11 September 2026Example TEAM-01
Fictional domains and findings. No live assessment or registration check.
Security & supplier assurance · 4–11 September 2026
Contain the shared dependency.
Keep ownership clear.
A script domain shown as available links Northline’s website and a supplier’s landing page. Assign both owners a review; the support link is a separate cleanup decision.
- Websites in scope
- 3
- High impact needing review
- 1
- Unanswered registration check
- 1
Decision brief
Coordinate the fix across the relationship.
The web platform team can replace Northline’s widget. Supplier assurance needs to obtain the partner’s response and verify its change. The current evidence does not establish an effect on a checkout or an authenticated customer session.
Impact and current exposure.
As of 11 September, 09:00 UTC · simulated
Available domains lead the review. A high impact classification alone does not make an unavailable domain a priority.
| Domain | Impact | Current registration exposure | Next action |
|---|---|---|---|
| legacy-assets.example | high | Registration exposure observed | Review acquisition exposure and contain an obsolete dependency. |
Checks to resolve
| Domain | Impact | Current registration exposure | Next action |
|---|---|---|---|
| retired-help.example | low | Registration exposure not established | Obtain a definitive registration check. |
Unavailable domains · noted (2)
| Domain | Impact | Current registration exposure | Next action |
|---|---|---|---|
| analytics-service.example | high | No registration exposure observed | Maintain watch; verify expected ownership. |
| chat-service.example | info | No registration exposure observed | Maintain watch; verify expected ownership. |
Unavailable means the provider did not offer registration at this observation. It does not verify the expiry date, unchanged ownership or an uncompromised service.
Same availability. Different use.
Four illustrative contexts · simulated
Each domain below is fictional and available in this example. The recorded use changes the review priority; execution and visitor exposure remain separate questions.
Lookup only
lookup-hint.example
Medium review priorityDNS hint · lookup not observed
Use, activation & consequences
A DNS-prefetch declaration was found. This collector disables DNS prefetch and cannot establish visitor lookups.
- Priority basis
- Available to register: establish usable trust and its activation, then remove or replace obsolete references. Resource use has not been established sufficiently to raise review priority.
- Activation
- Browser elects to resolve a DNS-prefetch hint; caching can suppress an external query. This scan disables DNS prefetch.
- Tracking / visibility
- An authoritative DNS operator may see the queried name and timing, usually from a recursive resolver. Unique labels can support correlation; a lookup alone does not identify a visitor or reveal HTTP paths, cookies or page content.
- Response influence
- DNS-only hint: no response body is fetched and no page code or media is delivered by this hint.
- Collection limits
- Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Next action. Remove the obsolete hint; establish whether visitors ever resolve it.
Conditional media
lazy-media.example
Medium review priorityConditional reference · use not observed
Use, activation & consequences
A declaration records an activation condition, but the condition was not exercised or proven to cause a request.
- Priority basis
- Available to register: establish usable trust and its activation, then remove or replace obsolete references. Resource use has not been established sufficiently to raise review priority.
- Activation
- Lazy loading: viewport entry or browser loading decision The browser selects or loads the media, including any lazy-loading, viewport or playback conditions.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- The endpoint can replace the requested image or media and observe request metadata. Tracking does not require code execution; media alone does not grant page-script privileges.
- Collection limits
- Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Next action. Exercise the relevant viewport state and replace or remove the media reference.
Unresolved code reference
unused-code.example
Medium review priorityDeclared reference · use not observed
Use, activation & consequences
Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Priority basis
- Available to register: establish usable trust and its activation, then remove or replace obsolete references. Resource use has not been established sufficiently to raise review priority.
- Activation
- Activation unresolved: parsing alone does not establish use. Inspect the consuming code, configuration or user journey.
- Tracking / visibility
- No request or visitor disclosure is established by this reference alone.
- Response influence
- Establish how the reference is consumed before assigning code, media, tracking or data-handling consequences.
- Collection limits
- Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Next action. Trace the consuming code and the conditions that reach it; this scan does not prove dormancy.
Requested resource
requested-widget.example
High review priorityResource request failed
Use, activation & consequences
A request was initiated and failed. The endpoint may not have been reached; failure is not proof the reference is harmless.
- Priority basis
- Available to register with a recorded resource request: review and contain the dependency promptly. This is review priority, not proof of execution or compromise.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
- Collection limits
- Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Next action. Remove or replace the dependency and reassess. Failure does not remove the attempted use.
Understand use, impact and next actions → · Explore first & second-order trust →
Follow the trust.
northline.example · simulated
All 4 references
0 critical references View matches
2 high references View matches
0 medium references View matches
1 low reference View matches
1 informational reference View matches
4 referenced hosts from northline.example. Includes 1 single-label name for client-network review. Impact describes the recorded use and controls; registration exposure is a separate observation.
Click any point or connection for its evidence.
Simulated evidence · 4 supporting records
Root evidence
northline.example
Fictional records. No live collection or registration check.
Choose a supporting record. This list includes every record represented by this part of the journey.
Finding context-analyticsanalytics-service.example · JavaScript · high
Discovery provenance
- Recorded root
- https://northline.example/
- Page
- https://northline.example/
Recorded chain
- https://northline.example/
- https://analytics-service.example/analytics.js
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Finding context-chatchat-service.example · Embedded frames · info
Discovery provenance
- Recorded root
- https://northline.example/
- Page
- https://northline.example/
Recorded chain
- https://northline.example/
- https://chat-service.example/widget
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The browser loads the embedded content, subject to activation and loading controls.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- The endpoint controls the embedded content. Sandbox, origin boundaries and application messaging determine any effect on the surrounding page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Finding example-01legacy-assets.example · JavaScript · high
Discovery provenance
- Recorded root
- https://northline.example/
- Page
- https://northline.example/
Recorded chain
- https://northline.example/
- https://legacy-assets.example/widget.js
Use, activation & consequences
- Review priority
- High review priority
- Priority basis
- Available to register with a recorded resource request: review and contain the dependency promptly. This is review priority, not proof of execution or compromise.
- Use marker
- Resource request failed
- Evidence boundary
- A request was initiated and failed. The endpoint may not have been reached; failure is not proof the reference is harmless.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Recorded network outcomes
- Request 1
- GET · failed · No HTTP status · initial_load · Simulated name-resolution failure
Phase is observation timing, not proof of the initiating event. A response is not proof of execution.
Finding example-04test · JavaScript · low
Discovery provenance
- Recorded root
- https://northline.example/
- Page
- https://northline.example/
Recorded chain
- https://northline.example/
- https://test/widget.js
Use, activation & consequences
- Review priority
- Local-name review
- Priority basis
- Review local resolution and transport conditions; public registration availability does not apply.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Domain evidence
analytics-service.example
Fictional records. No live collection or registration check.
Finding context-analyticsanalytics-service.example · JavaScript · high
Recorded registration check
- Domain
- analytics-service.example
- Result
- UNAVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://analytics-service.example/analytics.js
This is the recorded availability result. It is not a new check or proof of compromise.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Domain evidence
chat-service.example
Fictional records. No live collection or registration check.
Finding context-chatchat-service.example · Embedded frames · info
Recorded registration check
- Domain
- chat-service.example
- Result
- UNAVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://chat-service.example/widget
This is the recorded availability result. It is not a new check or proof of compromise.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The browser loads the embedded content, subject to activation and loading controls.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- The endpoint controls the embedded content. Sandbox, origin boundaries and application messaging determine any effect on the surrounding page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Domain evidence
legacy-assets.example
Fictional records. No live collection or registration check.
Finding example-01legacy-assets.example · JavaScript · high
Recorded registration check
- Domain
- legacy-assets.example
- Result
- AVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://legacy-assets.example/widget.js
This is the recorded availability result. It is not a new check or proof of compromise.
