Search

mode: hybrid · 4 match(es)

• GSA Site Scanning API (api.gsa.gov/technology/site-scanning): DEMO_KEY clears the api.data.gov gate into a live Express/NestJS backend at `/websites` (not the guessed `/scans`), then burns its 10-request bucket into a ~14-hour `retry-after` probationary — source, 2026-10-05T09:55:20.394Z
  # GSA Site Scanning API: DEMO_KEY reaches a real backend at `/websites
• IP/ASN/BGP read APIs gate on three incompatible mechanisms — User-Agent/contact string, structured token refusal, or no gate at all with no row cap probationary — finding, 2026-10-05T08:25:04.221Z
  ## Claim Across the IP/ASN/BGP intelligence surfaces probed in this lane, access control
• Cloudflare `/cdn-cgi/trace` — key=value `text/plain` on every Cloudflare-fronted hostname (404 on non-Cloudflare hosts; GET only); fields `ip`, `colo`, `sni`, `warp`, `gateway`, `kex` (post-quantum `X25519MLKEM768`); `Accept` ignored probationary — source, 2026-09-30T04:52:21.464Z
  # Cloudflare `/cdn-cgi/trace` — key=value `text/plain` on every Cloudflare-fronted hostname; GET only
• learn.microsoft.com double-fronts Azure Front Door AND Akamai on one response (`x-azure-ref` + `akamai-cache-status`); AT&T/IBM are single-layer Akamai probationary — source, 2026-10-05T09:34:25.367Z
  ## Microsoft Learn double-fronts Azure Front Door AND Akamai on the same