11 September 2026Example DISCOVER-01
Fictional domains and findings. No live assessment or registration check.
Domain assessment
One dependency to replace.
One name to review.
An external script on northline.example points to a domain shown as available in this example. A separate script uses an unqualified hostname.
- Website assessed
- 1
- Referenced domains
- 3
- High impact needing review
- 1
1 single-label name also needs client-network review; it is outside the domain-registration totals.
Your next action
Replace the retired widget.
Remove or replace the obsolete widget. Reassess the landing page and any other routes that use it.
Suggested owner: Web platform
Read evidence for northline.example ↗Supporting guide A domain appears in a finding. What now?
Impact and current exposure.
As of 11 September, 09:00 UTC · simulated
Available domains lead the review. A high impact classification alone does not make an unavailable domain a priority.
| Domain | Impact | Current registration exposure | Next action |
|---|---|---|---|
| legacy-assets.example | high | Registration exposure observed | Review acquisition exposure and contain an obsolete dependency. |
Checks to resolve
| Domain | Impact | Current registration exposure | Next action |
|---|
Unavailable domains · noted (2)
| Domain | Impact | Current registration exposure | Next action |
|---|---|---|---|
| analytics-service.example | high | No registration exposure observed | Maintain watch; verify expected ownership. |
| chat-service.example | info | No registration exposure observed | Maintain watch; verify expected ownership. |
Unavailable means the provider did not offer registration at this observation. It does not verify the expiry date, unchanged ownership or an uncompromised service.
Same availability. Different use.
Four illustrative contexts · simulated
Each domain below is fictional and available in this example. The recorded use changes the review priority; execution and visitor exposure remain separate questions.
Lookup only
lookup-hint.example
Medium review priorityDNS hint · lookup not observed
Use, activation & consequences
A DNS-prefetch declaration was found. This collector disables DNS prefetch and cannot establish visitor lookups.
- Priority basis
- Available to register: establish usable trust and its activation, then remove or replace obsolete references. Resource use has not been established sufficiently to raise review priority.
- Activation
- Browser elects to resolve a DNS-prefetch hint; caching can suppress an external query. This scan disables DNS prefetch.
- Tracking / visibility
- An authoritative DNS operator may see the queried name and timing, usually from a recursive resolver. Unique labels can support correlation; a lookup alone does not identify a visitor or reveal HTTP paths, cookies or page content.
- Response influence
- DNS-only hint: no response body is fetched and no page code or media is delivered by this hint.
- Collection limits
- Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Next action. Remove the obsolete hint; establish whether visitors ever resolve it.
Conditional media
lazy-media.example
Medium review priorityConditional reference · use not observed
Use, activation & consequences
A declaration records an activation condition, but the condition was not exercised or proven to cause a request.
- Priority basis
- Available to register: establish usable trust and its activation, then remove or replace obsolete references. Resource use has not been established sufficiently to raise review priority.
- Activation
- Lazy loading: viewport entry or browser loading decision The browser selects or loads the media, including any lazy-loading, viewport or playback conditions.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- The endpoint can replace the requested image or media and observe request metadata. Tracking does not require code execution; media alone does not grant page-script privileges.
- Collection limits
- Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Next action. Exercise the relevant viewport state and replace or remove the media reference.
Unresolved code reference
unused-code.example
Medium review priorityDeclared reference · use not observed
Use, activation & consequences
Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Priority basis
- Available to register: establish usable trust and its activation, then remove or replace obsolete references. Resource use has not been established sufficiently to raise review priority.
- Activation
- Activation unresolved: parsing alone does not establish use. Inspect the consuming code, configuration or user journey.
- Tracking / visibility
- No request or visitor disclosure is established by this reference alone.
- Response influence
- Establish how the reference is consumed before assigning code, media, tracking or data-handling consequences.
- Collection limits
- Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Next action. Trace the consuming code and the conditions that reach it; this scan does not prove dormancy.
Requested resource
requested-widget.example
High review priorityResource request failed
Use, activation & consequences
A request was initiated and failed. The endpoint may not have been reached; failure is not proof the reference is harmless.
- Priority basis
- Available to register with a recorded resource request: review and contain the dependency promptly. This is review priority, not proof of execution or compromise.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
- Collection limits
- Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Next action. Remove or replace the dependency and reassess. Failure does not remove the attempted use.
Understand use, impact and next actions → · Explore first & second-order trust →
Follow the trust.
northline.example · simulated
All 4 references
0 critical references View matches
2 high references View matches
0 medium references View matches
1 low reference View matches
1 informational reference View matches
4 referenced hosts from northline.example. Includes 1 single-label name for client-network review. Impact describes the recorded use and controls; registration exposure is a separate observation.
Click any point or connection for its evidence.
Simulated evidence · 4 supporting records
Root evidence
northline.example
Fictional records. No live collection or registration check.
Choose a supporting record. This list includes every record represented by this part of the journey.