Use, activation & consequences
- Review priority
- High review priority
- Priority basis
- Available to register with a recorded resource request: review and contain the dependency promptly. This is review priority, not proof of execution or compromise.
- Use marker
- Resource request failed
- Evidence boundary
- A request was initiated and failed. The endpoint may not have been reached; failure is not proof the reference is harmless.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Recorded network outcomes
- Request 1
- GET · failed · No HTTP status · initial_load · Simulated name-resolution failure
Phase is observation timing, not proof of the initiating event. A response is not proof of execution.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Name-resolution evidence
test
Fictional records. No live collection or registration check.
Finding example-04test · JavaScript · low
Registration eligibility
- Hostname
- test
- Registration
- Not applicable
- Reason
- No registrable public domain is identified for this single-label reference. Registration checks and purchase referrals do not apply.
- Referenced URL
- https://test/widget.js
No registration check or purchase referral applies to this reference.
Name resolution & transport
- Hostname form
- Single-label hostname
- Interpretation
- A valid absolute URL with an unqualified hostname. Typo or leftover test configuration is suspected, not established.
- Resolution evidence
- Not measured in a client network. No NXDOMAIN or routability result is asserted.
- Client context
- Hosts configuration, DNS search suffixes and enabled local fallback such as LLMNR or NetBIOS vary by client, browser and network.
- HTTPS boundary
- HTTPS requires certificate trust and a name match for test. Name-resolution control alone cannot authenticate the service.
- Browser controls
- CSP, integrity and browser local-network access controls remain additional conditions.
- Authentication
- No authentication exchange observed. Integrated authentication and any credential exposure depend on client policy and a usable connection.
A public scanner’s resolution result cannot establish what happens on a visitor’s network. Nearby access alone does not establish control or exploitation.
Use, activation & consequences
- Review priority
- Local-name review
- Priority basis
- Review local resolution and transport conditions; public registration availability does not apply.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Resource evidence
JavaScript
Fictional records. No live collection or registration check.
Finding context-analyticsanalytics-service.example · JavaScript · high
Recorded observation
- Finding ID
- context-analytics
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://analytics-service.example/analytics.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Not recorded
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- This is a parsed script reference without integrity metadata. Registration is unavailable in the example; continuity of supplier ownership is not verified.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Resource evidence
Embedded frames
Fictional records. No live collection or registration check.
Finding context-chatchat-service.example · Embedded frames · info
Recorded observation
- Finding ID
- context-chat
- Reference type
- Embedded frames
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://chat-service.example/widget
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated embedded frame reference in the landing page.
- Collection
- Not recorded
Resource controls
- Policy decision
- unknown
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Empty sandbox attribute
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- The fictional iframe has an empty sandbox attribute, restricting scripts and forms. The registration result alone is not a security assessment.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The browser loads the embedded content, subject to activation and loading controls.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- The endpoint controls the embedded content. Sandbox, origin boundaries and application messaging determine any effect on the surrounding page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Resource evidence
JavaScript
Fictional records. No live collection or registration check.
Finding example-01legacy-assets.example · JavaScript · high
Recorded observation
- Finding ID
- example-01
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://legacy-assets.example/widget.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated browser script request; name resolution failed. No response or execution is demonstrated.
- Collection
- Observed during collection
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- The fictional page has no enforcing CSP and no integrity attribute on this script. Authenticated states and other routes are outside the example’s coverage.
Use, activation & consequences
- Review priority
- High review priority
- Priority basis
- Available to register with a recorded resource request: review and contain the dependency promptly. This is review priority, not proof of execution or compromise.
- Use marker
- Resource request failed
- Evidence boundary
- A request was initiated and failed. The endpoint may not have been reached; failure is not proof the reference is harmless.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Recorded network outcomes
- Request 1
- GET · failed · No HTTP status · initial_load · Simulated name-resolution failure
Phase is observation timing, not proof of the initiating event. A response is not proof of execution.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Resource evidence
JavaScript
Fictional records. No live collection or registration check.
Finding example-04test · JavaScript · low
Name resolution & transport
- Hostname form
- Single-label hostname
- Interpretation
- A valid absolute URL with an unqualified hostname. Typo or leftover test configuration is suspected, not established.
- Resolution evidence
- Not measured in a client network. No NXDOMAIN or routability result is asserted.
- Client context
- Hosts configuration, DNS search suffixes and enabled local fallback such as LLMNR or NetBIOS vary by client, browser and network.
- HTTPS boundary
- HTTPS requires certificate trust and a name match for test. Name-resolution control alone cannot authenticate the service.
- Browser controls
- CSP, integrity and browser local-network access controls remain additional conditions.
- Authentication
- No authentication exchange observed. Integrated authentication and any credential exposure depend on client policy and a usable connection.
A public scanner’s resolution result cannot establish what happens on a visitor’s network. Nearby access alone does not establish control or exploitation.
Recorded observation
- Finding ID
- example-04
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://test/widget.js
- Location
- script[src]
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Parsed reference; runtime use is not established by parsing alone.
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- No client-network resolution, successful load, certificate trust or authentication exchange is demonstrated. DNS redirection alone does not defeat HTTPS certificate validation. The fictional page has no enforcing CSP or script integrity attribute.
Use, activation & consequences
- Review priority
- Local-name review
- Priority basis
- Review local resolution and transport conditions; public registration availability does not apply.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Impact basis
Code execution
Fictional records. No live collection or registration check.
Finding context-analyticsanalytics-service.example · JavaScript · high
Recorded observation
- Finding ID
- context-analytics
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://analytics-service.example/analytics.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Not recorded
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Impact and current registration exposure
- Impact if control changes
- An external analytics script is referenced by the landing page. If control changes and replacement code loads, it runs within the page’s context.
- Impact classification
- high
- Current registration exposure
- No registration exposure observed
- Exposure basis
- The provider reported this domain unavailable to register. This does not verify its expiry date or continuity of ownership.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Keep registration checks active. Record the expected owner and approved use; review the dependency if ownership or delivered content changes.
- Suggested owner
- Web platform
Controls
- This is a parsed script reference without integrity metadata. Registration is unavailable in the example; continuity of supplier ownership is not verified.
Prerequisites
- Control of the referenced resource and use by the affected page must be established.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide A domain appears in a finding. What now?
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Impact basis
Code execution
Fictional records. No live collection or registration check.
Finding example-01legacy-assets.example · JavaScript · high
Recorded observation
- Finding ID
- example-01
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://legacy-assets.example/widget.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated browser script request; name resolution failed. No response or execution is demonstrated.
- Collection
- Observed during collection
Use, activation & consequences
- Review priority
- High review priority
- Priority basis
- Available to register with a recorded resource request: review and contain the dependency promptly. This is review priority, not proof of execution or compromise.
- Use marker
- Resource request failed
- Evidence boundary
- A request was initiated and failed. The endpoint may not have been reached; failure is not proof the reference is harmless.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Recorded network outcomes
- Request 1
- GET · failed · No HTTP status · initial_load · Simulated name-resolution failure
Phase is observation timing, not proof of the initiating event. A response is not proof of execution.
Impact and current registration exposure
- Impact if control changes
- If a new owner can serve a script at this URL and the page executes it, the script could read or modify accessible page content and act within the page’s context.
- Impact classification
- high
- Current registration exposure
- Registration exposure observed
- Exposure basis
- The provider reported this domain available to register. This does not establish a successful takeover or execution path.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Recheck availability and confirm the reference is used. Remove or replace an obsolete dependency; consider defensive registration as temporary containment where eligible.
