Skip to content
https://inco.by

Infrastructure

· 17 checks — DNS, redirects, IPv6, crawlability, URL variants, and domain intelligence rolled into one auditable list.
SCORE
85
GRADE
B
FIX
0
REVIEW
9
PASS
8
INFO
0
Probed from Sao Paulo, Brazil
200 OK
Checks
17
8 PASS 9 REVIEW
B
DNSSEC
Unsigned (DNSSEC not deployed)
REVIEW
Unsigned (DNSSEC not deployed)
Info::
DNSSEC is not deployed
The zone is not DNSSEC-signed. Users on validating resolvers (Cloudflare 1.1.1.1, Quad9 9.9.9.9, growing default in mobile resolvers) get no protection against DNS spoofing for this domain. Most registrars now offer DNSSEC at a single click; consider enabling it for sites where authenticity matters (banking, healthcare, government).
B
CAA Records
No CAA records (any CA may issue certificates)
REVIEW
No CAA records (any CA may issue certificates)
Info::
No CAA records published
Without CAA records, any publicly-trusted CA can issue certificates for this domain. Adding a CAA record (`yourdomain. IN CAA 0 issue "letsencrypt.org"`) restricts issuance to CAs you authorize. Required by CAB Forum baseline since 2017; the default of 'any CA' is widely supported but is the broader attack surface for issuance fraud.
C
Reverse DNS
Action
0/4 IPs match cert SAN
REVIEW
0/4 IPs match cert SAN
Info::
PTR lookup failed for 172.67.187.119: lookup 172.67.187.119: no such host
No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue.
Info::
PTR lookup failed for 104.21.32.205: lookup 104.21.32.205: no such host
No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue.
Info::
PTR lookup failed for 2606:4700:3034::ac43:bb77: lookup 2606:4700:3034::ac43:bb77: no such host
No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue.
Info::
PTR lookup failed for 2606:4700:3033::6815:20cd: lookup 2606:4700:3033::6815:20cd: no such host
No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue.
C
Multi-Resolver DNS Speed
Action
Mean 119ms across 3 resolvers (spread 236ms)
REVIEW
Mean 119ms across 3 resolvers (spread 236ms)
Info::
Cloudflare: 2ms
Got: 2ms via 1.1.1.1:53
Info::
Quad9: 118ms
Got: 118ms via 9.9.9.9:53
Info::
Google: 238ms
Got: 238ms via 8.8.8.8:53
Info::
High latency spread between resolvers: 236ms (min 2ms / max 238ms)
Wide gap between the fastest and slowest public resolver suggests a geographic anycast issue or an authoritative-server cache problem. Users in different regions will see materially different DNS times.
B
URL Variants
www/non-www, trailing slash, HTTP→HTTPS
REVIEW
www/non-www, trailing slash, HTTP→HTTPS
Info::
www/non-www redirect configured correctly (preferred: non-www)
Critical::
HTTP version does not redirect to HTTPS
Got: HTTP 200 Expected: 301 redirect to HTTPS

www / non-www

301https://www.inco.by/
200https://inco.by/

Preferred variant: non-www

HTTP → HTTPS

200http://inco.by/

HTTP version does not redirect to HTTPS

B
HTTP Probe Timing
Total 1163 ms — DNS, TCP, TLS, TTFB, content transfer breakdown
REVIEW
DNS Lookup DNS Lookup — time to resolve the domain name to an IP address.
228 ms
TCP Connect TCP Connect — time to establish a TCP connection to the server.
1 ms
TLS Handshake TLS Handshake — time to complete the HTTPS encryption handshake.
9 ms
Time to First Byte Time to First Byte — how long the server takes to respond with the first byte of data.
714 ms
Total Time Total request time from DNS lookup through full response.
1.16 s

Connection waterfall

DNS Lookup 228 ms TCP Connect 1 ms TLS Handshake 9 ms Server Processing 476 ms Content Transfer 450 ms
B
TLS Certificate Expiry & Recommendations
57 days until leaf cert expires — 4 issues to address
REVIEW

