cookagents.fun

Public security posture · Completed

Share on X
$COOKCook AgentsRobinhood ChainPonsMC $11.6k at scan
0x0CEedb4145dEd3A95769dAD1FE8955B7ed586E69
✓ Confirmed: the project's website lists this contract addressgmgnDexScreener

This report grades the token's website configuration, not the token contract, liquidity or team.

Security grade

C
Configuration score74/100

Grades reflect only the externally visible controls listed below. A good grade does not prove the application is secure. How grades work

0
High
1
Medium
4
Low
2
Informational
16 of 23 assessed checks passed · 1 not assessed
Agent summaryExplains the evidence below. It doesn't create findings or change the grade.

Agent summary

Without a DMARC policy, receiving mail servers are not instructed on how to handle emails that spoof the cookagents.fun domain, which could lead to undetected phishing attacks. The site is doing well in terms of HTTPS and HSTS configuration, as well as refraining from disclosing exact versions and using secure cookie settings. The remaining fixes focus on enhancing email security and DNS configuration.

  1. 01Publish a DMARC policy to instruct receiving mail servers on handling spoofed emailsDMARC policymedium
  2. 02Remove 'unsafe-inline' from the Content Security Policy to reduce the risk of inline script injectionContent Security Policylow
  3. 03Enable DNSSEC to cryptographically sign DNS answers for the domainDNSSEClow
  4. 04Publish CAA records to specify authorized certificate authoritiesCAA recordslow
  5. 05Publish an SPF record to declare which servers are authorized to send mail as the domainSPF recordlow

meta/llama-3.3-70b-instruct-fp8-fast · Workers AI

Website & claims

What the site says, checked against data
Screenshot of cookagents.fun at scan time
cookagents.fun · captured at scan time
Page title
Cook Agents · Launch a coin. Seven cooks start working for it.
Domain registered
Oct 14, 2026 · 6 days before this scan
Registrar
HOSTINGER operations, UAB
Contract address on site
0x0CEedb4145dEd3A95769dAD1FE8955B7ed586E69
Links on site
X: x.com/cookagentsGitHub: github.com/cookagents
✓ Matches

Contract address shown on the website

The site shows 0x0CEedb4145dEd3A95769dAD1FE8955B7ed586E69.

✓ Matches

X account linked on the website

The site and the token both point to x.com/cookagents.

? Can't verify

“99% tax on buys”

Trading tax isn't checked yet.

? Can't verify

“1% of each trade”

Trading tax isn't checked yet.

? Can't verify

“the launchpad's owner can point a coin's future creator fees somewhere else after a 3-day notice”

Still on the Pons bonding curve: there is no pool to lock yet.

? Can't verify

“Contracts deployed on Robinhood Chain, their source published and verified”

No link to an audit firm's report was found on the page.

? Can't verify

“You can close the tab with seven days' notice and take your coin's creator fee back”

The contract has no owner() function to check.

? Can't verify

“Seven stations, one coin at a time”

Team identity claims can't be verified from public data.

✓ Matches

“Read from the launchpad's contract on 13 October 2026”

The domain was registered in 2026.

? Can't verify

“Fees are paid in ETH and credited on chain, so any tab can be read on the chain's explorer”

No public data source to check this against.

Claims are quoted verbatim from the page. “Matches” and “Doesn't match” come from on-chain data, the token's metadata or public domain records. Anything we can't check against data is marked “Can't verify”, which is not the same as false.

TLS & transport

All checks passed
HTTPS works with a trusted certificatePassed
The homepage loaded over HTTPS and the certificate was accepted.
Final URL
https://cookagents.fun/
Status
200
HTTP redirects to HTTPSPassed
The unencrypted homepage immediately redirects to HTTPS.
Redirect
301 → https://cookagents.fun/
HSTS is enabledPassed
Browsers are told to use HTTPS for 730 days, including subdomains.
Strict-Transport-Security
max-age=63072000; includeSubDomains
Legacy TLS not assessedNot assessed
Our scanning network could not open a raw TLS connection to this host (proxy request failed, cannot connect to the specified address. It looks like you might be trying to connect to a HTTP-based service — consider using fetch instead).
TLS 1.0
unknown
TLS 1.1
unknown

HTTP security headers

1 finding
lowConfirmed

Content Security Policy is permissive

A policy is enforced, but script-src allows 'unsafe-inline'.

