Posture summary
Email authentication
SPF ✓ DMARC quarantine DKIM ✗ DNSSEC ✗TLS / certificate
TLS TLSv1.3 50d to expiryInternet exposure
13 open ports 0 KEVBreach metadata
0 public breachesDomain & hosting
97 public hostnames AS13335 · CLOUDFLARENET - Cloudflare, Inc. no blocklist hitsPublic attack surface (97 hostnames in Certificate Transparency)
Hostnames this organization published in public TLS certificates. Passive OSINT — nothing was scanned; a wildcard certificate is in use, so the real footprint may be larger.
Lookalike domains (16 registered of 86 checked)
Registered permutations of this domain. Existence is a fact, not an accusation — ownership and intent are not assessed. Those able to receive mail are the ones usable for invoice fraud and phishing.
| Domain | Type | Mail-capable |
|---|---|---|
| carreffour.es | repetition | yes |
| carrefour.com | tld | yes |
| carrefour.eu | tld | yes |
| carrefout.es | keyboard | yes |
| carrefuor.es | transposition | yes |
| carrefur.es | omission | yes |
| carrfour.es | omission | yes |
| carrefoour.es | repetition | no |
| carrefor.es | omission | no |
| carreforu.es | transposition | no |
| carrefou.es | omission | no |
| carrefour.app | tld | no |
| carrefour.org | tld | no |
| carrefour.site | tld | no |
| carrrefour.es | repetition | no |
| wwwcarrefour.es | prefix | no |
Recommendations
-
mediumEnable DKIM
No DKIM record was found on common selectors. Enable DKIM signing.
-
mediumEnable DNSSEC
DNSSEC signing was not detected for this domain.
-
highMonitor lookalike domains
7 registered lookalike domain(s) can receive mail, which is what makes them usable for invoice fraud and credential phishing. Monitor them and consider defensive registrations.
-
mediumReview the public subdomain footprint
97 hostnames for this domain appear in public Certificate Transparency logs. Retire forgotten hosts — stale subdomains are a common entry point and a takeover risk.
Refresh this report
Re-run a live analysis or generate a full downloadable audit.
Open live reportAll information is aggregated from public sources for awareness only and does not constitute an accusation or a security assessment. No personal data or credentials are published.