Finding context-analyticsanalytics-service.example · JavaScript · high
Discovery provenance
- Recorded root
- https://northline.example/
- Page
- https://northline.example/
Recorded chain
- https://northline.example/
- https://analytics-service.example/analytics.js
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Finding context-chatchat-service.example · Embedded frames · info
Discovery provenance
- Recorded root
- https://northline.example/
- Page
- https://northline.example/
Recorded chain
- https://northline.example/
- https://chat-service.example/widget
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The browser loads the embedded content, subject to activation and loading controls.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- The endpoint controls the embedded content. Sandbox, origin boundaries and application messaging determine any effect on the surrounding page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Finding example-01legacy-assets.example · JavaScript · high
Discovery provenance
- Recorded root
- https://northline.example/
- Page
- https://northline.example/
Recorded chain
- https://northline.example/
- https://legacy-assets.example/widget.js
Use, activation & consequences
- Review priority
- High review priority
- Priority basis
- Available to register with a recorded resource request: review and contain the dependency promptly. This is review priority, not proof of execution or compromise.
- Use marker
- Resource request failed
- Evidence boundary
- A request was initiated and failed. The endpoint may not have been reached; failure is not proof the reference is harmless.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Recorded network outcomes
- Request 1
- GET · failed · No HTTP status · initial_load · Simulated name-resolution failure
Phase is observation timing, not proof of the initiating event. A response is not proof of execution.
Finding example-04test · JavaScript · low
Discovery provenance
- Recorded root
- https://northline.example/
- Page
- https://northline.example/
Recorded chain
- https://northline.example/
- https://test/widget.js
Use, activation & consequences
- Review priority
- Local-name review
- Priority basis
- Review local resolution and transport conditions; public registration availability does not apply.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Domain evidence
analytics-service.example
Fictional records. No live collection or registration check.
Finding context-analyticsanalytics-service.example · JavaScript · high
Recorded registration check
- Domain
- analytics-service.example
- Result
- UNAVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://analytics-service.example/analytics.js
This is the recorded availability result. It is not a new check or proof of compromise.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Domain evidence
chat-service.example
Fictional records. No live collection or registration check.
Finding context-chatchat-service.example · Embedded frames · info
Recorded registration check
- Domain
- chat-service.example
- Result
- UNAVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://chat-service.example/widget
This is the recorded availability result. It is not a new check or proof of compromise.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The browser loads the embedded content, subject to activation and loading controls.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- The endpoint controls the embedded content. Sandbox, origin boundaries and application messaging determine any effect on the surrounding page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Domain evidence
legacy-assets.example
Fictional records. No live collection or registration check.
Finding example-01legacy-assets.example · JavaScript · high
Recorded registration check
- Domain
- legacy-assets.example
- Result
- AVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://legacy-assets.example/widget.js
This is the recorded availability result. It is not a new check or proof of compromise.
Use, activation & consequences
- Review priority
- High review priority
- Priority basis
- Available to register with a recorded resource request: review and contain the dependency promptly. This is review priority, not proof of execution or compromise.
- Use marker
- Resource request failed
- Evidence boundary
- A request was initiated and failed. The endpoint may not have been reached; failure is not proof the reference is harmless.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Recorded network outcomes
- Request 1
- GET · failed · No HTTP status · initial_load · Simulated name-resolution failure
Phase is observation timing, not proof of the initiating event. A response is not proof of execution.
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Name-resolution evidence
test
Fictional records. No live collection or registration check.
Finding example-04test · JavaScript · low
Registration eligibility
- Hostname
- test
- Registration
- Not applicable
- Reason
- No registrable public domain is identified for this single-label reference. Registration checks and purchase referrals do not apply.
- Referenced URL
- https://test/widget.js
No registration check or purchase referral applies to this reference.
Name resolution & transport
- Hostname form
- Single-label hostname
- Interpretation
- A valid absolute URL with an unqualified hostname. Typo or leftover test configuration is suspected, not established.
- Resolution evidence
- Not measured in a client network. No NXDOMAIN or routability result is asserted.
- Client context
- Hosts configuration, DNS search suffixes and enabled local fallback such as LLMNR or NetBIOS vary by client, browser and network.
- HTTPS boundary
- HTTPS requires certificate trust and a name match for test. Name-resolution control alone cannot authenticate the service.
- Browser controls
- CSP, integrity and browser local-network access controls remain additional conditions.
- Authentication
- No authentication exchange observed. Integrated authentication and any credential exposure depend on client policy and a usable connection.
A public scanner’s resolution result cannot establish what happens on a visitor’s network. Nearby access alone does not establish control or exploitation.
Use, activation & consequences
- Review priority
- Local-name review
- Priority basis
- Review local resolution and transport conditions; public registration availability does not apply.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Resource evidence
JavaScript
Fictional records. No live collection or registration check.
