dnsspof
B
82/100
github.com

Moderate concentration — Single web origin IP.

NS 8 web 1 MX 8 CDN no DNSSEC no

Network dependency map

each block is one resolved endpoint, coloured by Autonomous System
DNS
Web
Mail
  • AS62597 NSONE - NSONE Inc×8
  • AS16509 AMAZON-02 - Amazon.com, Inc.×8
  • AS8075 MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation×8
  • AS36459 GITHUB - GitHub, Inc.×1

Findings

3
medium web Single web origin IP

The site resolves to exactly one IP with no CDN in front. That host is a hard single point of failure.

1 endpoints
  • github.com → 140.82.116.4 · AS36459 GITHUB - GitHub, Inc. · US

Put the origin behind a CDN/anycast layer, or publish multiple origins across networks.

low web No CDN in front of the origin

The origin is directly exposed: no anycast absorption, no edge caching, and the origin IP is visible for targeted attack.

Front the site with a CDN (Cloudflare, Fastly, CloudFront, …).

low dns DNSSEC not enabled

No DS record at the parent: responses are not cryptographically authenticated and can be forged by an on-path attacker or a poisoned resolver.

Enable DNSSEC signing and publish a DS record at the registrar. (Automate key rollover — misconfigured DNSSEC can itself cause outages.)

DNS records

Nameserversdns1.p08.nsone.net
dns2.p08.nsone.net
dns3.p08.nsone.net
dns4.p08.nsone.net
ns-1283.awsdns-32.org
ns-1707.awsdns-21.co.uk
ns-421.awsdns-52.com
ns-520.awsdns-01.net
A140.82.116.4
MX0 github-com.mail.protection.outlook.com
SOAdns1.p08.nsone.net. hostmaster.nsone.net. 1656468023 43200 7200 1209600 3600
CAA7 record(s) present
DNSSECunsigned
TXT22 record(s)

Scan history

  • B2026-08-01 03:15 UTCscore 82 · 4 networks
  • B2026-08-01 00:57 UTCscore 82 · 4 networks
  • B2026-08-01 00:57 UTCscore 82 · 4 networks
  • B2026-08-01 00:57 UTCscore 82 · 4 networks
  • B2026-08-01 00:57 UTCscore 82 · 4 networks
  • B2026-08-01 00:53 UTCscore 82 · 4 networks
  • B2026-07-30 10:50 UTCscore 82 · 4 networks
  • B2026-07-30 10:50 UTCscore 82 · 4 networks

← scan another domain