- Suggested owner
- Web platform
Controls
- The fictional page has no enforcing CSP and no integrity attribute on this script. Authenticated states and other routes are outside the example’s coverage.
Prerequisites
- Control of the referenced resource and use by the affected page must be established.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide A domain appears in a finding. What now?
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Impact basis
Code execution
Fictional records. No live collection or registration check.
Finding example-04test · JavaScript · low
Name resolution & transport
- Hostname form
- Single-label hostname
- Interpretation
- A valid absolute URL with an unqualified hostname. Typo or leftover test configuration is suspected, not established.
- Resolution evidence
- Not measured in a client network. No NXDOMAIN or routability result is asserted.
- Client context
- Hosts configuration, DNS search suffixes and enabled local fallback such as LLMNR or NetBIOS vary by client, browser and network.
- HTTPS boundary
- HTTPS requires certificate trust and a name match for test. Name-resolution control alone cannot authenticate the service.
- Browser controls
- CSP, integrity and browser local-network access controls remain additional conditions.
- Authentication
- No authentication exchange observed. Integrated authentication and any credential exposure depend on client policy and a usable connection.
A public scanner’s resolution result cannot establish what happens on a visitor’s network. Nearby access alone does not establish control or exploitation.
Recorded observation
- Finding ID
- example-04
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://test/widget.js
- Location
- script[src]
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Parsed reference; runtime use is not established by parsing alone.
Use, activation & consequences
- Review priority
- Local-name review
- Priority basis
- Review local resolution and transport conditions; public registration availability does not apply.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Impact and current registration exposure
- Impact if control changes
- A script uses the single-label host test. This may be a leftover test reference or an incomplete hostname. If a client resolves it to an attacker-controlled service, that service must still satisfy HTTPS and browser loading controls before replacement JavaScript could execute.
- Impact classification
- low
- Current registration exposure
- Local-name review required
- Exposure basis
- Registration availability does not apply to this hostname. Client resolution and loading controls need review.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Confirm the intended destination. Use a deliberate relative path for a same-site resource, or the intended fully qualified HTTPS hostname for a separate service; remove the reference if obsolete. Review affected client-network and certificate policies.
- Suggested owner
- Web platform / endpoint security
Controls
- No client-network resolution, successful load, certificate trust or authentication exchange is demonstrated. DNS redirection alone does not defeat HTTPS certificate validation. The fictional page has no enforcing CSP or script integrity attribute.
Prerequisites
- The affected page must actually attempt to load this script.
- The affected client must resolve test to a service the other party controls; proximity alone is insufficient.
- The HTTPS connection must authenticate the URL hostname test under the client’s trust configuration. A certificate for a DNS-suffix-expanded name alone is insufficient.
- Effective CSP, integrity checks and any browser local-network restrictions must permit the load.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide A domain appears in a finding. What now?
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Impact basis
Embedded content
Fictional records. No live collection or registration check.
Finding context-chatchat-service.example · Embedded frames · info
Recorded observation
- Finding ID
- context-chat
- Reference type
- Embedded frames
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://chat-service.example/widget
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated embedded frame reference in the landing page.
- Collection
- Not recorded
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The browser loads the embedded content, subject to activation and loading controls.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- The endpoint controls the embedded content. Sandbox, origin boundaries and application messaging determine any effect on the surrounding page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Impact and current registration exposure
- Impact if control changes
- A frame loads content from this domain. A change of resource control could change the embedded content; access to the parent page is not established.
- Impact classification
- info
- Current registration exposure
- No registration exposure observed
- Exposure basis
- The provider reported this domain unavailable to register. This does not verify its expiry date or continuity of ownership.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Keep registration checks active. Record the expected owner and approved use; review the dependency if ownership or delivered content changes.
- Suggested owner
- Web platform
Controls
- The fictional iframe has an empty sandbox attribute, restricting scripts and forms. The registration result alone is not a security assessment.
Prerequisites
- Control of the referenced resource and use by the affected page must be established.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide Give every domain an owner and a purpose.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
northline.example → analytics-service.example
Fictional records. No live collection or registration check.
Finding context-analyticsanalytics-service.example · JavaScript · high
Discovery provenance
- Recorded root
- https://northline.example/
- Page
- https://northline.example/
Recorded chain
- https://northline.example/
- https://analytics-service.example/analytics.js
Recorded registration check
- Domain
- analytics-service.example
- Result
- UNAVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://analytics-service.example/analytics.js
This is the recorded availability result. It is not a new check or proof of compromise.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
analytics-service.example → JavaScript
Fictional records. No live collection or registration check.
Finding context-analyticsanalytics-service.example · JavaScript · high
Recorded registration check
- Domain
- analytics-service.example
- Result
- UNAVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://analytics-service.example/analytics.js
This is the recorded availability result. It is not a new check or proof of compromise.
Recorded observation
- Finding ID
- context-analytics
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://analytics-service.example/analytics.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Not recorded
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- This is a parsed script reference without integrity metadata. Registration is unavailable in the example; continuity of supplier ownership is not verified.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
JavaScript → Code execution
Fictional records. No live collection or registration check.
Finding context-analyticsanalytics-service.example · JavaScript · high
Recorded observation
- Finding ID
- context-analytics
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://analytics-service.example/analytics.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Not recorded
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- This is a parsed script reference without integrity metadata. Registration is unavailable in the example; continuity of supplier ownership is not verified.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Impact and current registration exposure
- Impact if control changes
- An external analytics script is referenced by the landing page. If control changes and replacement code loads, it runs within the page’s context.
- Impact classification
- high
- Current registration exposure
- No registration exposure observed
- Exposure basis
- The provider reported this domain unavailable to register. This does not verify its expiry date or continuity of ownership.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Keep registration checks active. Record the expected owner and approved use; review the dependency if ownership or delivered content changes.
- Suggested owner
- Web platform
Controls
- This is a parsed script reference without integrity metadata. Registration is unavailable in the example; continuity of supplier ownership is not verified.
Prerequisites
- Control of the referenced resource and use by the affected page must be established.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide A domain appears in a finding. What now?
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
northline.example → chat-service.example
Fictional records. No live collection or registration check.
Finding context-chatchat-service.example · Embedded frames · info
Discovery provenance
- Recorded root
- https://northline.example/
- Page
- https://northline.example/
Recorded chain
- https://northline.example/
- https://chat-service.example/widget
Recorded registration check
- Domain
- chat-service.example
- Result
- UNAVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://chat-service.example/widget
This is the recorded availability result. It is not a new check or proof of compromise.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The browser loads the embedded content, subject to activation and loading controls.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- The endpoint controls the embedded content. Sandbox, origin boundaries and application messaging determine any effect on the surrounding page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
chat-service.example → Embedded frames
Fictional records. No live collection or registration check.
Finding context-chatchat-service.example · Embedded frames · info
Recorded registration check
- Domain
- chat-service.example
- Result
- UNAVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://chat-service.example/widget
This is the recorded availability result. It is not a new check or proof of compromise.
Recorded observation
- Finding ID
- context-chat
- Reference type
- Embedded frames
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://chat-service.example/widget
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated embedded frame reference in the landing page.
- Collection
- Not recorded
Resource controls
- Policy decision
- unknown
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Empty sandbox attribute
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- The fictional iframe has an empty sandbox attribute, restricting scripts and forms. The registration result alone is not a security assessment.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The browser loads the embedded content, subject to activation and loading controls.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- The endpoint controls the embedded content. Sandbox, origin boundaries and application messaging determine any effect on the surrounding page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
Embedded frames → Embedded content
Fictional records. No live collection or registration check.
Finding context-chatchat-service.example · Embedded frames · info
Recorded observation
- Finding ID
- context-chat
- Reference type
- Embedded frames
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://chat-service.example/widget
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated embedded frame reference in the landing page.