Finding context-analyticsanalytics-service.example · JavaScript · high
Recorded observation
- Finding ID
- context-analytics
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://analytics-service.example/analytics.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Not recorded
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- This is a parsed script reference without integrity metadata. Registration is unavailable in the example; continuity of supplier ownership is not verified.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Resource evidence
Embedded frames
Fictional records. No live collection or registration check.
Finding context-chatchat-service.example · Embedded frames · info
Recorded observation
- Finding ID
- context-chat
- Reference type
- Embedded frames
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://chat-service.example/widget
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated embedded frame reference in the landing page.
- Collection
- Not recorded
Resource controls
- Policy decision
- unknown
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Empty sandbox attribute
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- The fictional iframe has an empty sandbox attribute, restricting scripts and forms. The registration result alone is not a security assessment.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The browser loads the embedded content, subject to activation and loading controls.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- The endpoint controls the embedded content. Sandbox, origin boundaries and application messaging determine any effect on the surrounding page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Resource evidence
JavaScript
Fictional records. No live collection or registration check.
Finding example-01legacy-assets.example · JavaScript · high
Recorded observation
- Finding ID
- example-01
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://legacy-assets.example/widget.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated browser script request; name resolution failed. No response or execution is demonstrated.
- Collection
- Observed during collection
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- The fictional page has no enforcing CSP and no integrity attribute on this script. Authenticated states and other routes are outside the example’s coverage.
Use, activation & consequences
- Review priority
- High review priority
- Priority basis
- Available to register with a recorded resource request: review and contain the dependency promptly. This is review priority, not proof of execution or compromise.
- Use marker
- Resource request failed
- Evidence boundary
- A request was initiated and failed. The endpoint may not have been reached; failure is not proof the reference is harmless.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Recorded network outcomes
- Request 1
- GET · failed · No HTTP status · initial_load · Simulated name-resolution failure
Phase is observation timing, not proof of the initiating event. A response is not proof of execution.
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Resource evidence
JavaScript
Fictional records. No live collection or registration check.
Finding example-04test · JavaScript · low
Name resolution & transport
- Hostname form
- Single-label hostname
- Interpretation
- A valid absolute URL with an unqualified hostname. Typo or leftover test configuration is suspected, not established.
- Resolution evidence
- Not measured in a client network. No NXDOMAIN or routability result is asserted.
- Client context
- Hosts configuration, DNS search suffixes and enabled local fallback such as LLMNR or NetBIOS vary by client, browser and network.
- HTTPS boundary
- HTTPS requires certificate trust and a name match for test. Name-resolution control alone cannot authenticate the service.
- Browser controls
- CSP, integrity and browser local-network access controls remain additional conditions.
- Authentication
- No authentication exchange observed. Integrated authentication and any credential exposure depend on client policy and a usable connection.
A public scanner’s resolution result cannot establish what happens on a visitor’s network. Nearby access alone does not establish control or exploitation.
Recorded observation
- Finding ID
- example-04
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://test/widget.js
- Location
- script[src]
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Parsed reference; runtime use is not established by parsing alone.
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- No client-network resolution, successful load, certificate trust or authentication exchange is demonstrated. DNS redirection alone does not defeat HTTPS certificate validation. The fictional page has no enforcing CSP or script integrity attribute.
Use, activation & consequences
- Review priority
- Local-name review
- Priority basis
- Review local resolution and transport conditions; public registration availability does not apply.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Impact basis
Code execution
Fictional records. No live collection or registration check.
Finding context-analyticsanalytics-service.example · JavaScript · high
Recorded observation
- Finding ID
- context-analytics
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://analytics-service.example/analytics.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Not recorded
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Impact and current registration exposure
- Impact if control changes
- An external analytics script is referenced by the landing page. If control changes and replacement code loads, it runs within the page’s context.
- Impact classification
- high
- Current registration exposure
- No registration exposure observed
- Exposure basis
- The provider reported this domain unavailable to register. This does not verify its expiry date or continuity of ownership.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Keep registration checks active. Record the expected owner and approved use; review the dependency if ownership or delivered content changes.
- Suggested owner
- Web platform
Controls
- This is a parsed script reference without integrity metadata. Registration is unavailable in the example; continuity of supplier ownership is not verified.
Prerequisites
- Control of the referenced resource and use by the affected page must be established.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide A domain appears in a finding. What now?
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Impact basis
Code execution
Fictional records. No live collection or registration check.
Finding example-01legacy-assets.example · JavaScript · high
Recorded observation
- Finding ID
- example-01
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://legacy-assets.example/widget.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated browser script request; name resolution failed. No response or execution is demonstrated.
- Collection
- Observed during collection
Use, activation & consequences
- Review priority
- High review priority
- Priority basis
- Available to register with a recorded resource request: review and contain the dependency promptly. This is review priority, not proof of execution or compromise.
