orbio.bot

Public security posture · Completed

Share on X

Security grade

B
Configuration score82/100

Grades reflect only the externally visible controls listed below. A good grade does not prove the application is secure. How grades work

0
High
1
Medium
2
Low
1
Informational
20 of 24 assessed checks passed
Agent summaryExplains the evidence below. It doesn't create findings or change the grade.

Agent summary

Without a DMARC policy, receiving mail servers are not instructed on how to handle emails that spoof the orbio.bot domain, which could lead to undetected phishing attacks. The site is well-protected with features like HTTPS, HSTS, and Content Security Policy already in place. The remaining fixes focus on enhancing email security and providing a channel for vulnerability reporting.

  1. 01Publish a DMARC policy to prevent email spoofing and protect users from phishing attacks.DMARC policymedium
  2. 02Create a security.txt file to provide a channel for vulnerability reporting and disclosure.security.txtinfo
  3. 03Implement an SPF record to declare authorized mail servers and prevent spam.SPF recordlow
  4. 04Enable DNSSEC to cryptographically sign DNS answers and enhance domain security.DNSSEClow

meta/llama-3.3-70b-instruct-fp8-fast · Workers AI

Website & claims

What the site says, checked against data
Screenshot of orbio.bot at scan time
orbio.bot · captured at scan time
Page title
orbio.bot | Autopilot for orbio CREDIT
Domain registered
Oct 20, 2026 · 0 days before this scan
Registrar
Spaceship, Inc.
Contract address on site
0xf2e4a05c6faaec17bc999ceeb77b81cf4de5d473
Links on site
X: x.com/getorbiobot
? Can't verify

“No owner, no fee”

The contract has no owner() function to check.

Claims are quoted verbatim from the page. “Matches” and “Doesn't match” come from on-chain data, the token's metadata or public domain records. Anything we can't check against data is marked “Can't verify”, which is not the same as false.

TLS & transport

All checks passed
HTTPS works with a trusted certificatePassed
The homepage loaded over HTTPS and the certificate was accepted.
Final URL
https://orbio.bot/
Status
200
HTTP redirects to HTTPSPassed
The unencrypted homepage immediately redirects to HTTPS.
Redirect
308 → https://orbio.bot/
HSTS is enabledPassed
Browsers are told to use HTTPS for 730 days, including subdomains.
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Legacy TLS versions are refusedPassed
The server refused handshakes offering only TLS 1.0 or TLS 1.1.
TLS 1.0
rejected
TLS 1.1
rejected

HTTP security headers

All checks passed
Content Security Policy is enforcedPassed
Script sources are restricted by an enforced policy.
Content-Security-Policy
default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; media-src 'self'; manifest-src 'self'; worker-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-src 'none'; frame-ancestors 'none'
Framing is restrictedPassed
Other sites can't embed this page in a frame.
X-Frame-Options
DENY
CSP frame-ancestors
'none'
MIME sniffing disabledPassed
Browsers will respect declared content types.
X-Content-Type-Options
nosniff
Referrer-Policy is setPassed
Policy: no-referrer.
Referrer-Policy
no-referrer
Permissions-Policy is setPassed
Access to powerful browser features is restricted.
Permissions-Policy
camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=(), bluetooth=(), hid=(), interest-cohort=(), browsing-topics=()
No exact versions disclosedPassed
Server headers don't reveal exact software versions.

Cookie configuration

All checks passed
Secure flag: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
HttpOnly: no session cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
SameSite: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.

DNS & email posture

3 findings
mediumConfirmed

No DMARC policy

Receiving mail servers aren't told what to do with mail that spoofs this domain.

Lookup
_dmarc.orbio.bot
Recommendation · Publish _dmarc TXT v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain and move to p=reject once reports look clean.
Why it matters ↓

DMARC tells receiving mail servers to reject mail that fails authentication — the main defence against spoofed announcements from your domain.

How we check: Reads the _dmarc TXT record for the domain or its organizational domain and checks the policy.

https://dmarc.org/overview/
lowConfirmed

No SPF record

The domain doesn't declare which servers may send mail as it.

MX
(none)
Recommendation · If the domain never sends mail, publish v=spf1 -all.
Why it matters ↓

SPF lists who may send mail as the domain. Crypto projects are frequent targets of impersonation emails.

How we check: Reads the domain's TXT records for an SPF policy and checks it is not permissive.

https://datatracker.ietf.org/doc/html/rfc7208
lowConfirmed

DNSSEC not enabled

DNS answers for this domain are not cryptographically signed.

AD flag
not set
Recommendation · Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
Why it matters ↓

DNSSEC prevents forged DNS answers from sending visitors to a look-alike server.