- Collection
- Not recorded
Resource controls
- Policy decision
- unknown
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Empty sandbox attribute
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- The fictional iframe has an empty sandbox attribute, restricting scripts and forms. The registration result alone is not a security assessment.
Use, activation & consequences
- Review priority
- Recorded dependency
- Priority basis
- The current check reports unavailable. Retain the trust context and monitor changes; no current registration exposure is established.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The browser loads the embedded content, subject to activation and loading controls.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- The endpoint controls the embedded content. Sandbox, origin boundaries and application messaging determine any effect on the surrounding page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Impact and current registration exposure
- Impact if control changes
- A frame loads content from this domain. A change of resource control could change the embedded content; access to the parent page is not established.
- Impact classification
- info
- Current registration exposure
- No registration exposure observed
- Exposure basis
- The provider reported this domain unavailable to register. This does not verify its expiry date or continuity of ownership.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Keep registration checks active. Record the expected owner and approved use; review the dependency if ownership or delivered content changes.
- Suggested owner
- Web platform
Controls
- The fictional iframe has an empty sandbox attribute, restricting scripts and forms. The registration result alone is not a security assessment.
Prerequisites
- Control of the referenced resource and use by the affected page must be established.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide Give every domain an owner and a purpose.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
northline.example → legacy-assets.example
Fictional records. No live collection or registration check.
Finding example-01legacy-assets.example · JavaScript · high
Discovery provenance
- Recorded root
- https://northline.example/
- Page
- https://northline.example/
Recorded chain
- https://northline.example/
- https://legacy-assets.example/widget.js
Recorded registration check
- Domain
- legacy-assets.example
- Result
- AVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://legacy-assets.example/widget.js
This is the recorded availability result. It is not a new check or proof of compromise.
Use, activation & consequences
- Review priority
- High review priority
- Priority basis
- Available to register with a recorded resource request: review and contain the dependency promptly. This is review priority, not proof of execution or compromise.
- Use marker
- Resource request failed
- Evidence boundary
- A request was initiated and failed. The endpoint may not have been reached; failure is not proof the reference is harmless.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Recorded network outcomes
- Request 1
- GET · failed · No HTTP status · initial_load · Simulated name-resolution failure
Phase is observation timing, not proof of the initiating event. A response is not proof of execution.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
legacy-assets.example → JavaScript
Fictional records. No live collection or registration check.
Finding example-01legacy-assets.example · JavaScript · high
Recorded registration check
- Domain
- legacy-assets.example
- Result
- AVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://legacy-assets.example/widget.js
This is the recorded availability result. It is not a new check or proof of compromise.
Recorded observation
- Finding ID
- example-01
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://legacy-assets.example/widget.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated browser script request; name resolution failed. No response or execution is demonstrated.
- Collection
- Observed during collection
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- The fictional page has no enforcing CSP and no integrity attribute on this script. Authenticated states and other routes are outside the example’s coverage.
Use, activation & consequences
- Review priority
- High review priority
- Priority basis
- Available to register with a recorded resource request: review and contain the dependency promptly. This is review priority, not proof of execution or compromise.
- Use marker
- Resource request failed
- Evidence boundary
- A request was initiated and failed. The endpoint may not have been reached; failure is not proof the reference is harmless.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Recorded network outcomes
- Request 1
- GET · failed · No HTTP status · initial_load · Simulated name-resolution failure
Phase is observation timing, not proof of the initiating event. A response is not proof of execution.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
JavaScript → Code execution
Fictional records. No live collection or registration check.
Finding example-01legacy-assets.example · JavaScript · high
Recorded observation
- Finding ID
- example-01
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://legacy-assets.example/widget.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated browser script request; name resolution failed. No response or execution is demonstrated.
- Collection
- Observed during collection
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- The fictional page has no enforcing CSP and no integrity attribute on this script. Authenticated states and other routes are outside the example’s coverage.
Use, activation & consequences
- Review priority
- High review priority
- Priority basis
- Available to register with a recorded resource request: review and contain the dependency promptly. This is review priority, not proof of execution or compromise.
- Use marker
- Resource request failed
- Evidence boundary
- A request was initiated and failed. The endpoint may not have been reached; failure is not proof the reference is harmless.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Recorded network outcomes
- Request 1
- GET · failed · No HTTP status · initial_load · Simulated name-resolution failure
Phase is observation timing, not proof of the initiating event. A response is not proof of execution.
Impact and current registration exposure
- Impact if control changes
- If a new owner can serve a script at this URL and the page executes it, the script could read or modify accessible page content and act within the page’s context.
- Impact classification
- high
- Current registration exposure
- Registration exposure observed
- Exposure basis
- The provider reported this domain available to register. This does not establish a successful takeover or execution path.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Recheck availability and confirm the reference is used. Remove or replace an obsolete dependency; consider defensive registration as temporary containment where eligible.
- Suggested owner
- Web platform
Controls
- The fictional page has no enforcing CSP and no integrity attribute on this script. Authenticated states and other routes are outside the example’s coverage.
Prerequisites
- Control of the referenced resource and use by the affected page must be established.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide A domain appears in a finding. What now?
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
northline.example → test
Fictional records. No live collection or registration check.
Finding example-04test · JavaScript · low
Discovery provenance
- Recorded root
- https://northline.example/
- Page
- https://northline.example/
Recorded chain
- https://northline.example/
- https://test/widget.js
Registration eligibility
- Hostname
- test
- Registration
- Not applicable
- Reason
- No registrable public domain is identified for this single-label reference. Registration checks and purchase referrals do not apply.
- Referenced URL
- https://test/widget.js
No registration check or purchase referral applies to this reference.
Name resolution & transport
- Hostname form
- Single-label hostname
- Interpretation
- A valid absolute URL with an unqualified hostname. Typo or leftover test configuration is suspected, not established.
- Resolution evidence
- Not measured in a client network. No NXDOMAIN or routability result is asserted.
- Client context
- Hosts configuration, DNS search suffixes and enabled local fallback such as LLMNR or NetBIOS vary by client, browser and network.
- HTTPS boundary
- HTTPS requires certificate trust and a name match for test. Name-resolution control alone cannot authenticate the service.
- Browser controls
- CSP, integrity and browser local-network access controls remain additional conditions.
- Authentication
- No authentication exchange observed. Integrated authentication and any credential exposure depend on client policy and a usable connection.
A public scanner’s resolution result cannot establish what happens on a visitor’s network. Nearby access alone does not establish control or exploitation.
Use, activation & consequences
- Review priority
- Local-name review
- Priority basis
- Review local resolution and transport conditions; public registration availability does not apply.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
test → JavaScript
Fictional records. No live collection or registration check.
Finding example-04test · JavaScript · low
Registration eligibility
- Hostname
- test
- Registration
- Not applicable
- Reason
- No registrable public domain is identified for this single-label reference. Registration checks and purchase referrals do not apply.
- Referenced URL
- https://test/widget.js
No registration check or purchase referral applies to this reference.
Name resolution & transport
- Hostname form
- Single-label hostname
- Interpretation
- A valid absolute URL with an unqualified hostname. Typo or leftover test configuration is suspected, not established.
- Resolution evidence
- Not measured in a client network. No NXDOMAIN or routability result is asserted.
- Client context
- Hosts configuration, DNS search suffixes and enabled local fallback such as LLMNR or NetBIOS vary by client, browser and network.
- HTTPS boundary
- HTTPS requires certificate trust and a name match for test. Name-resolution control alone cannot authenticate the service.
- Browser controls
- CSP, integrity and browser local-network access controls remain additional conditions.