- Use marker
- Resource request failed
- Evidence boundary
- A request was initiated and failed. The endpoint may not have been reached; failure is not proof the reference is harmless.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Recorded network outcomes
- Request 1
- GET · failed · No HTTP status · initial_load · Simulated name-resolution failure
Phase is observation timing, not proof of the initiating event. A response is not proof of execution.
Impact and current registration exposure
- Impact if control changes
- If a new owner can serve a script at this URL and the page executes it, the script could read or modify accessible page content and act within the page’s context.
- Impact classification
- high
- Current registration exposure
- Registration exposure observed
- Exposure basis
- The provider reported this domain available to register. This does not establish a successful takeover or execution path.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Recheck availability and confirm the reference is used. Remove or replace an obsolete dependency; consider defensive registration as temporary containment where eligible.
- Suggested owner
- Web platform
Controls
- The fictional page has no enforcing CSP and no integrity attribute on this script. Authenticated states and other routes are outside the example’s coverage.
Prerequisites
- Control of the referenced resource and use by the affected page must be established.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide A domain appears in a finding. What now?
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Impact basis
Code execution
Fictional records. No live collection or registration check.
Finding example-04test · JavaScript · low
Name resolution & transport
- Hostname form
- Single-label hostname
- Interpretation
- A valid absolute URL with an unqualified hostname. Typo or leftover test configuration is suspected, not established.
- Resolution evidence
- Not measured in a client network. No NXDOMAIN or routability result is asserted.
- Client context
- Hosts configuration, DNS search suffixes and enabled local fallback such as LLMNR or NetBIOS vary by client, browser and network.
- HTTPS boundary
- HTTPS requires certificate trust and a name match for test. Name-resolution control alone cannot authenticate the service.
- Browser controls
- CSP, integrity and browser local-network access controls remain additional conditions.
- Authentication
- No authentication exchange observed. Integrated authentication and any credential exposure depend on client policy and a usable connection.
A public scanner’s resolution result cannot establish what happens on a visitor’s network. Nearby access alone does not establish control or exploitation.
Recorded observation
- Finding ID
- example-04
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://test/widget.js
- Location
- script[src]
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Parsed reference; runtime use is not established by parsing alone.
Use, activation & consequences
- Review priority
- Local-name review
- Priority basis
- Review local resolution and transport conditions; public registration availability does not apply.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Impact and current registration exposure
- Impact if control changes
- A script uses the single-label host test. This may be a leftover test reference or an incomplete hostname. If a client resolves it to an attacker-controlled service, that service must still satisfy HTTPS and browser loading controls before replacement JavaScript could execute.
- Impact classification
- low
- Current registration exposure
- Local-name review required
- Exposure basis
- Registration availability does not apply to this hostname. Client resolution and loading controls need review.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Confirm the intended destination. Use a deliberate relative path for a same-site resource, or the intended fully qualified HTTPS hostname for a separate service; remove the reference if obsolete. Review affected client-network and certificate policies.
- Suggested owner
- Web platform / endpoint security
Controls
- No client-network resolution, successful load, certificate trust or authentication exchange is demonstrated. DNS redirection alone does not defeat HTTPS certificate validation. The fictional page has no enforcing CSP or script integrity attribute.
Prerequisites
- The affected page must actually attempt to load this script.
- The affected client must resolve test to a service the other party controls; proximity alone is insufficient.
- The HTTPS connection must authenticate the URL hostname test under the client’s trust configuration. A certificate for a DNS-suffix-expanded name alone is insufficient.
- Effective CSP, integrity checks and any browser local-network restrictions must permit the load.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide A domain appears in a finding. What now?
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Impact basis
Embedded content
Fictional records. No live collection or registration check.
Finding context-chatchat-service.example · Embedded frames · info
Recorded observation
- Finding ID
- context-chat
- Reference type
- Embedded frames
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://chat-service.example/widget
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated embedded frame reference in the landing page.
- Collection
- Not recorded
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The browser loads the embedded content, subject to activation and loading controls.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- The endpoint controls the embedded content. Sandbox, origin boundaries and application messaging determine any effect on the surrounding page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Impact and current registration exposure
- Impact if control changes
- A frame loads content from this domain. A change of resource control could change the embedded content; access to the parent page is not established.
- Impact classification
- info
- Current registration exposure
- No registration exposure observed
- Exposure basis
- The provider reported this domain unavailable to register. This does not verify its expiry date or continuity of ownership.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Keep registration checks active. Record the expected owner and approved use; review the dependency if ownership or delivered content changes.
- Suggested owner
- Web platform
Controls
- The fictional iframe has an empty sandbox attribute, restricting scripts and forms. The registration result alone is not a security assessment.
Prerequisites
- Control of the referenced resource and use by the affected page must be established.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide Give every domain an owner and a purpose.
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
northline.example → analytics-service.example
Fictional records. No live collection or registration check.
