mongodb.com

15-check dossier · scoreboard above, section details below

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/mongodb.com/badge.svg)](https://www.domainposture.com/d/mongodb.com)

HTML

<a href="https://www.domainposture.com/d/mongodb.com"><img src="https://www.domainposture.com/d/mongodb.com/badge.svg" alt="Domain posture" /></a>

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

mongodb.com

15-check dossier · scoreboard above, section details below

Get a pack →

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/mongodb.com/badge.svg)](https://www.domainposture.com/d/mongodb.com)

HTML

<a href="https://www.domainposture.com/d/mongodb.com"><img src="https://www.domainposture.com/d/mongodb.com/badge.svg" alt="Domain posture" /></a>

Mostly compliant · 4 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 11
Warn: 4
Fail: 0

What an auditor would flag first

medium
Security headers
6 security header(s) missing
SOC 2 CC6.6ISO 27001 A.8.23
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7
low
TLS certificate
cert expires in 79 days
SOC 2 CC6.1ISO 27001 A.8.24

Need this as an artifact your auditor can verify?

Your mongodb.com scan flagged 1 medium and 3 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=reject — strict policy
DKIM1/6 DKIM selectors valid
TLS certificatecert expires in 79 days
Redirect chainHTTPS served correctly
Security headers6 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2033-07-08
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=1431 15.197.135.80
ttl=1431 3.33.132.188
AAAA: —
NS: ttl=21600 ns-cloud-e3.googledomains.com.
ttl=21600 ns-cloud-e4.googledomains.com.
ttl=21600 ns-cloud-e1.googledomains.com.
ttl=21600 ns-cloud-e2.googledomains.com.
SOA: ttl=900 ns-868.awsdns-44.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
CAA: —
TXT: ttl=3600 "1password-site-verification=7LBJAFJGQVF67OTR3TS3VVIQ2I"
ttl=3600 "1password-site-verification=VA2TUKKDPVDXBIFWIS2RTCJAGA"
ttl=3600 "MS=4CA8CA205115A2802524B6229479E81155C7B144"
ttl=3600 "_globalsign-domain-verification=BahbT-Pu-HaLP9bBimZ0MGe-4CPc4Z_MXqKNUajBmF"
ttl=3600 "_globalsign-domain-verification=eoEm4eIVawgCAi8WJocwgs97Q4gCe0777TT7zqoOtu"
ttl=3600 "adobe-idp-site-verification=7e49cd3f28a1fb6739adb46fc0d29c0f8f859b72d54064ef4149961c515b21ca"
ttl=3600 "adobe-sign-verification=3f1248c7698bca493febd6f5a735253e"
ttl=3600 "anthropic-domain-verification-tf2qg0=0NDSvXG7c27ZeroJKUM7BNTck"
ttl=3600 "apple-domain-verification=tNOOw2iPl2LUfcMu"
ttl=3600 "atlassian-domain-verification=5lWCtlSDbmHGBCWNRa0buLQdsVorZW1J7NFasVSNmaUN/yNKp9GJ/ZpIEoxyclot"
ttl=3600 "atlassian-domain-verification=jjck5dvAj6VthEJajeDaIZJGREpgUciBajpzmCrOC2kX7O6eoeEoBX8ZkCdSATYY"
ttl=3600 "box-domain-verification=55eb0bc00b129ed2970b4d3c5f755831c056e1b6b0740fa10c3528104285d18a"
ttl=3600 "cisco-ci-domain-verification=1b3023202cc0b31aa5939adc27eae7212a7c7dfa42ecc98dfd0f381c384a503f"
ttl=3600 "cursor-domain-verification-cfnbr3=0IapLrYkBUN6XM3QNT2vS4guB"
ttl=3600 "docker-verification=83b08d26-b419-4ad2-bbf5-6642a9c58bd9"
ttl=3600 "fastly-domain-delegation-B786i7h8o9786I78ho09786FDR7Cvgjhk-2024/09/04"
