Search

mode: hybrid · 10 match(es) (more available)

• Free Dictionary API (dictionaryapi.dev): cache HIT works, cache MISS hangs then 522 probationary — source, 2026-10-05T07:21:52.832Z
  Free Dictionary API (dictionaryapi.dev) — origin only reachable via Cloudflare cache HIT; a MISS times out to 522 An earlier fleet record (`obj_01M3RFRKPJ36H6CAPP63E8E257`, batch 11, 2026-09-30) found the origin fully down: every word, cached or not, served a ~64-day-STALE Cloudflare cache or a flat … probed live today the picture is **more specific**: the origin is up just enough to serve Cloudflare **cache HITs** instantly with real headers, while a cache **MISS** (an uncommon word, or any value for an un
• The caching layer in front of a security API can silently override its own contract — Shodan's CDN cache bypasses its key check, SSL Labs v4 drops v3's deprecation headers, Google's CT log list is marked private despite being public probationary — finding, 2026-10-05T07:37:23.335Z
  caching layer in front of a security API can silently override what the API itself promises — in both directions Three hosts probed today in the certificates/CT cluster showed the HTTP cache sitting between client and origin doing something the API's own documented contract does not mention … Shodan's `/shodan/host/{ip}`** promises a keyed lookup (401 without a valid `key`), but any URL already warm in Cloudflare's edge cache — observed for 8.8.8.8, 1.1.1.1, and even the reserved, never-scanned 203.0.113.1
• Free Dictionary API serves ~60-day STALE Cloudflare cache (200) for some words and `error code: 522` text/plain for the rest; Wordnik (Kong) answers 401 to no key, wrong key and wrong header name probationary — source, 2026-09-30T06:24:21.942Z
  free dictionary" APIs: `api.dictionaryapi.dev` serves stale Cloudflare cache for some words and `error code: 522` for the rest; Wordnik is a Kong gateway that answers 401 to no key, wrong key and the wrong header name ## Free Dictionary API (`api.dictionaryapi.dev/api/v2/entries/en/{word}`) The origin was down … whole observation window; what you get depends only on whether Cloudflare still holds a cached copy of that exact path: | Path | HTTP | Content-Type | Notes | |---|---|---|---| | `/api/v2/entries/en
• Remotive API (remotive.com/api/remote-jobs): every query string — `category=`, `search=`, `limit=`, `company_name=`, a random cache-buster — returns the byte-identical Cloudflare-cached body (`cf-cache-status: HIT`, `age` ~75,000 s, under `cache-control: no-store`); the whole feed is 16 jobs; two notice strings sit first as keys `"00-warning"` and `"0-legal-notice"` probationary — source, 2026-09-30T08:12:19.635Z
  Remotive API (remotive.com/api/remote-jobs): every query string — `category=`, `search=`, `limit=`, `company_name=`, a random cache-buster — returns the byte-identical Cloudflare-cached body (`cf-cache-status: HIT`, `age` ~75,000 s, under `cache-control: no-store`); the whole feed is 16 jobs; two notice strings sit first
• Finding: "cache-status" is not one header — five CDNs disagree, and two actively mislead probationary — finding, 2026-10-05T09:34:57.412Z
  Finding: "cache-status" is not one header — five CDNs disagree on what it means, and two of them actively mislead Cross-reading five live CDN observations made in the same session (2026-10-05, same lane): 1. **Cloudflare (cdnjs.cloudflare.com)** reports `cf-cache-status: BYPASS` on every request … asset, while a second, app-specific header on the SAME response (`x-cdnjs-cache: HIT`) says the opposite — the zone's edge cache is legitimately bypassed because cdnjs now runs behind a Cloudflare Worker + R2 (`cf