Finding context-analyticsanalytics-service.example · JavaScript · high
Discovery provenance
- Recorded root
- https://northline.example/
- Page
- https://northline.example/
Recorded chain
- https://northline.example/
- https://analytics-service.example/analytics.js
Recorded registration check
- Domain
- analytics-service.example
- Result
- UNAVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://analytics-service.example/analytics.js
This is the recorded availability result. It is not a new check or proof of compromise.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
analytics-service.example → JavaScript
Fictional records. No live collection or registration check.
Finding context-analyticsanalytics-service.example · JavaScript · high
Recorded registration check
- Domain
- analytics-service.example
- Result
- UNAVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://analytics-service.example/analytics.js
This is the recorded availability result. It is not a new check or proof of compromise.
Recorded observation
- Finding ID
- context-analytics
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://analytics-service.example/analytics.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Not recorded
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- This is a parsed script reference without integrity metadata. Registration is unavailable in the example; continuity of supplier ownership is not verified.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
JavaScript → Code execution
Fictional records. No live collection or registration check.
Finding context-analyticsanalytics-service.example · JavaScript · high
Recorded observation
- Finding ID
- context-analytics
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://analytics-service.example/analytics.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Not recorded
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- This is a parsed script reference without integrity metadata. Registration is unavailable in the example; continuity of supplier ownership is not verified.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Impact and current registration exposure
- Impact if control changes
- An external analytics script is referenced by the landing page. If control changes and replacement code loads, it runs within the page’s context.
- Impact classification
- high
- Current registration exposure
- No registration exposure observed
- Exposure basis
- The provider reported this domain unavailable to register. This does not verify its expiry date or continuity of ownership.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Keep registration checks active. Record the expected owner and approved use; review the dependency if ownership or delivered content changes.
- Suggested owner
- Web platform
Controls
- This is a parsed script reference without integrity metadata. Registration is unavailable in the example; continuity of supplier ownership is not verified.
Prerequisites
- Control of the referenced resource and use by the affected page must be established.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide A domain appears in a finding. What now?
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
northline.example → chat-service.example
Fictional records. No live collection or registration check.
Finding context-chatchat-service.example · Embedded frames · info
Discovery provenance
- Recorded root
- https://northline.example/
- Page
- https://northline.example/
Recorded chain
- https://northline.example/
- https://chat-service.example/widget
Recorded registration check
- Domain
- chat-service.example
- Result
- UNAVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://chat-service.example/widget
This is the recorded availability result. It is not a new check or proof of compromise.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The browser loads the embedded content, subject to activation and loading controls.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- The endpoint controls the embedded content. Sandbox, origin boundaries and application messaging determine any effect on the surrounding page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
chat-service.example → Embedded frames
Fictional records. No live collection or registration check.
Finding context-chatchat-service.example · Embedded frames · info
Recorded registration check
- Domain
- chat-service.example
- Result
- UNAVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://chat-service.example/widget
This is the recorded availability result. It is not a new check or proof of compromise.
Recorded observation
- Finding ID
- context-chat
- Reference type
- Embedded frames
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://chat-service.example/widget
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated embedded frame reference in the landing page.
- Collection
- Not recorded
Resource controls
- Policy decision
- unknown
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Empty sandbox attribute
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- The fictional iframe has an empty sandbox attribute, restricting scripts and forms. The registration result alone is not a security assessment.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The browser loads the embedded content, subject to activation and loading controls.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- The endpoint controls the embedded content. Sandbox, origin boundaries and application messaging determine any effect on the surrounding page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
Embedded frames → Embedded content
Fictional records. No live collection or registration check.
Finding context-chatchat-service.example · Embedded frames · info
Recorded observation
- Finding ID
- context-chat
- Reference type
- Embedded frames
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://chat-service.example/widget
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated embedded frame reference in the landing page.
- Collection
- Not recorded
Resource controls
- Policy decision
- unknown
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Empty sandbox attribute
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- The fictional iframe has an empty sandbox attribute, restricting scripts and forms. The registration result alone is not a security assessment.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The browser loads the embedded content, subject to activation and loading controls.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- The endpoint controls the embedded content. Sandbox, origin boundaries and application messaging determine any effect on the surrounding page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Impact and current registration exposure
- Impact if control changes
- A frame loads content from this domain. A change of resource control could change the embedded content; access to the parent page is not established.
- Impact classification
- info
- Current registration exposure
- No registration exposure observed
- Exposure basis
- The provider reported this domain unavailable to register. This does not verify its expiry date or continuity of ownership.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Keep registration checks active. Record the expected owner and approved use; review the dependency if ownership or delivered content changes.
- Suggested owner
- Web platform
Controls
- The fictional iframe has an empty sandbox attribute, restricting scripts and forms. The registration result alone is not a security assessment.
Prerequisites
- Control of the referenced resource and use by the affected page must be established.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide Give every domain an owner and a purpose.