How we check: Resolves the domain through a validating resolver and checks whether the answer is DNSSEC-authenticated.

https://www.cloudflare.com/dns/dnssec/how-dnssec-works/
CAA records publishedPassed
Certificate issuance is restricted.
CAA orbio.bot
0 issue "letsencrypt.org"
CAA orbio.bot
0 issue "pki.goog"
CAA orbio.bot
0 issue "sectigo.com"

Frontend & disclosure

1 finding
infoConfirmed

No security.txt

There is no published channel for reporting vulnerabilities.

https://orbio.bot/.well-known/security.txt
HTTP 404
Recommendation · Publish /.well-known/security.txt with Contact and Expires fields (see securitytxt.org).
Why it matters ↓

Gives researchers a clear way to report vulnerabilities privately instead of disclosing them publicly.

How we check: Requests /.well-known/security.txt and checks it contains a Contact field and has not expired.

https://securitytxt.org/
No mixed contentPassed
All resources referenced in the homepage HTML use HTTPS or relative URLs.
No third-party scripts in the HTMLPassed
All script tags in the homepage HTML load from the site's own domain.

Web3 frontend

All checks passed
No known-malicious releases referencedPassed
Checked 5 scripts and the homepage HTML against published malicious wallet-package releases.
No wallet code loaded from public CDNsPassed
Wallet and chain libraries are not fetched from public CDNs at runtime.
No source maps referencedPassed
None of the 5 scripts and the homepage HTML reference a source map.
No contract addresses referencedPassed
No EVM addresses were found in 5 scripts and the homepage HTML.

Wallet stack detected

No wallet or chain libraries recognised in the inspected code.

Inspected 5 scripts (44 KB) that the homepage loads for every visitor, plus the HTML. Lazy-loaded code beyond these may not be covered.

Contracts referenced in page code

No EVM addresses found in the inspected code.

Verification status from Sourcify. Green chains link to the block explorer.

Agent trace

26 steps · every action the agent took
Show the full trace ↓
  1. 0.0s▸Public assessment of orbio.bot · budget 60 requests
  2. 0.0s✓Resolved orbio.bot → 216.150.16.129 (+1 more), all public
  3. 0.1s▸Probing HTTPS, HTTP and legacy TLS
  4. 0.6s✓GET https://orbio.bot/ → 200 in 448ms
  5. 0.6s·GET http://orbio.bot/ → 308 https://orbio.bot/
  6. 0.6s✓TLS 1.0 handshake refused
  7. 0.6s✓TLS 1.1 handshake refused
  8. 0.6s·Security headers present: strict-transport-security, content-security-policy, x-frame-options, x-content-type-options, referrer-policy, permissions-policy
  9. 0.6s·0 cookies set on the homepage
  10. 0.6s▸Reading DNS, security.txt and the page's JavaScript
  11. 0.6s·Homepage references 1 script; reading landing.js
  12. 0.7s·DNS: DNSSEC off · CAA set · SPF none · DMARC none
  13. 0.8s·security.txt not found (HTTP 404)
  14. 0.8s·Following imports: 4 more chunks found; reading shell.js, orbio.js, bot.js, common.js
  15. 1.0s·landing.js (3 KB)
  16. 1.0s·shell.js (9 KB)
  17. 1.0s·orbio.js (6 KB)
  18. 1.0s·bot.js (20 KB)
  19. 1.0s·common.js (6 KB)
  20. 1.0s·No wallet or chain libraries recognised
  21. 1.2s✓Graded B (82/100) · 0 high, 1 medium, 2 low · 17 requests to the target
  22. 6.3s✓Rendered the homepage in a browser and saved a screenshot: "orbio.bot | Autopilot for orbio CREDIT"
  23. 6.3s·Domain registered 2026-10-20 (0 days ago) via Spaceship, Inc.
  24. 6.4s◆Writing summary with meta/llama-3.3-70b-instruct-fp8-fast and checking the site's claims
  25. 15.8s◆Checked 1 claim: 0 match, 0 don't match, 1 can't be verified
  26. 15.9s◆Summary ready · 4 prioritized fixes

Scope & limitations

Assessment type
Public, non-invasive
Target
orbio.bot
Final URL
https://orbio.bot/
Resolved addresses
216.150.16.129, 216.150.16.1
Scanned
Oct 21, 2026, 03:28 UTC
Duration
1.2s
Requests made
17 (budget 60)
Report ID
2jkk85sh28
  • This is a public, non-invasive assessment of externally visible configuration. It does not test application logic, authentication, APIs, smart contracts or wallet flows.
  • Only the homepage, up to 8 of the scripts it loads, and a few well-known paths were requested. Other pages, lazy-loaded code and subdomains may be configured differently.
  • A good grade means the checked controls are in place. It does not prove the application is secure.

Own orbio.bot? Verified owners will be able to request authorized deeper testing and receive findings privately. To dispute a result or opt out of public assessments, see opt-out & abuse reporting.