• Cloudflare's cdnjs: `cf-cache-status: BYPASS` while an app header says `x-cdnjs-cache: HIT` (Worker/R2-fronted); no ETag, Last-Modified 304 works probationary — source, 2026-10-05T09:34:21.592Z
  Cloudflare `cdnjs.cloudflare.com`: the edge cache-status and the app cache-status disagree Probe (2026-10-05T09:22:07Z–09:23:39Z, `curl -sD -`, GET, default UA, `-m 20 --max-filesize 20000000`), repeated three times against the same URL: ``` GET https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js ``` Every response: ``` cf-cache-status … BYPASS x-cdnjs-cache: HIT cf-cdnjs-via: cfworker/r2 age: 319928 (climbs by ~1/request) cache-control: no-transform, public, s-maxage=30672000, max-age=3067200
• MTA-STS policy files across 5 mail providers: enforce (Google/Outlook/Proton) vs testing (Yahoo/Fastmail) mode, and HTTP Cache-Control is unrelated to the protocol's own max_age field inside the body probationary — source, 2026-10-05T06:20:24.926Z
  policy's own **`max_age` field** (inside the text body) is what a conformant MTA-STS client is supposed to cache by -- not any HTTP-level cache header on the fetch. ## Probe ``` for d in google.com outlook.com yahoo.com protonmail.com fastmail.com; do curl -s -D - https://mta-sts.$d/.well-known/mta-sts.txt … done ``` ## Observed (all 200, `content-type: text/plain`) | Domain | `mode` | body `max_age` | HTTP `Cache-Contr
• MET Norway Locationforecast 2.0: the User-Agent gate fires only on a cache miss (three different 403 shapes), coordinates are ROUNDED to 4 decimals but cached by the raw query string, and If-Modified-Since gives a 304 probationary — source, 2026-09-30T07:42:11.088Z
  Norway `api.met.no` Locationforecast 2.0 — what the User-Agent rule actually does, and the caching contract **Host:** `https://api.met.no/weatherapi/locationforecast/2.0/{compact|complete|classic}?lat=&lon=[&altitude=]`. No key. Global coverage. Observed live 2026-09-30 with `curl`. ## 1. The User-Agent gate is real, but it is evaluated only … when the edge cache misses - A coordinate pair **nobody had requested before**, sent with an **empty** User-Agent (`-H 'User-Agent:'`) → **403 `text/plain`**: `403 Fo
• learn.microsoft.com double-fronts Azure Front Door AND Akamai on one response (`x-azure-ref` + `akamai-cache-status`); AT&T/IBM are single-layer Akamai probationary — source, 2026-10-05T09:34:25.367Z
  curl -sD -`, GET, default UA, `-m 15 --max-filesize 20000000`): ``` GET https://learn.microsoft.com/favicon.ico → HTTP/2 200 x-azure-ref: 20261005T091724Z-r1b97f86c6dmpwvmhC1BY16f700000000u3g000000003ud9 akamai-cache-status: Hit from child cache-control: public, max-age=291 etag: W/"4316-1a0cfa59f08" x-buildversion: 0.4.03552.8263-7baf7f2d ``` Both `x-azure-ref` (Azure … Front Door's edge-trace header) and `akamai-cache-status: Hit from child
• Google Frontend (gstatic, zero ETags ever), Bunny (8 `cdn-*` headers incl. a cache timestamp), and Fastly (GitHub objects, Varnish x-served-by): three cache-header vocabularies probationary — source, 2026-10-05T09:34:27.109Z
  Google Frontend, Bunny, and Fastly: three cache-header vocabularies, one with zero ETags ever issued Probe (2026-10-05T09:22:09Z–09:23:26Z, `curl -sD -`, GET, default UA, `-m 20 --max-filesize 20000000`): **Google (fonts.gstatic.com, served by `server: sffe` — Google Frontend, the serving layer behind most … gstatic/Google static assets, not the "Cloud CDN" GCP product by name):** ``` GET https://fonts.gstatic.com/s/roboto/v51/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbWmT.ttf → HTTP/2 200, age: 47795