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
northline.example → legacy-assets.example
Fictional records. No live collection or registration check.
Finding example-01legacy-assets.example · JavaScript · high
Discovery provenance
- Recorded root
- https://northline.example/
- Page
- https://northline.example/
Recorded chain
- https://northline.example/
- https://legacy-assets.example/widget.js
Recorded registration check
- Domain
- legacy-assets.example
- Result
- AVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://legacy-assets.example/widget.js
This is the recorded availability result. It is not a new check or proof of compromise.
Use, activation & consequences
- Review priority
- High review priority
- Priority basis
- Available to register with a recorded resource request: review and contain the dependency promptly. This is review priority, not proof of execution or compromise.
- Use marker
- Resource request failed
- Evidence boundary
- A request was initiated and failed. The endpoint may not have been reached; failure is not proof the reference is harmless.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Recorded network outcomes
- Request 1
- GET · failed · No HTTP status · initial_load · Simulated name-resolution failure
Phase is observation timing, not proof of the initiating event. A response is not proof of execution.
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
legacy-assets.example → JavaScript
Fictional records. No live collection or registration check.
Finding example-01legacy-assets.example · JavaScript · high
Recorded registration check
- Domain
- legacy-assets.example
- Result
- AVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://legacy-assets.example/widget.js
This is the recorded availability result. It is not a new check or proof of compromise.
Recorded observation
- Finding ID
- example-01
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://legacy-assets.example/widget.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated browser script request; name resolution failed. No response or execution is demonstrated.
- Collection
- Observed during collection
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- The fictional page has no enforcing CSP and no integrity attribute on this script. Authenticated states and other routes are outside the example’s coverage.
Use, activation & consequences
- Review priority
- High review priority
- Priority basis
- Available to register with a recorded resource request: review and contain the dependency promptly. This is review priority, not proof of execution or compromise.
- Use marker
- Resource request failed
- Evidence boundary
- A request was initiated and failed. The endpoint may not have been reached; failure is not proof the reference is harmless.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Recorded network outcomes
- Request 1
- GET · failed · No HTTP status · initial_load · Simulated name-resolution failure
Phase is observation timing, not proof of the initiating event. A response is not proof of execution.
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
JavaScript → Code execution
Fictional records. No live collection or registration check.
Finding example-01legacy-assets.example · JavaScript · high
Recorded observation
- Finding ID
- example-01
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://legacy-assets.example/widget.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated browser script request; name resolution failed. No response or execution is demonstrated.
- Collection
- Observed during collection
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- The fictional page has no enforcing CSP and no integrity attribute on this script. Authenticated states and other routes are outside the example’s coverage.
Use, activation & consequences
- Review priority
- High review priority
- Priority basis
- Available to register with a recorded resource request: review and contain the dependency promptly. This is review priority, not proof of execution or compromise.
- Use marker
- Resource request failed
- Evidence boundary
- A request was initiated and failed. The endpoint may not have been reached; failure is not proof the reference is harmless.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Recorded network outcomes
- Request 1
- GET · failed · No HTTP status · initial_load · Simulated name-resolution failure
Phase is observation timing, not proof of the initiating event. A response is not proof of execution.
Impact and current registration exposure
- Impact if control changes
- If a new owner can serve a script at this URL and the page executes it, the script could read or modify accessible page content and act within the page’s context.
- Impact classification
- high
- Current registration exposure
- Registration exposure observed
- Exposure basis
- The provider reported this domain available to register. This does not establish a successful takeover or execution path.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Recheck availability and confirm the reference is used. Remove or replace an obsolete dependency; consider defensive registration as temporary containment where eligible.
- Suggested owner
- Web platform
Controls
- The fictional page has no enforcing CSP and no integrity attribute on this script. Authenticated states and other routes are outside the example’s coverage.
Prerequisites
- Control of the referenced resource and use by the affected page must be established.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide A domain appears in a finding. What now?
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
northline.example → test
Fictional records. No live collection or registration check.
Finding example-04test · JavaScript · low
Discovery provenance
- Recorded root
- https://northline.example/
- Page
- https://northline.example/
Recorded chain
- https://northline.example/
- https://test/widget.js
Registration eligibility
- Hostname
- test
- Registration
- Not applicable
- Reason
- No registrable public domain is identified for this single-label reference. Registration checks and purchase referrals do not apply.
- Referenced URL
- https://test/widget.js
No registration check or purchase referral applies to this reference.
Name resolution & transport
- Hostname form
- Single-label hostname
- Interpretation
- A valid absolute URL with an unqualified hostname. Typo or leftover test configuration is suspected, not established.
- Resolution evidence
- Not measured in a client network. No NXDOMAIN or routability result is asserted.
- Client context
- Hosts configuration, DNS search suffixes and enabled local fallback such as LLMNR or NetBIOS vary by client, browser and network.
