against email spoofing?

No. No DMARC record was found for petrochina.com.cn, so mail forged from @petrochina.com.cn has no policy-based barrier at all.

How is petrochina.com.cn's F security grade calculated?

CyberTrust scores petrochina.com.cn passively across 6 area(s) — reputation and credential exposure 100/100; DNS hygiene 84/100; HTTP security headers 40/100; email spoofing defences (SPF/DKIM/DMARC) 36/100; external attack surface 32/100; TLS encryption and certificates 0/100 — and combines them by weight into the overall score of 43/100, which maps to grade F.

How many subdomains does petrochina.com.cn expose?

This scan observed 51 publicly resolvable subdomain(s) for petrochina.com.cn. Verified owners get the full list, with each host's open ports and running services.

Public security report

petrochina.com.cn security rating

43/100

A means lowest risk and F means highest, like a school report card. How the score is calculated →

Scanned 2026-10-30 · 24 issue(s) found · 7 checks passed

Re-scan petrochina.com.cn now

What this scan found

CyberTrust assessed petrochina.com.cn passively — using only information that is publicly visible on the internet: DNS records, certificates, response headers and reachable services. The result is 43/100, grade F, where A means lowest risk and F means highest, like a school report card.

Email spoofing is possible: no DMARC record was found for petrochina.com.cn, so anyone can send mail that appears to come from @petrochina.com.cn.

Strongest area: reputation and credential exposure (100/100). Weakest area: TLS encryption and certificates (0/100).

24 issue(s) need attention (1 critical, 6 high, 5 medium, 12 low), while 7 checks passed.

51 subdomain(s) of petrochina.com.cn resolve publicly.

Score by category

Area	Score	Grade	Issues
DNS hygiene	84	B	2
email spoofing defences (SPF/DKIM/DMARC)	36	F	4
external attack surface	32	F	3
IP threat intelligence	—	—	0
reputation and credential exposure	100	A	0
TLS encryption and certificates	0	F	9
HTTP security headers	40	F	6

Issues found (24)

criticalCertificate expired 936 days ago (2024-04-07)

It expired 936 days ago (2024-04-07): browsers show a full-page warning, most visitors leave, and API or app integrations fail without a clear reason.

1 asset(s) affected · worth +6 points · check a certificate with the free SSL tool →

highNo DMARC policy

Without it, spoofed mail is usually delivered as normal and you receive no visibility at all; bulk senders are also required by major mailbox providers to publish DMARC.

1 asset(s) affected · worth +6 points · check any domain's DMARC record with the free DMARC tool →

high1 actively exploited vulnerabilities (CISA KEV) on 223.69.170.30

1 actively exploited vulnerabilities (CVE-2020-11023) match versions seen on 223.69.170.30; working exploits exist and attackers scan for them at scale.

1 asset(s) affected · worth +6 points · how to manage your external attack surface →

highCertificate is not trusted (unable to get local issuer certificate)

This certificate cannot be chained (unable to get local issuer certificate), so visitors get a warning - and repeated warnings teach people to click through, which defeats warnings during real attacks.

2 asset(s) affected · worth +4 points · check a certificate with the free SSL tool →

highRC4 cipher accepted

RC4 is prohibited by standard and has practical attacks that recover plaintext such as cookies.

1 asset(s) affected · worth +4 points · how to read an SSL/TLS certificate check →

highTLS 1.2/1.3 not supported

Only deprecated protocols are supported, so browsers refuse to connect outright - visitors cannot open the site at all.

1 asset(s) affected · worth +4 points · how to read an SSL/TLS certificate check →

highSSLv3 is enabled

SSLv3 suffers from POODLE, which can recover plaintext such as cookies and credentials; it is prohibited by standard and offers no compatibility benefit today.

1 asset(s) affected · worth +4 points · how to read an SSL/TLS certificate check →

medium3 known vulnerabilities inferred on 223.69.170.30

3 known vulnerabilities are inferred on 223.69.170.30; even un-weaponised ones leave the system open to every published technique. Version-based inference - treat as a patch-currency signal.

1 asset(s) affected · worth +3 points · how to manage your external attack surface →

mediumOutdated TLS versions enabled (TLSv1.0, TLSv1.1)

Versions TLSv1.0, TLSv1.1 are formally deprecated, fail PCI DSS requirements and are no longer supported by modern browsers; they also enable downgrade attacks and fail compliance audits.

2 asset(s) affected · worth +2 points · how to read an SSL/TLS certificate check →

mediumDES/3DES cipher accepted

64-bit block ciphers are vulnerable to SWEET32 after enough data on one connection, and 3DES is no longer accepted by compliance standards.

1 asset(s) affected · worth +2 points · how to read an SSL/TLS certificate check →

mediumNo forward secrecy

Without it, anyone who later obtains the private key can decrypt everything they recorded earlier.

1 asset(s) affected · worth +2 points · how to read an SSL/TLS certificate check →

mediumHSTS not enabled

Without it, an attacker can strip SSL on the first HTTP request and keep the user on plaintext (SSL stripping), a common attack on public Wi-Fi.

1 asset(s) affected · worth +2 points · how to set HSTS, CSP and other security headers →

lowNo OCSP stapling

The server does not staple the certificate revocation status. Every revocation check becomes an extra round trip to the CA, which slows the first visit and, if the CA endpoint is unreachable or the visitor's network blocks it, leaves the browser without a usable revocation status.

3 asset(s) affected · worth +1 points · check a certificate with the free SSL tool →

lowNo CAA record

Without it any CA may issue certificates for your domain, enabling a lookalike site with a valid padlock.

1 asset(s) affected · worth +1 points · see who can issue certificates with the free CAA tool →

lowDNSSEC not enabled

Without it, attackers can poison caches or forge answers and send visitors to a lookalike server that harvests credentials.

