primevideo.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

primevideo.com

15-check dossier · scoreboard above, section details below

Get a pack →

A-

Audit-ready · 4 minor advisories

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 11
Warn: 4
Fail: 0

What an auditor would flag first

low
DMARC
p=quarantine — receivers send to spam
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7
low
Security headers
3 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2

Need this as an artifact your auditor can verify?

Your primevideo.com scan flagged 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX1 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=quarantine — receivers send to spam
DKIMno DKIM selectors found — likely not configured
TLS certificatecert valid for 114 days
Redirect chainHTTPS served correctly
Security headers3 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✗)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2026-10-31
Certificate Transparency35 subdomain(s) found in CT logs (1 wildcard cert(s))

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=11 3.171.61.24
ttl=11 3.171.61.65
ttl=11 3.171.61.90
ttl=11 3.171.61.11
AAAA: —
NS: ttl=78032 ns-1172.awsdns-18.org.
ttl=78032 ns-1933.awsdns-49.co.uk.
ttl=78032 ns-306.awsdns-38.com.
ttl=78032 ns-532.awsdns-02.net.
SOA: ttl=900 ns-1933.awsdns-49.co.uk. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 900
CAA: —
TXT: ttl=900 "MS=ms35125271"
ttl=900 "google-site-verification=T7MCISsmLlHGtFwAm5SP0f_tjN_ygqjpaXbhtJOlKHY"
ttl=900 "google-site-verification=fLLG-R7u0APME_LIafQD3GE3uyiK18Vu4qajGwkX5TQ"
ttl=900 "google-site-verification=qF9TbJ6oxoeA7tw6EXEpfwomlNLw7-d8i9KyOnwJWR8"
ttl=900 "spf2.0/pra include:amazon.com -all"
ttl=900 "v=spf1 include:amazon.com -all"

fetched 2026-06-04T07:55:56.135Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

1 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 amazon-smtp.amazon.com.

fetched 2026-06-04T07:55:56.137Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 include:amazon.com -all

v=spf1
include:amazon.com
-all

fetched 2026-06-04T07:55:56.138Z

spf

info

Open standalone →

resolving spf…

dmarc

low

Open standalone →

p=quarantine — receivers send to spam

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Upgrade to p=reject once your SPF and DKIM pass rates are consistently high

v=DMARC1;p=quarantine;pct=100;rua=mailto:report@dmarc.amazon.com;ruf=mailto:report@dmarc.amazon.com

v=: DMARC1
p=: quarantine
pct=: 100
rua=: mailto:report@dmarc.amazon.com
ruf=: mailto:report@dmarc.amazon.com

fetched 2026-06-04T07:55:56.150Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 114 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: primevideo.com
issuer:: Amazon RSA 2048 M01 / Amazon
valid:: Mar 13 00:00:00 2026 GMT → Sep 26 23:59:59 2026 GMT
authorized:: yes
sha256:: 53:BE:87:1A:0B:A0:30:43:88:2C:B3:A5:4D:2C:7B:35:A6:B8:50:53:B4:E8:1D:27:45:0E:7C:0B:63:08:EE:64
sans: primevideo.com
amazonvideo.com
www.amazonvideo.com

fetched 2026-06-04T07:55:56.055Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 3 hops

[301] https://primevideo.com/
[302] https://www.primevideo.com/
[200] https://www.primevideo.com/offers/nonprimehomepage/ref=dv_web_force_root

fetched 2026-06-04T07:55:56.572Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