- HTTPS boundary
- HTTPS requires certificate trust and a name match for test. Name-resolution control alone cannot authenticate the service.
- Browser controls
- CSP, integrity and browser local-network access controls remain additional conditions.
- Authentication
- No authentication exchange observed. Integrated authentication and any credential exposure depend on client policy and a usable connection.
A public scanner’s resolution result cannot establish what happens on a visitor’s network. Nearby access alone does not establish control or exploitation.
Use, activation & consequences
- Review priority
- Local-name review
- Priority basis
- Review local resolution and transport conditions; public registration availability does not apply.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
test → JavaScript
Fictional records. No live collection or registration check.
Finding example-04test · JavaScript · low
Registration eligibility
- Hostname
- test
- Registration
- Not applicable
- Reason
- No registrable public domain is identified for this single-label reference. Registration checks and purchase referrals do not apply.
- Referenced URL
- https://test/widget.js
No registration check or purchase referral applies to this reference.
Name resolution & transport
- Hostname form
- Single-label hostname
- Interpretation
- A valid absolute URL with an unqualified hostname. Typo or leftover test configuration is suspected, not established.
- Resolution evidence
- Not measured in a client network. No NXDOMAIN or routability result is asserted.
- Client context
- Hosts configuration, DNS search suffixes and enabled local fallback such as LLMNR or NetBIOS vary by client, browser and network.
- HTTPS boundary
- HTTPS requires certificate trust and a name match for test. Name-resolution control alone cannot authenticate the service.
- Browser controls
- CSP, integrity and browser local-network access controls remain additional conditions.
- Authentication
- No authentication exchange observed. Integrated authentication and any credential exposure depend on client policy and a usable connection.
A public scanner’s resolution result cannot establish what happens on a visitor’s network. Nearby access alone does not establish control or exploitation.
Recorded observation
- Finding ID
- example-04
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://test/widget.js
- Location
- script[src]
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Parsed reference; runtime use is not established by parsing alone.
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- No client-network resolution, successful load, certificate trust or authentication exchange is demonstrated. DNS redirection alone does not defeat HTTPS certificate validation. The fictional page has no enforcing CSP or script integrity attribute.
Use, activation & consequences
- Review priority
- Local-name review
- Priority basis
- Review local resolution and transport conditions; public registration availability does not apply.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
JavaScript → Code execution
Fictional records. No live collection or registration check.
Finding example-04test · JavaScript · low
Name resolution & transport
- Hostname form
- Single-label hostname
- Interpretation
- A valid absolute URL with an unqualified hostname. Typo or leftover test configuration is suspected, not established.
- Resolution evidence
- Not measured in a client network. No NXDOMAIN or routability result is asserted.
- Client context
- Hosts configuration, DNS search suffixes and enabled local fallback such as LLMNR or NetBIOS vary by client, browser and network.
- HTTPS boundary
- HTTPS requires certificate trust and a name match for test. Name-resolution control alone cannot authenticate the service.
- Browser controls
- CSP, integrity and browser local-network access controls remain additional conditions.
- Authentication
- No authentication exchange observed. Integrated authentication and any credential exposure depend on client policy and a usable connection.
A public scanner’s resolution result cannot establish what happens on a visitor’s network. Nearby access alone does not establish control or exploitation.
Recorded observation
- Finding ID
- example-04
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://test/widget.js
- Location
- script[src]
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Parsed reference; runtime use is not established by parsing alone.
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- No client-network resolution, successful load, certificate trust or authentication exchange is demonstrated. DNS redirection alone does not defeat HTTPS certificate validation. The fictional page has no enforcing CSP or script integrity attribute.
Use, activation & consequences
- Review priority
- Local-name review
- Priority basis
- Review local resolution and transport conditions; public registration availability does not apply.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Impact and current registration exposure
- Impact if control changes
- A script uses the single-label host test. This may be a leftover test reference or an incomplete hostname. If a client resolves it to an attacker-controlled service, that service must still satisfy HTTPS and browser loading controls before replacement JavaScript could execute.
- Impact classification
- low
- Current registration exposure
- Local-name review required
- Exposure basis
- Registration availability does not apply to this hostname. Client resolution and loading controls need review.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Confirm the intended destination. Use a deliberate relative path for a same-site resource, or the intended fully qualified HTTPS hostname for a separate service; remove the reference if obsolete. Review affected client-network and certificate policies.
- Suggested owner
- Web platform / endpoint security
Controls
- No client-network resolution, successful load, certificate trust or authentication exchange is demonstrated. DNS redirection alone does not defeat HTTPS certificate validation. The fictional page has no enforcing CSP or script integrity attribute.
Prerequisites
- The affected page must actually attempt to load this script.
- The affected client must resolve test to a service the other party controls; proximity alone is insufficient.
- The HTTPS connection must authenticate the URL hostname test under the client’s trust configuration. A certificate for a DNS-suffix-expanded name alone is insufficient.