ttl=3600 "fastly-domain-delegation-r6zgE6qXzBYA6fY4S0ku-336644-20210119"
ttl=3600 "gc-ai-domain-verification-2qc1ya=1xaTzpixB76ktn9CN16zvYm5b"
ttl=3600 "google-site-verification=0f3EXvJUvQ3H7ylgRB7X3nBSEntiwzVFKMfzcNsngUI"
ttl=3600 "google-site-verification=562vGo4DqMUVmuvOAcCgqaFCY00wasgjDTLy4KB8vPA"
ttl=3600 "google-site-verification=8nKw09t6kqtmo-syWEsejuM0xpNaowHAzIYt-z1x3tw"
ttl=3600 "google-site-verification=ATOZv4ZhgEMEB4gvomWkM_EKbEnqsQz7hSVnjYm3W5I"
ttl=3600 "google-site-verification=HrlMCZusdWpxviJtgBQgfALccbHyTu_m1t0OYxXfBDo"
ttl=3600 "google-site-verification=SvmqGQerYRQUsIJxQw6p_cBN6oarDd5eb-yuYaifGxM"
ttl=3600 "google-site-verification=Vsgbzf-MCnquFOd4oZBWtjHSzO3XY77ek5S7i3FMAMg"
ttl=3600 "google-site-verification=rUNGIOiX1yMv9Pn9vZgn9vzLt_parHbOq9J7z7B9I9Y"
ttl=3600 "h1-domain-verification=jJ5AyTFx2Rx8wFXachJe9WWNTThNHdwJag4rjzwa6qoCmJM8"
ttl=3600 "hfdd82dys1cxnrpmvkj5fbdqdnxtcd30"
ttl=3600 "hj-ownership=7FLwwv83eh7TVJu"
ttl=3600 "hj-ownership=FXi7nSi9V6pghnW"
ttl=3600 "jamf-site-verification=Y54uJo10H5oL1Rrqe8em0Q"
ttl=3600 "knowbe4-site-verification=9a9a209d4202465d4bf7d6ce836f106a"
ttl=3600 "meltwater_sso_20210421_T3-5315"
ttl=3600 "miro-verification=da61ff1c05dc48f901de87b0f36c23312aaf3f7f"
ttl=3600 "mixpanel-domain-verify=daa04a63-bf99-4c43-986f-16723a114423"
ttl=3600 "netlify-domain-verification=310624"
ttl=3600 "onetrust-domain-verification=3286c0d285224075a7ffbacad125e02a"
ttl=3600 "openai-domain-verification=dv-coIzMUrqJjndZfF2eNVxDcTk"
ttl=3600 "paloaltonetworks-site-verification=3e42e1a9e5f222476bfa7e2960beb2ac42285a9713b4d62446b61826de4faae0"
ttl=3600 "smartsheet-site-validation=yeajQBNXMt9teGC8JYEGXTtS87UhbaB2"
ttl=3600 "stripe-verification=35be7ed98dade87dc28b55fcdc21230c86399013d4c4098e6d95698b5cc07e5c"
ttl=3600 "stripe-verification=5A69234D984D152B400480EFFE4C26FCC93F4AD666FDC9B1D36F960DE567192A"
ttl=3600 "stripe-verification=6d2ac874436248aa663c1d44801f7f2c1d036bff74ec6c2756069651013cbae5"
ttl=3600 "stripe-verification=7134b106ff8f884bf66f3b73862433bcbf35891599b2a3433f83e288ff542077"
ttl=3600 "stripe-verification=7a201a06f242afc951e529da65b2780fdcc738010d75f835ce9dc1ea5074fb78"
ttl=3600 "stripe-verification=83f31955cb78c08fd120241a0e5cd78804f8ab1948ed9c54bf089fa101e36160"
ttl=3600 "stripe-verification=930a6043d62002295bc26665767006c55db27c4552a596d3ee5e3cd13de67d9c"
ttl=3600 "stripe-verification=a01cdcb0cc84e6786d1bd68bad7ed6d54908a9888215b406fa9e20251ec28a2d"
ttl=3600 "stripe-verification=c8842b6e2c46106c2194def809035717df5705c5fa9d204924a2f6f97b548f1f"
ttl=3600 "stripe-verification=cba14c9dca9c8c6b9f0ace0d5bc98b7bf5dd65448b9d2ef73cf695a13b089ec3"
ttl=3600 "stripe-verification=eae03c5b0c4d5950e779400cf7dd8ca8949b1bd1ea48192233bd0c1417af0fef"
ttl=3600 "successfactors-site-verification=NDZlMDhkYzMzM2EzYTMxZjkzMGU1OGQzZTZjNjhjZmEwYjVmNWQzODBiOWFmYTgzYTQ1ZTE3NWYxZGE0NjU1OQ=="
ttl=3600 "v=spf1 include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email -all"
ttl=3600 "warpstream-verification=K3cowuStVHhJuQzcqKzW6Q=="
ttl=3600 "wrike-verification=MzY5MjcwNTo5NDRjZGYxZjIwYjY3NjVhMmY0YWUxZmQxY2Q5Njg0M2Y5ZmEyZGFmYmYxOTU3YmI3OWNkYjMyNzAxOTdkYWMy"