3 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.primevideo.com/offers/nonprimehomepage/ref=dv_web_force_root

security headers

strict-transport-security: max-age=47474747; includeSubDomains; preload
content-security-policy: —
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: —
permissions-policy: —

other headers

accept-ch: ect,rtt,downlink,device-memory,sec-ch-device-memory,viewport-width,sec-ch-viewport-width,dpr,sec-ch-dpr,sec-ch-ua-full-version-list,sec-ch-ua-platform,sec-ch-ua-platform-version
accept-ch-lifetime: 86400
connection: keep-alive
content-encoding: gzip
content-language: en-US
content-security-policy-report-only: style-src https://*.amazon.com https://*.media-amazon.com https://*.ssl-images-amazon.com https://*.amazon-adsystem.com 'unsafe-inline';report-uri /1/batch/2/OE/mid=ATVPDKIKX0DER:sid=130-3348092-3651111:rid=HAYF038SD1XKS2FC2F0B:sn=www.primevideo.com;script-src https://*.amazon.com https://*.media-amazon.com https://*.ssl-images-amazon.com https://*.amazon-adsystem.com 'unsafe-inline' 'unsafe-eval';default-src https://*.amazon.com https://*.media-amazon.com https://*.ssl-images-amazon.com https://*.amazon-adsystem.com
content-type: text/html;charset=UTF-8
date: Thu, 04 Jun 2026 07:55:56 GMT
server: Server
set-cookie: i18n-prefs=USD; Domain=.primevideo.com; Expires=Fri, 04-Jun-2027 07:55:56 GMT; Path=/
transfer-encoding: chunked
vary: Accept-Encoding,User-Agent
via: 1.1 4d312fa9950971c88054a0fc2536913e.cloudfront.net (CloudFront)
x-amz-cf-id: ug_Dav9KcHGWdXNds7z5XloQ2SzFihBAE4L2YrbnsRW2-Zr16GezBQ==
x-amz-cf-pop: IAD61-P12
x-amz-rid: HAYF038SD1XKS2FC2F0B
x-cache: Miss from cloudfront
x-xss-protection: 1;

fetched 2026-06-04T07:55:56.493Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 403

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-04T07:55:56.169Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✗)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: *
Disallow: /hp/video/
Disallow: /-/*/hp/video/
Disallow: /api
Disallow: /gp/video/api
Disallow: /region/*/api
Disallow: /-/*/api
Disallow: /mystuff
Disallow: /gp/video/mystuff
Disallow: /region/*/mystuff
Disallow: /-/*/mystuff
Disallow: /profiles
Disallow: /gp/video/profiles
Disallow: /region/*/profiles
Disallow: /-/*/profiles
Disallow: /optout
Disallow: /gp/video/optout
Disallow: /region/*/optout
Disallow: /-/*/optout
Disallow: /settings
Disallow: /gp/video/settings
Disallow: /region/*/settings
Disallow: /-/*/settings
Disallow: /search
Disallow: /gp/video/search
Disallow: /region/*/search
Disallow: /-/*/search
Disallow: /ap/
Disallow: /gp/video/ap/
Disallow: /region/*/ap/
Disallow: /-/*/ap/
Disallow: /auth
Disallow: /gp/video/auth
Disallow: /region/*/auth
Disallow: /-/*/auth
Disallow: /salp/i
Disallow: /gp/video/salp/i
Disallow: /region/*/salp/i
Disallow: /-/*/salp/i
Disallow: /detail/Login
Disallow: /gp/video/detail/Login
Disallow: /region/*/detail/Login
Disallow: /-/*/detail/Login
Disallow: */src/
Disallow: */node_modules/
Disallow: /review/create-review/