- Effective CSP, integrity checks and any browser local-network restrictions must permit the load.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide A domain appears in a finding. What now?
Assessment record & coverage
- Assessment ID
- example-discover
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Evidence, on request.
4 illustrated references
legacy-assets.example
Available · simulatedScript on northline.example · High impact
Impact if control changes. If a new owner can serve a script at this URL and the page executes it, the script could read or modify accessible page content and act within the page’s context.
Current registration exposure: Registration exposure observed
Reference, controls & next action
- Discovered on
https://northline.example/- Referenced resource
https://legacy-assets.example/widget.js- Controls & uncertainty
- The fictional page has no enforcing CSP and no integrity attribute on this script. Authenticated states and other routes are outside the example’s coverage.
- Next action
- Remove or replace the obsolete widget. Reassess the landing page and any other routes that use it.
Supporting guide A domain appears in a finding. What now?
- Suggested owner
- Web platform
Illustrated observation: 11 September 2026, 09:00 UTC. Registration data is simulated; no provider was queried. Impact classification is not evidence of compromise.
test
Local name · reviewScript on northline.example · Local-name review
Impact if control changes. A script uses the single-label host test. This may be a leftover test reference or an incomplete hostname. If a client resolves it to an attacker-controlled service, that service must still satisfy HTTPS and browser loading controls before replacement JavaScript could execute.
Current registration exposure: Local-name review required
Why a nearby attacker still needs more
- Resolution evidence
- Not measured in a client network. No NXDOMAIN or routability result is asserted.
- Client context
- Hosts configuration, DNS search suffixes and enabled local fallback such as LLMNR or NetBIOS vary by client, browser and network.
- HTTPS boundary
- HTTPS requires certificate trust and a name match for test. Name-resolution control alone cannot authenticate the service.
- Browser controls
- CSP, integrity and browser local-network access controls remain additional conditions.
- Authentication
- No authentication exchange observed. Integrated authentication and any credential exposure depend on client policy and a usable connection.
This is a naming and dependency review. It is not a purchasable-domain finding or a confirmed local-network exploit.
Reference, controls & next action
- Discovered on
https://northline.example/- Referenced resource
https://test/widget.js- Controls & uncertainty
- No client-network resolution, successful load, certificate trust or authentication exchange is demonstrated. DNS redirection alone does not defeat HTTPS certificate validation. The fictional page has no enforcing CSP or script integrity attribute.
- Next action
- Confirm the intended destination. Use a deliberate relative path for a same-site resource, or the intended fully qualified HTTPS hostname for a separate service; remove the reference if obsolete. Review affected client-network and certificate policies.
Supporting guide A domain appears in a finding. What now?
- Suggested owner
- Web platform / endpoint security
Illustrated observation: 11 September 2026, 09:00 UTC. No client resolver, certificate or registration check was performed. Impact classification is not evidence of compromise.
Other dependencies (2)
analytics-service.example
Unavailable · simulatedScript on northline.example · Dependency context
Impact if control changes. An external analytics script is referenced by the landing page. If control changes and replacement code loads, it runs within the page’s context.
Current registration exposure: No registration exposure observed
Reference, controls & next action
- Discovered on
https://northline.example/- Referenced resource
https://analytics-service.example/analytics.js- Controls & uncertainty
- This is a parsed script reference without integrity metadata. Registration is unavailable in the example; continuity of supplier ownership is not verified.
- Next action
- Keep registration checks active. Record the expected supplier and approved script; review any unapproved change before retaining the dependency.
Supporting guide A domain appears in a finding. What now?
- Suggested owner
- Web platform
Illustrated observation: 11 September 2026, 09:00 UTC. Registration data is simulated; no provider was queried. Impact classification is not evidence of compromise.
chat-service.example
Unavailable · simulatedEmbedded frame on northline.example · Dependency context
Impact if control changes. A frame loads content from this domain. A change of resource control could change the embedded content; access to the parent page is not established.
Current registration exposure: No registration exposure observed
Reference, controls & next action
- Discovered on
https://northline.example/- Referenced resource
https://chat-service.example/widget- Controls & uncertainty
- The fictional iframe has an empty sandbox attribute, restricting scripts and forms. The registration result alone is not a security assessment.
- Next action
- Retain the supplier relationship and sandbox restrictions in the dependency inventory.
Supporting guide Give every domain an owner and a purpose.
- Suggested owner
- Web platform
Illustrated observation: 11 September 2026, 09:00 UTC. Registration data is simulated; no provider was queried. Impact classification is not evidence of compromise.
Scope & limits
This example covers 1 configured landing page, with rendering and one navigation hop illustrated. It does not assess authenticated routes, every SPA state, mailboxes or enterprise identity systems.
- northline.example · Your domains
Available is an illustrated registration state, not a confirmed compromise. Unchecked means no result. A reference missing from a later scan would not, on its own, demonstrate a fix.