A compact, evidence-led view of the public attack surface for bbnu.my. The site is healthy behind Cloudflare, but its browser policy layer needs tightening before production launch.
HSTS, CSP, frame protection, Permissions-Policy, COOP and CORP were not observed. This reduces browser-side protection against clickjacking, script injection and cross-origin leakage.
nosniff ✓ referrer-policy ✓ CSP ✕ HSTS ✕The public response returns Access-Control-Allow-Origin: *. Low impact for the current static page, but unsafe if reused on authenticated or data-bearing APIs.
No CAA record was found. Add one to limit which certificate authorities may issue certificates for the domain.
CAA: noneNo DS record was observed. Consider DNSSEC if registrar support and operational recovery procedures are ready.
DS: noneThe scan saw these ports on Cloudflare IP space. This does not prove the origin is exposed; origin validation requires an authorized origin-side review.
80 · 443 · 8080 · 8443Null MX, hard-fail SPF and rejecting DMARC indicate that this domain is not configured to receive or send email.
MX 0 . SPF -all DMARC p=reject