User-agent: AddSearchBot
Disallow: /

User-agent: AI2Bot
Disallow: /

User-agent: AI2Bot-DeepResearchEval
Disallow: /

User-agent: Ai2Bot-Dolma
Disallow: /

User-agent: aiHitBot
Disallow: /

User-agent: Andibot
Disallow: /

User-agent: Anomura
Disallow: /

User-agent: atlassian-bot
Disallow: /

User-agent: Brightbot
Disallow: /

User-agent: BuddyBot
Disallow: /

User-agent: Bytespider
Disallow: /

User-agent: CCBot
Disallow: /

User-agent: Channel3Bot
Disallow: /

User-agent: ChatGLM-Spider
Disallow: /

User-agent: ChatGPT-User
Disallow: /

User-agent: Claude-User
Disallow: /

User-agent: Cloudflare-AutoRAG
Disallow: /

User-agent: CloudflareBrowserRenderingCrawler
Disallow: /

User-agent: cohere-ai
Disallow: /

User-agent: cohere-training-data-crawler
Disallow: /

User-agent: Copilot
Disallow: /

User-agent: CopilotNative
Disallow: /

User-agent: CopilotSapphire
Disallow: /

User-agent: Cotoyogi
Disallow: /

User-agent: Crawl4AI
Disallow: /

User-agent: Datenbank Crawler
Disallow: /

User-agent: DeepSeekBot
Disallow: /

User-agent: Devin
Disallow: /

User-agent: Diffbot
Disallow: /

User-agent: DuckAssistBot
Disallow: /

User-agent: Echobot Bot
Disallow: /

User-agent: EchoboxBot
Disallow: /

User-agent: EtaoSpider
Disallow: /

User-agent: factset_spyderbot
Disallow: /

User-agent: FriendlyCrawler
Disallow: /

User-agent: Gemini-Deep-Research
Disallow: /

User-agent: Google-CloudVertexBot
Disallow: /

User-agent: Google-Firebase
Disallow: /

User-agent: Google-NotebookLM
Disallow: /

User-agent: GoogleAgent-Mariner
Disallow: /

User-agent: GoogleAgent-Shopping
Disallow: /

User-agent: GoogleOther
Disallow: /

User-agent: Grok-DeepSearch
Disallow: /

User-agent: GrokBot
Disallow: /

User-agent: iAskBot
Disallow: /

User-agent: iaskspider
Disallow: /

User-agent: IbouBot
Disallow: /

User-agent: ICC-Crawler
Disallow: /

User-agent: img2dataset
Disallow: /

User-agent: ImagesiftBot
Disallow: /

User-agent: imageSpider
Disallow: /

User-agent: imgproxy
Disallow: /

User-agent: ISSCyberRiskCrawler
Disallow: /

User-agent: Kangaroo Bot
Disallow: /

User-agent: KlaviyoAIBot
Disallow: /

User-agent: KunatoCrawler
Disallow: /

User-agent: laion-huggingface-processor
Disallow: /

User-agent: Linguee Bot
Disallow: /

User-agent: LinkupBot
Disallow: /

User-agent: Manus-User
Disallow: /

User-agent: meta-externalagent
Disallow: /

User-agent: meta-externalfetcher
Disallow: /

User-agent: meta-webindexer
Disallow: /

User-agent: MistralAI-User
Disallow: /

User-agent: netEstate Imprint Crawler
Disallow: /

User-agent: omgili
Disallow: /

User-agent: Panscient
Disallow: /

User-agent: panscient.com
Disallow: /

User-agent: PanguBot
Disallow: /

User-agent: Perplexity-User
Disallow: /

User-Agent: PerplexityBot
Disallow: /

User-agent: PetalBot
Disallow: /

User-agent: PhindBot
Disallow: /

User-agent: Poggio-Citations
Disallow: /

User-agent: QualifiedBot
Disallow: /

User-agent: SBIntuitionsBot
Disallow: /

User-agent: Scrapy
Disallow: /

User-agent: SemrushBot-SWA

sitemap.xml

absent

head

title: —
description: —

social

no OpenGraph or Twitter meta tags found

fetched 2026-06-04T07:55:56.563Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-06-04T07:55:56.178Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2026-10-31

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: MarkMonitor Inc.
created: 2000-10-31T12:22:33Z
expires: 2026-10-31T11:22:32Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited

fetched 2026-06-04T07:55:56.612Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

35 subdomain(s) found in CT logs (1 wildcard cert(s))

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

source: certspotter
certificates seen: 100
subdomains in CT: 35 discovered (full list in Domain Audit Report)
wildcards: *.overpass.primevideo.com

fetched 2026-06-04T07:55:57.089Z

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.