1 asset(s) affected · worth +1 points · what DNSSEC prevents and how to enable it →

lowNo DKIM key found on common selectors

Without DKIM, mail integrity cannot be verified and DMARC loses one of its two authentication pillars. Note we probed only 46 common selectors, so a custom selector may exist.

1 asset(s) affected · worth +1 points · look up DKIM keys with the free DKIM tool →

lowNo MTA-STS policy

Without it an attacker on the network path can force a downgrade to plaintext and read or modify mail such as contracts and payment details.

1 asset(s) affected · worth +1 points · how to stop email spoofing with SPF, DKIM and DMARC →

lowSPF soft-fails without DMARC enforcement

Without an enforcing DMARC policy most receivers still deliver forged mail to the inbox.

1 asset(s) affected · worth +1 points · check an SPF record with the free SPF tool →

lowAdmin/middleware console exposed: HTTPS-alt/admin on 36.112.43.173:8443

HTTPS-alt/admin on 36.112.43.173:8443 (hosts: knowledge-doc.petrochina.com.cn, knowledge-preview.petrochina.com.cn, knowledge.petrochina.com.cn) faces constant credential stuffing and exploit attempts; weak or default passwords often hand over full access in one try.

1 asset(s) affected · worth +1 points · how to manage your external attack surface →

lowCookies without Secure/HttpOnly (BIGipServerdmz-80, EMPHPSID)

Missing Secure lets cookies travel in plaintext; missing HttpOnly lets injected scripts steal sessions; missing SameSite enables CSRF. Affected: BIGipServerdmz-80, EMPHPSID.

1 asset(s) affected · worth +1 points · how to set HSTS, CSP and other security headers →

lowNo Content Security Policy

Without it, any injected script runs: session theft, fake payment forms, or card-skimming scripts on compromised pages. CSP limits the damage even when something else fails.

1 asset(s) affected · worth +1 points · how to set HSTS, CSP and other security headers →

lowServer reveals software versions

Exact versions let attackers look up ready-made exploits instead of probing - most intrusions start with a version scan.

1 asset(s) affected · worth +1 points · how to set HSTS, CSP and other security headers →

lowX-Content-Type-Options missing

Without it a file uploaded as an image can be executed as HTML/JavaScript on your domain, stealing same-site cookies and sessions.

1 asset(s) affected · worth +1 points · how to set HSTS, CSP and other security headers →

lowNo clickjacking protection

Without it, attackers overlay a transparent frame of your page and trick users into clicking real actions such as transfers or password changes (clickjacking).

1 asset(s) affected · worth +1 points · how to set HSTS, CSP and other security headers →

Checks passed

Mail exchangers configured
SPF record is valid
Name servers are redundant
No weak cipher suites accepted
Certificate is valid and trusted
No shadow-AI services exposed
No mail-server IP on spam blocklists

What we detected

subdomain count: 51

What could not be fully checked

No BIMI record
BIMI shows your logo next to authenticated mail in supporting inboxes (requires an enforcing DMARC policy). It is a trust signal rather than a security control, so it does not affect your score.
No TLS-RPT record
TLS-RPT sends you reports when other servers fail to deliver mail to you securely. Recommended alongside MTA-STS.
Website returned an error page — partly unassessed 2 host(s)
The page returned HTTP 412 (often a firewall challenge for automated clients), so most header and content checks could not run. HSTS was still assessed where the response is reliable, but this category is only partially evaluated and its score should be read as incomplete.
Website not reachable 6 host(s)
The site could not be fetched, so its response headers and page content were not checked.
No Referrer-Policy
Browsers default to strict-origin-when-cross-origin today; setting it explicitly is good hygiene.
No Permissions-Policy
Permissions-Policy disables powerful browser features (camera, microphone, geolocation) you do not use.
RSA key exchange still accepted 2 host(s)
Static RSA key exchange is kept for old clients. It lacks forward secrecy but is not scored when ECDHE is available.
HTTPS not available on port 443 6 host(s)
The TLS checks could not run on this host, so its TLS configuration was not verified.
TLS 1.3 not enabled
TLS 1.3 is faster and removes legacy cryptography. Recommended, but not required.

Frequently asked questions about petrochina.com.cn security

Does petrochina.com.cn have DMARC protection against email spoofing?: No. No DMARC record was found for petrochina.com.cn, so mail forged from @petrochina.com.cn has no policy-based barrier at all.
How is petrochina.com.cn's F security grade calculated?: CyberTrust scores petrochina.com.cn passively across 6 area(s) — reputation and credential exposure 100/100; DNS hygiene 84/100; HTTP security headers 40/100; email spoofing defences (SPF/DKIM/DMARC) 36/100; external attack surface 32/100; TLS encryption and certificates 0/100 — and combines them by weight into the overall score of 43/100, which maps to grade F.
What is the most serious issue found on petrochina.com.cn?: Certificate expired 936 days ago (2024-04-07) (severity critical). It expired 936 days ago (2024-04-07): browsers show a full-page warning, most visitors leave, and API or app integrations fail without a clear reason. Fixing it is worth about +6 points.
How many subdomains does petrochina.com.cn expose?: This scan observed 51 publicly resolvable subdomain(s) for petrochina.com.cn. Verified owners get the full list, with each host's open ports and running services.

What a verified owner of petrochina.com.cn sees

Everything above is what anyone can observe from the internet. Domain owners who verify ownership additionally get the full asset inventory — every subdomain with its open ports and running services — look-alike and typosquatting domains registered against the brand, credential-exposure monitoring, and copy-paste fixes for each finding.

Verify ownership of petrochina.com.cn (free) → Open the live interactive report →