Certificate validity

57
days left
0d 30d 60d 90d+

Recommended actions

  • Prefer TLS 1.3 — TLS 1.2 is acceptable but TLS 1.3 removes RSA key exchange and improves latency
  • Enable HSTS: Strict-Transport-Security: max-age=31536000; includeSubDomains
  • Enable DNSSEC on your domain for DNS spoofing protection
  • Enable OCSP stapling on your TLS server to remove a CA roundtrip and protect user privacy
B
Operational Status Page
No status page link detected
REVIEW
No status page link detected
Info::
No operational status page link detected
Status pages communicate planned maintenance and incidents to users -- a hallmark of operationally-mature services. Most SaaS teams publish one via Atlassian Statuspage, Instatus, BetterUptime, or a self-hosted Cachet. Smaller sites legitimately don't need one; flagged as Info, not a failure.
B
Health Check Endpoint
No conventional health endpoint found
REVIEW
No conventional health endpoint found
Info::
No conventional health endpoint found
Health endpoints (/health, /healthz, /status, /ping, /api/health) let uptime monitors, load balancers, and orchestration systems (Kubernetes, ECS, Fly.io) verify the service is alive. Marketing sites and small services often skip them legitimately; flagged as Info, not a failure. Probe results: /api/health: 404, /health: connection error, /healthz: connection error, /ping: 404, /status: 404.
A
DNS Records
2 A records, 450 ms lookup
PASS
2 A records, 450 ms lookup
Info::
Resolves to 2 IPv4 address(es)
Got: 172.67.187.119, 104.21.32.205
Info::
Has 2 IPv6 (AAAA) record(s)
Got: 2606:4700:3034::ac43:bb77, 2606:4700:3033::6815:20cd
Info::
2 nameserver(s) configured
Got: daisy.ns.cloudflare.com, theo.ns.cloudflare.com
Info::
No MX records — email not configured via DNS
Info::
No SPF record found in TXT records
SPF helps prevent email spoofing. Add a TXT record starting with 'v=spf1'.
Warning::
DNS resolution is slow (450 ms)
Slow DNS adds latency to every page load. Consider a faster DNS provider.
Got: 450 ms
A172.67.187.119, 104.21.32.205
AAAA2606:4700:3034::ac43:bb77, 2606:4700:3033::6815:20cd
CNAME—
NSdaisy.ns.cloudflare.com, theo.ns.cloudflare.com
MX—
TXT—
CAALookup not available with standard resolver
Resolved in 450 ms

SPF helps prevent email spoofing. Add a TXT record starting with 'v=spf1'.

Why this matters

Without SPF, receiving servers can't validate sending IPs — your domain is easier to spoof in phishing.

Learn more ▾

SPF complements DMARC. Both should be published. SPF records list authorized sending IPs (e.g., `v=spf1 include:_spf.google.com ~all` for Google Workspace). After publishing, verify in Google Postmaster Tools or mxtoolbox.

Source: RFC 7208 (SPF)

Slow DNS adds latency to every page load. Consider a faster DNS provider.

Why this matters

DNS resolution is slow — anycast DNS providers (Cloudflare, Route 53) typically resolve <50ms globally.

Source: DNS performance benchmarks

A+
Subdomain Takeover
No subdomain takeover risk detected
PASS
No subdomain takeover risk detected
Info::
No CNAME record present
A+
Redirect Chain
No redirects — direct access
PASS
No redirects — direct access
Info::
No redirects — direct access
Got: https://inco.by

https://inco.by

702 ms · HTTP/1.1 FINAL

#URLStatusTimeProtocolServer
1https://inco.by200702 msHTTP/1.1cloudflare
A+
IPv6 Readiness
IPv6 reachable (2 ms)
PASS
IPv6 reachable (2 ms)
Info::
IPv6 is configured and reachable at 2606:4700:3034::ac43:bb77, 2606:4700:3033::6815:20cd
Got: 2 ms connect
IPv6 Ready
AAAA Records 2606:4700:3034::ac43:bb77, 2606:4700:3033::6815:20cd Connection Reachable (2 ms)
A+
Crawlability
robots.txt present, sitemap with 2 URLs
PASS
robots.txt present, sitemap with 2 URLs
Info::
robots.txt is present
Got: 1979 bytes
Info::
sitemap.xml is present
Info::
sitemap.xml is valid XML
Info::
sitemap.xml contains 2 entries
Info::
Sitemap index with 2 child sitemaps
Info::
robots.txt references sitemap
robots.txt 200 OK
Size 1979 B Sitemaps referenced 2 User-agents CloudflareBrowserRenderingCrawler, Google-Extended, GPTBot, Applebot-Extended, CCBot, ClaudeBot, meta-externalagent, *, Amazonbot, Bytespider Blocking No — crawling allowed
# As a condition of accessing this website, you agree to abide by the following
# content signals:

# (a)  If a Content-Signal = yes, you may collect content for the corresponding
#      use.
# (b)  If a Content-Signal = no, you may not collect content for the
#      corresponding use.
# (c)  If the website operator does not include a Content-Signal for a
#      corresponding use, the website operator neither grants nor restricts
#      permission via Content-Signal with respect to the corresponding use.