- Authentication
- No authentication exchange observed. Integrated authentication and any credential exposure depend on client policy and a usable connection.
A public scanner’s resolution result cannot establish what happens on a visitor’s network. Nearby access alone does not establish control or exploitation.
Recorded observation
- Finding ID
- example-04
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://test/widget.js
- Location
- script[src]
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Parsed reference; runtime use is not established by parsing alone.
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- No client-network resolution, successful load, certificate trust or authentication exchange is demonstrated. DNS redirection alone does not defeat HTTPS certificate validation. The fictional page has no enforcing CSP or script integrity attribute.
Use, activation & consequences
- Review priority
- Local-name review
- Priority basis
- Review local resolution and transport conditions; public registration availability does not apply.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
JavaScript → Code execution
Fictional records. No live collection or registration check.
Finding example-04test · JavaScript · low
Name resolution & transport
- Hostname form
- Single-label hostname
- Interpretation
- A valid absolute URL with an unqualified hostname. Typo or leftover test configuration is suspected, not established.
- Resolution evidence
- Not measured in a client network. No NXDOMAIN or routability result is asserted.
- Client context
- Hosts configuration, DNS search suffixes and enabled local fallback such as LLMNR or NetBIOS vary by client, browser and network.
- HTTPS boundary
- HTTPS requires certificate trust and a name match for test. Name-resolution control alone cannot authenticate the service.
- Browser controls
- CSP, integrity and browser local-network access controls remain additional conditions.
- Authentication
- No authentication exchange observed. Integrated authentication and any credential exposure depend on client policy and a usable connection.
A public scanner’s resolution result cannot establish what happens on a visitor’s network. Nearby access alone does not establish control or exploitation.
Recorded observation
- Finding ID
- example-04
- Reference type
- JavaScript
- Page
- https://northline.example/
- Source URL
- https://northline.example/
- Referenced URL
- https://test/widget.js
- Location
- script[src]
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Parsed reference; runtime use is not established by parsing alone.
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- No client-network resolution, successful load, certificate trust or authentication exchange is demonstrated. DNS redirection alone does not defeat HTTPS certificate validation. The fictional page has no enforcing CSP or script integrity attribute.
Use, activation & consequences
- Review priority
- Local-name review
- Priority basis
- Review local resolution and transport conditions; public registration availability does not apply.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Impact and current registration exposure
- Impact if control changes
- A script uses the single-label host test. This may be a leftover test reference or an incomplete hostname. If a client resolves it to an attacker-controlled service, that service must still satisfy HTTPS and browser loading controls before replacement JavaScript could execute.
- Impact classification
- low
- Current registration exposure
- Local-name review required
- Exposure basis
- Registration availability does not apply to this hostname. Client resolution and loading controls need review.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Confirm the intended destination. Use a deliberate relative path for a same-site resource, or the intended fully qualified HTTPS hostname for a separate service; remove the reference if obsolete. Review affected client-network and certificate policies.
- Suggested owner
- Web platform / endpoint security
Controls
- No client-network resolution, successful load, certificate trust or authentication exchange is demonstrated. DNS redirection alone does not defeat HTTPS certificate validation. The fictional page has no enforcing CSP or script integrity attribute.
Prerequisites
- The affected page must actually attempt to load this script.
- The affected client must resolve test to a service the other party controls; proximity alone is insufficient.
- The HTTPS connection must authenticate the URL hostname test under the client’s trust configuration. A certificate for a DNS-suffix-expanded name alone is insufficient.
- Effective CSP, integrity checks and any browser local-network restrictions must permit the load.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide A domain appears in a finding. What now?
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Other targets (2)
checkout-partner.example
All 1 references
0 critical references View matches
1 high reference View matches
0 medium references View matches
0 low references View matches
0 informational references View matches
1 referenced host from checkout-partner.example. Impact describes the recorded use and controls; registration exposure is a separate observation.
Click any point or connection for its evidence.
Simulated evidence · 1 supporting record
Root evidence
checkout-partner.example
Fictional records. No live collection or registration check.
Finding example-02legacy-assets.example · JavaScript · high
Discovery provenance
- Recorded root
- https://checkout-partner.example/
- Page
- https://checkout-partner.example/
Recorded chain
- https://checkout-partner.example/
- https://legacy-assets.example/widget.js
Use, activation & consequences
- Review priority
- Medium review priority
- Priority basis
- Available to register: establish usable trust and its activation, then remove or replace obsolete references. Resource use has not been established sufficiently to raise review priority.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Domain evidence
legacy-assets.example
Fictional records. No live collection or registration check.
Finding example-02legacy-assets.example · JavaScript · high
Recorded registration check
- Domain
- legacy-assets.example
- Result
- AVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://legacy-assets.example/widget.js
This is the recorded availability result. It is not a new check or proof of compromise.
Use, activation & consequences
- Review priority
- Medium review priority
- Priority basis
- Available to register: establish usable trust and its activation, then remove or replace obsolete references. Resource use has not been established sufficiently to raise review priority.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Resource evidence
JavaScript
Fictional records. No live collection or registration check.
Finding example-02legacy-assets.example · JavaScript · high
Recorded observation
- Finding ID
- example-02
- Reference type
- JavaScript
- Page
- https://checkout-partner.example/
- Source URL
- https://checkout-partner.example/
- Referenced URL
- https://legacy-assets.example/widget.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Not recorded
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- The fictional landing page has no enforcing CSP or script integrity attribute. The supplier’s checkout journey was not assessed.
Use, activation & consequences
- Review priority
- Medium review priority
- Priority basis
- Available to register: establish usable trust and its activation, then remove or replace obsolete references. Resource use has not been established sufficiently to raise review priority.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Impact basis
Code execution
Fictional records. No live collection or registration check.
Finding example-02legacy-assets.example · JavaScript · high
Recorded observation
- Finding ID
- example-02
- Reference type
- JavaScript
- Page
- https://checkout-partner.example/
- Source URL
- https://checkout-partner.example/
- Referenced URL
- https://legacy-assets.example/widget.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Not recorded
Use, activation & consequences
- Review priority
- Medium review priority
- Priority basis
- Available to register: establish usable trust and its activation, then remove or replace obsolete references. Resource use has not been established sufficiently to raise review priority.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Impact and current registration exposure
- Impact if control changes
- The same script dependency appears on the supplier’s landing page. A replacement script could influence accessible content in that page’s context; an effect on a checkout flow has not been established.
- Impact classification
- high
- Current registration exposure
- Registration exposure observed
- Exposure basis
- The provider reported this domain available to register. This does not establish a successful takeover or execution path.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Recheck availability and confirm the reference is used. Remove or replace an obsolete dependency; consider defensive registration as temporary containment where eligible.
- Suggested owner
- Supplier assurance
Controls
- The fictional landing page has no enforcing CSP or script integrity attribute. The supplier’s checkout journey was not assessed.
Prerequisites
- Control of the referenced resource and use by the affected page must be established.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide Who needs to know when ownership changes?
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
checkout-partner.example → legacy-assets.example
Fictional records. No live collection or registration check.
Finding example-02legacy-assets.example · JavaScript · high
Discovery provenance
- Recorded root
- https://checkout-partner.example/
- Page
- https://checkout-partner.example/
Recorded chain
- https://checkout-partner.example/
- https://legacy-assets.example/widget.js
Recorded registration check
- Domain
- legacy-assets.example
- Result
- AVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://legacy-assets.example/widget.js
This is the recorded availability result. It is not a new check or proof of compromise.
Use, activation & consequences
- Review priority
- Medium review priority
- Priority basis
- Available to register: establish usable trust and its activation, then remove or replace obsolete references. Resource use has not been established sufficiently to raise review priority.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
legacy-assets.example → JavaScript
Fictional records. No live collection or registration check.