fetched 2026-06-17T08:28:43.421Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 aspmx.l.google.com.
pri=20 alt1.aspmx.l.google.com.
pri=20 alt2.aspmx.l.google.com.
pri=30 aspmx2.googlemail.com.
pri=30 aspmx3.googlemail.com.

fetched 2026-06-17T08:28:43.181Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email -all

v=spf1
include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email
-all

fetched 2026-06-17T08:28:43.285Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; rua=mailto:[email protected],mailto:[email protected]; ruf=mailto:[email protected],mailto:[email protected]

v=: DMARC1
p=: reject
rua=: mailto:[email protected],mailto:[email protected]
ruf=: mailto:[email protected],mailto:[email protected]

fetched 2026-06-17T08:28:43.376Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCf/gcFQMFcC/TFu5v5hERlQFZxnU1SetuiSSr9M/2mH4zDFkTRKund135yQR4Bkoyb2F3cXytX0iZDz5dMvGatTGCuvylVLUiStQmo6fUXjKy/aAqHqN0EOVE4uiFVOf7Iozp2LLrBb9ZxVazp8k1JlTS2KwaxRi5Z5TqRlF5s/QIDAQAB
k1:: —
selector1:: —
selector2:: —
mxvault:: —

fetched 2026-06-17T08:28:43.426Z

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 79 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: mongodb.com
issuer:: YR1 / Let's Encrypt
valid:: Jun 7 07:13:06 2026 GMT → Sep 5 07:13:05 2026 GMT
authorized:: yes
sha256:: C6:77:94:F2:29:75:EE:11:84:D6:7B:65:5F:6C:2B:13:BD:2C:EA:46:A8:97:04:F5:4B:E3:D8:39:14:F3:B9:AD
sans: mongodb.com

fetched 2026-06-17T08:28:43.796Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://mongodb.com/
[200] https://www.mongodb.com/

fetched 2026-06-17T08:28:45.229Z

redirects

info

Open standalone →

tracing redirects…

headers

medium

Open standalone →

6 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Strict-Transport-Security: max-age=15552000; includeSubDomains
Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.mongodb.com/

security headers

strict-transport-security: —
content-security-policy: —
x-frame-options: —
x-content-type-options: —
referrer-policy: —
permissions-policy: —

other headers

cache-control: s-maxage=30, stale-while-revalidate
connection: keep-alive
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 17 Jun 2026 08:28:45 GMT
document-policy: js-profiling
etag: "dxy9bqrew8khw2"
server: istio-envoy
transfer-encoding: chunked
vary: Accept-Encoding
via: 1.1 8a4ad7a380f44490867006729a8f8656.cloudfront.net (CloudFront)
x-amz-cf-id: Sg65Pv0Fm4dxO8k1GCEmFwc-y5NWlDhBUomDyK1cIAsy22NC4CQilQ==
x-amz-cf-pop: BOM78-P11
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 35
x-mdb-locale: en-us
x-mdb-url: /
x-nextjs-cache: HIT
x-powered-by: Next.js

fetched 2026-06-17T08:28:45.421Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-17T08:28:44.133Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