# The content signals and their meanings are:

# search:   building a search index and providing search results (e.g., returning
#           hyperlinks and short excerpts from your website's contents). Search does not
#           include providing AI-generated search summaries.
# ai-input: inputting content into one or more AI models (e.g., retrieval
#           augmented generation, grounding, or other real-time taking of content for
#           generative AI search answers).
# ai-train: training or fine-tuning AI models.
# use:      how AI systems may consume the content (immediate, reference, or full).

# ANY RESTRICTIONS EXPRESSED VIA CONTENT SIGNALS ARE EXPRESS RESERVATIONS OF
# RIGHTS UNDER ARTICLE 4 OF THE EUROPEAN UNION DIRECTIVE 2019/790 ON COPYRIGHT
# AND RELATED RIGHTS IN THE DIGITAL SINGLE MARKET.

# BEGIN Cloudflare Managed content

User-agent: *
Content-Signal: search=yes,ai-train=no,use=reference
Allow: /

User-agent: Amazonbot
Disallow: /

User-agent: Applebot-Extended
Disallow: /

User-agent: Bytespider
Disallow: /

User-agent: CCBot
Disallow: /

User-agent: ClaudeBot
Disallow: /

User-agent: CloudflareBrowserRenderingCrawler
Disallow: /

User-agent: Google-Extended
Disallow: /

User-agent: GPTBot
Disallow: /

User-agent: meta-externalagent
Disallow: /

# END Cloudflare Managed Content

User-agent: *
Disallow: /wp-admin/
Allow: /wp-admin/admin-ajax.php

Sitemap: https://inco.by/sitemap.xml
Sitemap: https://inco.by/sitemap.html
sitemap.xml 200 OK
Type Sitemap Index URLs 2 entries Valid XML Yes
Child Sitemaps:
A+
Domain Intelligence
inco.by — via Reliable Software, Ltd, 16 years, 1 months old
PASS
inco.by — via Reliable Software, Ltd, 16 years, 1 months old
Info::
Domain registered until Oct 15, 2027 (1 years, 2 months remaining)
Info::
Registrar: Reliable Software, Ltd
Domain expiry

432 days

October 15, 2027

SSL certificate

57 days

Issued by Google Trust Services

Domain age

16 years, 1 months

Registered September 20, 2010

DNSSEC

Status unknown

Protects against DNS spoofing

Hosting

Unknown

2606:4700:3033::6815:20cd

Registrar

Reliable Software, Ltd

Lock status unknown 2 NS records
Expiry timeline
Today
+1 year
Domain expiry SSL expiry Danger zone (≤30 days)
Registrar Reliable Software, Ltd
Created September 20, 2010 (16 years, 1 months ago)
Expires October 15, 2027 (1 years, 2 months)
Last Updated July 1, 2026
Name Servers daisy.ns.cloudflare.com, theo.ns.cloudflare.com
Hosting
IP Address 2606:4700:3033::6815:20cd
Data source: whois (1.5s)
A
CDN & Delivery
Cloudflare (DYNAMIC)
PASS
Cloudflare (DYNAMIC)
Info::
Site is served via Cloudflare CDN (edge: GRU)
Got: cf-ray: a2536c6058c6b4e8-GRU
Info::
CDN cache status: DYNAMIC
CDN Detected: Cloudflare
Provider Cloudflare Cache Status DYNAMIC Evidence cf-ray: a2536c6058c6b4e8-GRU
A+
CDN Cache Observability
Cache state: DYNAMIC
PASS
Cache state: DYNAMIC
Info::
CDN cache state observable via 1 header(s)
Got: cf-cache-status=DYNAMIC
All checks on this page are automated. Results are estimates - run targeted manual reviews when the score affects a release decision.

Send Feedback