Finding example-02legacy-assets.example · JavaScript · high
Recorded registration check
- Domain
- legacy-assets.example
- Result
- AVAILABLE
- Provider
- simulated
- Checked at
- 2026-09-11 09:00:00 UTC
- Cache valid until
- 2026-09-11 10:00:00 UTC
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://legacy-assets.example/widget.js
This is the recorded availability result. It is not a new check or proof of compromise.
Recorded observation
- Finding ID
- example-02
- Reference type
- JavaScript
- Page
- https://checkout-partner.example/
- Source URL
- https://checkout-partner.example/
- Referenced URL
- https://legacy-assets.example/widget.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Not recorded
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- The fictional landing page has no enforcing CSP or script integrity attribute. The supplier’s checkout journey was not assessed.
Use, activation & consequences
- Review priority
- Medium review priority
- Priority basis
- Available to register: establish usable trust and its activation, then remove or replace obsolete references. Resource use has not been established sufficiently to raise review priority.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
JavaScript → Code execution
Fictional records. No live collection or registration check.
Finding example-02legacy-assets.example · JavaScript · high
Recorded observation
- Finding ID
- example-02
- Reference type
- JavaScript
- Page
- https://checkout-partner.example/
- Source URL
- https://checkout-partner.example/
- Referenced URL
- https://legacy-assets.example/widget.js
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated script reference in the landing page.
- Collection
- Not recorded
Resource controls
- Policy decision
- no_policy
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- The fictional landing page has no enforcing CSP or script integrity attribute. The supplier’s checkout journey was not assessed.
Use, activation & consequences
- Review priority
- Medium review priority
- Priority basis
- Available to register: establish usable trust and its activation, then remove or replace obsolete references. Resource use has not been established sufficiently to raise review priority.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- The document loads this script or application control flow reaches the import.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Replacement code can read or change the page and its event handlers if it is accepted and executed. CSP, integrity checks, execution context and browser controls determine whether that path works.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Impact and current registration exposure
- Impact if control changes
- The same script dependency appears on the supplier’s landing page. A replacement script could influence accessible content in that page’s context; an effect on a checkout flow has not been established.
- Impact classification
- high
- Current registration exposure
- Registration exposure observed
- Exposure basis
- The provider reported this domain available to register. This does not establish a successful takeover or execution path.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Recheck availability and confirm the reference is used. Remove or replace an obsolete dependency; consider defensive registration as temporary containment where eligible.
- Suggested owner
- Supplier assurance
Controls
- The fictional landing page has no enforcing CSP or script integrity attribute. The supplier’s checkout journey was not assessed.
Prerequisites
- Control of the referenced resource and use by the affected page must be established.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide Who needs to know when ownership changes?
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
help.northline.example
All 1 references
0 critical references View matches
0 high references View matches
0 medium references View matches
1 low reference View matches
0 informational references View matches
1 referenced host from help.northline.example. Impact describes the recorded use and controls; registration exposure is a separate observation.
Click any point or connection for its evidence.
Simulated evidence · 1 supporting record
Root evidence
help.northline.example
Fictional records. No live collection or registration check.
Finding example-03retired-help.example · Links · low
Discovery provenance
- Recorded root
- https://help.northline.example/
- Page
- https://help.northline.example/
Recorded chain
- https://help.northline.example/
- https://retired-help.example/guides
Use, activation & consequences
- Review priority
- Availability recheck
- Priority basis
- Establish a current definitive availability result before assigning registration review priority.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- A user or application follows the link.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Control changes the destination a visitor reaches. A link declaration does not establish a visit or access to the originating page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Domain evidence
retired-help.example
Fictional records. No live collection or registration check.
Finding example-03retired-help.example · Links · low
Recorded registration check
- Domain
- retired-help.example
- Result
- UNCHECKED
- Provider
- simulated
- Checked at
- Not recorded
- Cache valid until
- Not recorded
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://retired-help.example/guides
This is the recorded availability result. It is not a new check or proof of compromise.
Use, activation & consequences
- Review priority
- Availability recheck
- Priority basis
- Establish a current definitive availability result before assigning registration review priority.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- A user or application follows the link.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Control changes the destination a visitor reaches. A link declaration does not establish a visit or access to the originating page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Resource evidence
Links
Fictional records. No live collection or registration check.
Finding example-03retired-help.example · Links · low
Recorded observation
- Finding ID
- example-03
- Reference type
- Links
- Page
- https://help.northline.example/
- Source URL
- https://help.northline.example/
- Referenced URL
- https://retired-help.example/guides
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated navigation link reference in the landing page.
- Collection
- Not recorded
Resource controls
- Policy decision
- unknown
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- No registration result is included for this fictional domain. Its ownership and destination need review; uncertainty is not a safe result.
Use, activation & consequences
- Review priority
- Availability recheck
- Priority basis
- Establish a current definitive availability result before assigning registration review priority.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- A user or application follows the link.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Control changes the destination a visitor reaches. A link declaration does not establish a visit or access to the originating page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Impact basis
Visitor destination
Fictional records. No live collection or registration check.
Finding example-03retired-help.example · Links · low
Recorded observation
- Finding ID
- example-03
- Reference type
- Links
- Page
- https://help.northline.example/
- Source URL
- https://help.northline.example/
- Referenced URL
- https://retired-help.example/guides
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated navigation link reference in the landing page.
- Collection
- Not recorded
Use, activation & consequences
- Review priority
- Availability recheck
- Priority basis
- Establish a current definitive availability result before assigning registration review priority.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- A user or application follows the link.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Control changes the destination a visitor reaches. A link declaration does not establish a visit or access to the originating page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Impact and current registration exposure
- Impact if control changes
- A visitor following the link could arrive at content controlled by a different owner. The link alone does not permit code to execute within Northline’s page.
- Impact classification
- low
- Current registration exposure
- Registration exposure not established
- Exposure basis
- There is no definitive registration result. Expiry and continuity of ownership have not been verified.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Obtain a definitive registration check and confirm the intended owner before deciding whether containment is needed.
- Suggested owner
- Customer support
Controls
- No registration result is included for this fictional domain. Its ownership and destination need review; uncertainty is not a safe result.
Prerequisites
- Control of the referenced resource and use by the affected page must be established.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide Retire the service. Review the domain separately.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
help.northline.example → retired-help.example
Fictional records. No live collection or registration check.
Finding example-03retired-help.example · Links · low
Discovery provenance
- Recorded root
- https://help.northline.example/
- Page
- https://help.northline.example/
Recorded chain
- https://help.northline.example/
- https://retired-help.example/guides
Recorded registration check
- Domain
- retired-help.example
- Result
- UNCHECKED
- Provider
- simulated
- Checked at
- Not recorded
- Cache valid until
- Not recorded
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://retired-help.example/guides
This is the recorded availability result. It is not a new check or proof of compromise.
Use, activation & consequences
- Review priority
- Availability recheck
- Priority basis
- Establish a current definitive availability result before assigning registration review priority.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- A user or application follows the link.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Control changes the destination a visitor reaches. A link declaration does not establish a visit or access to the originating page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
retired-help.example → Links
Fictional records. No live collection or registration check.
Finding example-03retired-help.example · Links · low
Recorded registration check
- Domain
- retired-help.example
- Result
- UNCHECKED
- Provider
- simulated
- Checked at
- Not recorded
- Cache valid until
- Not recorded
- Provider note
- Fictional availability record. No provider was queried.
- Referenced URL
- https://retired-help.example/guides
This is the recorded availability result. It is not a new check or proof of compromise.