# See http://www.robotstxt.org/robotstxt.html for documentation on how to use the robots.txt file

User-agent: mauibot
Disallow: /community/forums/
 
User-agent: semrushbot
Disallow: /community/forums/
 
User-agent: ahrefsbot
Disallow: /community/forums/
 
User-agent: blexbot
Disallow: /community/forums/
 
User-agent: seo spider
Disallow: /community/forums/
 
User-agent: bingbot
Disallow: /community/forums/auth/
Disallow: /community/forums/assets/browser-update*.js
Disallow: /community/forums/email/
Disallow: /community/forums/session
Disallow: /community/forums/session/
Disallow: /community/forums/admin
Disallow: /community/forums/admin/
Disallow: /community/forums/user-api-key
Disallow: /community/forums/user-api-key/
Disallow: /community/forums/*?api_key*
Disallow: /community/forums/*?*api_key*

User-agent: *
# Directories
Disallow: /misc/
Disallow: /profiles/
Disallow: /u/
Disallow: /community/forums/auth/
Disallow: /community/forums/email/
Disallow: /community/forums/session
Disallow: /community/forums/session/
Disallow: /community/forums/admin
Disallow: /community/forums/admin/
Disallow: /community/forums/user-api-key
Disallow: /community/forums/user-api-key/
Disallow: /community/forums/g/
Disallow: /community/forums/u/
Disallow: /community/forums/user_avatar/

# Files
Disallow: /admin/*
Disallow: /data/*
Disallow: /comment/reply/
Disallow: /filter/tips/
Disallow: /node/add/
Disallow: /search/
Disallow: /search
Disallow: /user/register/
Disallow: /user/password/
Disallow: /user/login/
Disallow: /user/logout/
Disallow: /lp/p/*
Disallow: /lp/s/*
Disallow: /lp/d/*
Disallow: /thank-you/*
Disallow: /link/*
Disallow: /community/forums/assets/browser-update*.js
Disallow: /docs/*.epub
Disallow: /docs/*.pdf
Disallow: /docs/atlas/app-services/

# No access for quicktabs in the URL
Disallow: /*?quicktabs_*
Disallow: /*&quicktabs_*
Disallow: /*?qt-view_*
Disallow: /*&qt-view_*
# No crawling field collections or taxonomy
Disallow: /field-collection/*
Disallow: /tags/*
Disallow: /taxonomy/term/*
# Paths (no clean URLs)
Disallow: /?q=admin/
Disallow: /?q=comment/reply/
Disallow: /?q=filter/tips/
Disallow: /?q=node/add/
Disallow: /?q=search/
Disallow: /?q=user/password/
Disallow: /?q=user/register/
Disallow: /?q=user/login/
Disallow: /?q=user/logout/
# Specific pages
Disallow: /commercialsupport/
Disallow: /partners/referral-federal
Disallow: /customer-evaluation-downloads-development-versions
Disallow: /community/forums/*?api_key*
Disallow: /community/forums/*?*api_key*
Disallow: /docs/meta/
Disallow: /docs/search/
Disallow: /docs/openapi/

# Prevent exposing future docs
Disallow: /docs-qa*

# Prevent exposing devhub UAT
Disallow: /devcenter-uat*

Disallow: /lp/internal/cheq-ppc-invalid-users*

Disallow: /.well-known/security.txt

Sitemap: https://www.mongodb.com/sitemap-index.xml

sitemap.xml

present — 15 url(s)

head

title: MongoDB: The World’s Leading Modern Data Platform | MongoDB
description: Get your ideas to market faster with a flexible, AI-ready database. MongoDB makes working with data easy.

social

og:description: Get your ideas to market faster with a flexible, AI-ready database. MongoDB makes working with data easy.
og:type: website
og:site_name: MongoDB
og:title: MongoDB: The World’s Leading Modern Data Platform
og:url: https://www.mongodb.com/
og:image: https://images.contentstack.io/v3/assets/blt7151619cb9560896/bltfe3bee7877352896/Meta_Generic.png
twitter:card: summary_large_image
twitter:site: @mongodb
twitter:title: MongoDB: The World’s Leading Modern Data Platform

fetched 2026-06-17T08:28:45.070Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-06-17T08:28:43.368Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2033-07-08

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: Gandi SAS
created: 2008-07-08T23:48:57Z
expires: 2033-07-08T23:48:57Z
statuses: clientTransferProhibited https://icann.org/epp#clientTransferProhibited

fetched 2026-06-17T08:28:44.224Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: TypeError: fetch failed; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: TypeError: fetch failed; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.