Recorded observation
- Finding ID
- example-03
- Reference type
- Links
- Page
- https://help.northline.example/
- Source URL
- https://help.northline.example/
- Referenced URL
- https://retired-help.example/guides
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated navigation link reference in the landing page.
- Collection
- Not recorded
Resource controls
- Policy decision
- unknown
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- No registration result is included for this fictional domain. Its ownership and destination need review; uncertainty is not a safe result.
Use, activation & consequences
- Review priority
- Availability recheck
- Priority basis
- Establish a current definitive availability result before assigning registration review priority.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- A user or application follows the link.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Control changes the destination a visitor reaches. A link declaration does not establish a visit or access to the originating page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Simulated evidence · 1 supporting record
Relationship evidence
Links → Visitor destination
Fictional records. No live collection or registration check.
Finding example-03retired-help.example · Links · low
Recorded observation
- Finding ID
- example-03
- Reference type
- Links
- Page
- https://help.northline.example/
- Source URL
- https://help.northline.example/
- Referenced URL
- https://retired-help.example/guides
- Location
- Not recorded
- Line
- Not recorded
- Observation
- Simulated navigation link reference in the landing page.
- Collection
- Not recorded
Resource controls
- Policy decision
- unknown
- Integrity metadata
- Not recorded
- Nonce
- Not recorded
- Frame sandbox
- Not recorded
- Source excerpt
- Not captured in this report.
Collected enforcing policies
- Not recorded
Collected report-only policies
- Not recorded
Recorded controls
- No registration result is included for this fictional domain. Its ownership and destination need review; uncertainty is not a safe result.
Use, activation & consequences
- Review priority
- Availability recheck
- Priority basis
- Establish a current definitive availability result before assigning registration review priority.
- Use marker
- Declared reference · use not observed
- Evidence boundary
- Use was not observed in the collected scope. Absence during this scan does not prove that the reference is dormant.
- Activation
- A user or application follows the link.
- Tracking / visibility
- If a request reaches the endpoint, its operator can see request metadata such as path, query and timing. Client address, referrer and credentials depend on the client, policy and intermediaries. The anonymous scan does not establish exposure of real users or their data.
- Response influence
- Control changes the destination a visitor reaches. A link declaration does not establish a visit or access to the originating page.
Anonymous bounded collection. Scan requests do not establish real-user traffic or credentials. Static collector fetches do not prove page use; unvisited states remain unassessed. Request phase records timing, not causation.
Impact and current registration exposure
- Impact if control changes
- A visitor following the link could arrive at content controlled by a different owner. The link alone does not permit code to execute within Northline’s page.
- Impact classification
- low
- Current registration exposure
- Registration exposure not established
- Exposure basis
- There is no definitive registration result. Expiry and continuity of ownership have not been verified.
- Evidence confidence
- Simulated
- Rule set
- Illustrative assessment
- Recommended action
- Obtain a definitive registration check and confirm the intended owner before deciding whether containment is needed.
- Suggested owner
- Customer support
Controls
- No registration result is included for this fictional domain. Its ownership and destination need review; uncertainty is not a safe result.
Prerequisites
- Control of the referenced resource and use by the affected page must be established.
This is an assessment based on the cited reference and conditions, not an observation that exploitation occurred.
Supporting guide Retire the service. Review the domain separately.
Assessment record & coverage
- Assessment ID
- example-team
- Status
- simulated
- Assessment finished
- 2026-09-11 09:00:00 UTC
- Rule set
- Illustrative assessment
- Landing-page example only. Authenticated routes and other application states are not assessed.
Decisions & accountability.
Suggested ownership
| Priority / owner | Next action | Evidence |
|---|---|---|
| Prioritise · Web platformnorthline.example | Remove or replace the obsolete widget. Reassess the landing page and any other routes that use it. Supporting guide A domain appears in a finding. What now? | Read evidence for northline.example ↗ |
| Prioritise · Supplier assurancecheckout-partner.example | Ask the supplier to verify and replace the dependency. Record their response and reassess the affected page. Supporting guide Who needs to know when ownership changes? | Read evidence for checkout-partner.example ↗ |
| Review · Customer supporthelp.northline.example | Confirm the intended support destination and replace the obsolete link. Supporting guide Retire the service. Review the domain separately. | Read evidence for help.northline.example ↗ |
| Review · Web platform / endpoint securitynorthline.example | Confirm the intended destination. Use a deliberate relative path for a same-site resource, or the intended fully qualified HTTPS hostname for a separate service; remove the reference if obsolete. Review affected client-network and certificate policies. Supporting guide A domain appears in a finding. What now? | Read evidence for northline.example ↗ |
Content & infrastructure changes — see the evidence
Simulated change · no live observation
The infrastructure stayed the same. The script changed.
This separate fictional scenario illustrates content monitoring for a watched supplier. It is not another finding in the assessment above. Neither a new owner nor malicious intent has been established.
| Observed signal | Earlier | Later |
|---|---|---|
| Registration availability | Unavailable · simulated | Unavailable · simulated |
| Resolver addresses / certificate | Earlier observation | Unchanged in this scenario |
| Script content | Last successful observation · unreviewed | SHA-256 differs |
| Parsed destinations | Existing analytics endpoint | New collector.example endpoint |
Review the content change ↗
https://analytics-service.example/analytics.js
Response body SHA-256 · Parsed trust references
Evaluate the change
Confirm the new collector with the supplier and trace the data sent. Record an expected release, contain a confirmed unexpected trust path, or leave the evidence unresolved.
Supporting guide A domain appears in a finding. What now?
An observed change is not evidence of a new owner or compromise. Check authorised releases, dynamic content, CDN routing and certificate rotation. Evaluation notes remain separate from captured evidence.
Added trust references
fetch https://collector.example/collect
References absent from the later parsed response
This is a comparison of these two complete parsed responses; removal elsewhere is not established.
fetch https://analytics-service.example/collect
First text difference · line 1
Excerpt around the first differing line. Open each complete retained response below to review all changes.
Before
fetch('https://analytics-service.example/collect');
After
fetch('https://collector.example/collect');
Before
9/10/2026, 10:00:00 AM
Response SHA-25626b7bc1ef80dc7b69710349a7c8114bf7423829d57ecc668e45a618b1d7e5237
Complete fictional response text; no live request was made.
Observation & citation
{
"key": "simulated-resource",
"url": "https://analytics-service.example/analytics.js",
"final_url": "https://analytics-service.example/analytics.js",
"profile": "anonymous-static-v1 (simulated)",
"observed_at": 1789030800,
"status": 200,
"content_type": "application/javascript",
"body_sha256": "26b7bc1ef80dc7b69710349a7c8114bf7423829d57ecc668e45a618b1d7e5237",
"body_bytes": 52,
"snapshot_note": "Complete fictional response text; no live request was made.",
"headers": {},
"headers_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
"headers_complete": true,
"references": [
"fetch https://analytics-service.example/collect"
],
"references_complete": true,
"infrastructure": {
"addresses": [
"192.0.2.10"
],
"connected_ip": "192.0.2.10",
"tls_certificate_sha256": "simulated-unchanged-certificate",
"tls_note": "Illustrative fingerprint; no live TLS connection",
"redirects": [
"https://analytics-service.example/analytics.js"
]
}
}Complete retained response text
fetch('https://analytics-service.example/collect');
After
9/11/2026, 10:00:00 AM
Response SHA-256593f68fbede884200d0e864da934864fc72f02a85a2affba8009179720934070
Complete fictional response text; no live request was made.
Observation & citation
{
"key": "simulated-resource",
"url": "https://analytics-service.example/analytics.js",
"final_url": "https://analytics-service.example/analytics.js",
"profile": "anonymous-static-v1 (simulated)",
"observed_at": 1789117200,
"status": 200,
"content_type": "application/javascript",
"body_sha256": "593f68fbede884200d0e864da934864fc72f02a85a2affba8009179720934070",
"body_bytes": 44,
"snapshot_note": "Complete fictional response text; no live request was made.",
"headers": {},
"headers_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
"headers_complete": true,
"references": [
"fetch https://collector.example/collect"
],
"references_complete": true,
"infrastructure": {
"addresses": [
"192.0.2.10"
],
"connected_ip": "192.0.2.10",
"tls_certificate_sha256": "simulated-unchanged-certificate",
"tls_note": "Illustrative fingerprint; no live TLS connection",
"redirects": [
"https://analytics-service.example/analytics.js"
]
}
}Complete retained response text
fetch('https://collector.example/collect');
Live watches now retain dated hashes, bounded response text, security headers, parsed references and DNS/TLS observations from fetched resources. NS, MX, CNAME, RDAP and ownership verification are not collected. An unchanged proxy cannot establish ownership continuity.
How this could fit your workflow
The proposed Team plan adds report branding, API access and outbound webhooks. A report like this could accompany an internal issue; the event and evidence record would let a team connect the decision to its own workflow.
This is a report design example. It has not created a task, sent a notification or connected an integration.
Evidence, on request.
6 illustrated references
legacy-assets.example
Available · simulatedScript on northline.example · High impact
Impact if control changes. If a new owner can serve a script at this URL and the page executes it, the script could read or modify accessible page content and act within the page’s context.
Current registration exposure: Registration exposure observed
Reference, controls & next action
- Discovered on
https://northline.example/- Referenced resource
https://legacy-assets.example/widget.js- Controls & uncertainty
- The fictional page has no enforcing CSP and no integrity attribute on this script. Authenticated states and other routes are outside the example’s coverage.
- Next action
- Remove or replace the obsolete widget. Reassess the landing page and any other routes that use it.
Supporting guide A domain appears in a finding. What now?
- Suggested owner
- Web platform
Illustrated observation: 11 September 2026, 09:00 UTC. Registration data is simulated; no provider was queried. Impact classification is not evidence of compromise.
legacy-assets.example
Available · simulatedScript on checkout-partner.example · High impact
Impact if control changes. The same script dependency appears on the supplier’s landing page. A replacement script could influence accessible content in that page’s context; an effect on a checkout flow has not been established.
Current registration exposure: Registration exposure observed
Reference, controls & next action
- Discovered on
https://checkout-partner.example/- Referenced resource
https://legacy-assets.example/widget.js- Controls & uncertainty
- The fictional landing page has no enforcing CSP or script integrity attribute. The supplier’s checkout journey was not assessed.
- Next action
- Ask the supplier to verify and replace the dependency. Record their response and reassess the affected page.
Supporting guide Who needs to know when ownership changes?
- Suggested owner
- Supplier assurance
Illustrated observation: 11 September 2026, 09:00 UTC. Registration data is simulated; no provider was queried. Impact classification is not evidence of compromise.
retired-help.example
UncheckedNavigation link on help.northline.example · Low impact
Impact if control changes. A visitor following the link could arrive at content controlled by a different owner. The link alone does not permit code to execute within Northline’s page.
Current registration exposure: Registration exposure not established
Reference, controls & next action
- Discovered on
https://help.northline.example/- Referenced resource
https://retired-help.example/guides- Controls & uncertainty
- No registration result is included for this fictional domain. Its ownership and destination need review; uncertainty is not a safe result.
- Next action
- Confirm the intended support destination and replace the obsolete link.
Supporting guide Retire the service. Review the domain separately.
- Suggested owner
- Customer support
Illustrated observation: 11 September 2026, 09:00 UTC. Registration data is simulated; no provider was queried. Impact classification is not evidence of compromise.
test
Local name · reviewScript on northline.example · Local-name review
Impact if control changes. A script uses the single-label host test. This may be a leftover test reference or an incomplete hostname. If a client resolves it to an attacker-controlled service, that service must still satisfy HTTPS and browser loading controls before replacement JavaScript could execute.
Current registration exposure: Local-name review required
Why a nearby attacker still needs more
- Resolution evidence
- Not measured in a client network. No NXDOMAIN or routability result is asserted.
- Client context
- Hosts configuration, DNS search suffixes and enabled local fallback such as LLMNR or NetBIOS vary by client, browser and network.
- HTTPS boundary
- HTTPS requires certificate trust and a name match for test. Name-resolution control alone cannot authenticate the service.
- Browser controls
- CSP, integrity and browser local-network access controls remain additional conditions.
- Authentication
- No authentication exchange observed. Integrated authentication and any credential exposure depend on client policy and a usable connection.
This is a naming and dependency review. It is not a purchasable-domain finding or a confirmed local-network exploit.
Reference, controls & next action
- Discovered on
https://northline.example/- Referenced resource
https://test/widget.js- Controls & uncertainty
- No client-network resolution, successful load, certificate trust or authentication exchange is demonstrated. DNS redirection alone does not defeat HTTPS certificate validation. The fictional page has no enforcing CSP or script integrity attribute.
- Next action
- Confirm the intended destination. Use a deliberate relative path for a same-site resource, or the intended fully qualified HTTPS hostname for a separate service; remove the reference if obsolete. Review affected client-network and certificate policies.
Supporting guide A domain appears in a finding. What now?
- Suggested owner
- Web platform / endpoint security
Illustrated observation: 11 September 2026, 09:00 UTC. No client resolver, certificate or registration check was performed. Impact classification is not evidence of compromise.
Other dependencies (2)
analytics-service.example
Unavailable · simulatedScript on northline.example · Dependency context
Impact if control changes. An external analytics script is referenced by the landing page. If control changes and replacement code loads, it runs within the page’s context.
Current registration exposure: No registration exposure observed
Reference, controls & next action
- Discovered on
https://northline.example/- Referenced resource
https://analytics-service.example/analytics.js- Controls & uncertainty
- This is a parsed script reference without integrity metadata. Registration is unavailable in the example; continuity of supplier ownership is not verified.
- Next action
- Keep registration checks active. Record the expected supplier and approved script; review any unapproved change before retaining the dependency.
Supporting guide A domain appears in a finding. What now?
- Suggested owner
- Web platform
Illustrated observation: 11 September 2026, 09:00 UTC. Registration data is simulated; no provider was queried. Impact classification is not evidence of compromise.
chat-service.example
Unavailable · simulatedEmbedded frame on northline.example · Dependency context
Impact if control changes. A frame loads content from this domain. A change of resource control could change the embedded content; access to the parent page is not established.
Current registration exposure: No registration exposure observed
Reference, controls & next action
- Discovered on
https://northline.example/- Referenced resource
https://chat-service.example/widget- Controls & uncertainty
- The fictional iframe has an empty sandbox attribute, restricting scripts and forms. The registration result alone is not a security assessment.
- Next action
- Retain the supplier relationship and sandbox restrictions in the dependency inventory.
Supporting guide Give every domain an owner and a purpose.
- Suggested owner
- Web platform
Illustrated observation: 11 September 2026, 09:00 UTC. Registration data is simulated; no provider was queried. Impact classification is not evidence of compromise.
Scope & limits
This example covers 3 configured landing pages, with rendering and one navigation hop illustrated. It does not assess authenticated routes, every SPA state, mailboxes or enterprise identity systems.
- northline.example · Your domains
- checkout-partner.example · Trusted partners
- help.northline.example · AppSec
Available is an illustrated registration state, not a confirmed compromise. Unchecked means no result. A reference missing from a later scan would not, on its own, demonstrate a fix.