Content-Security-Policy
default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'
Recommendation · Remove 'unsafe-inline' and 'unsafe-eval' from script-src and list specific origins. Nonces or hashes with 'strict-dynamic' keep inline bootstraps working.
Why it matters ↓

CSP limits which scripts can run. For dApps it is the main browser-side defence against an injected script draining connected wallets.

How we check: Reads the Content-Security-Policy header and flags policies that still allow inline or arbitrary-origin scripts.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
Framing is restrictedPassed
Other sites can't embed this page in a frame.
X-Frame-Options
DENY
CSP frame-ancestors
'none'
MIME sniffing disabledPassed
Browsers will respect declared content types.
X-Content-Type-Options
nosniff
Referrer-Policy is setPassed
Policy: strict-origin-when-cross-origin.
Referrer-Policy
strict-origin-when-cross-origin
Permissions-Policy is setPassed
Access to powerful browser features is restricted.
Permissions-Policy
camera=(), microphone=(), geolocation=()
No exact versions disclosedPassed
Server headers don't reveal exact software versions.

Cookie configuration

All checks passed
Secure flag: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
HttpOnly: no session cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
SameSite: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.

DNS & email posture

4 findings
mediumConfirmed

No DMARC policy

Receiving mail servers aren't told what to do with mail that spoofs this domain.

Lookup
_dmarc.cookagents.fun
Recommendation · Publish _dmarc TXT v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain and move to p=reject once reports look clean.
Why it matters ↓

DMARC tells receiving mail servers to reject mail that fails authentication — the main defence against spoofed announcements from your domain.

How we check: Reads the _dmarc TXT record for the domain or its organizational domain and checks the policy.

https://dmarc.org/overview/
lowConfirmed

No SPF record

The domain doesn't declare which servers may send mail as it.

MX
(none)
Recommendation · If the domain never sends mail, publish v=spf1 -all.
Why it matters ↓

SPF lists who may send mail as the domain. Crypto projects are frequent targets of impersonation emails.

How we check: Reads the domain's TXT records for an SPF policy and checks it is not permissive.

https://datatracker.ietf.org/doc/html/rfc7208
lowConfirmed

No CAA records

Any certificate authority may issue certificates for this domain.

Recommendation · Publish CAA records naming the CAs you use, e.g. 0 issue "letsencrypt.org".
Why it matters ↓

CAA restricts which certificate authorities may issue certificates for the domain, reducing the risk of a mis-issued certificate.

How we check: Looks up CAA records for the domain and its parents.

https://datatracker.ietf.org/doc/html/rfc8659
lowConfirmed

DNSSEC not enabled

DNS answers for this domain are not cryptographically signed.

AD flag
not set
Recommendation · Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
Why it matters ↓

DNSSEC prevents forged DNS answers from sending visitors to a look-alike server.

How we check: Resolves the domain through a validating resolver and checks whether the answer is DNSSEC-authenticated.

https://www.cloudflare.com/dns/dnssec/how-dnssec-works/

Frontend & disclosure

1 finding
infoConfirmed

No security.txt

There is no published channel for reporting vulnerabilities.

https://cookagents.fun/.well-known/security.txt
HTTP 404
Recommendation · Publish /.well-known/security.txt with Contact and Expires fields (see securitytxt.org).
Why it matters ↓

Gives researchers a clear way to report vulnerabilities privately instead of disclosing them publicly.

How we check: Requests /.well-known/security.txt and checks it contains a Contact field and has not expired.

https://securitytxt.org/
No mixed contentPassed
All resources referenced in the homepage HTML use HTTPS or relative URLs.
No third-party scripts in the HTMLPassed
All script tags in the homepage HTML load from the site's own domain.

Web3 frontend

1 finding
infoPotential · needs review

5 of 5 referenced addresses without verified source on Sourcify

These addresses appear in the page code but have no verified source on Sourcify for Ethereum, Base, Arbitrum One, OP Mainnet, Polygon, BNB Chain. They may be wallets rather than contracts, live on another chain, or be verified elsewhere, such as Etherscan.

Unverified address
0x0CEedb4145dEd3A95769dAD1FE8955B7ed586E69
Unverified address
0x438bA70c03B76A88f325d8107c3Cd17CE7fb4AB6
Unverified address
0x86f3de2Ad36C4DE5f3e7c08Bea7BB17dDeF2A04E
Unverified address
0x2ab2150C836aBcb7627c826Ae70092682CD6B9E2
Unverified address
0xCa3D4b39fAD5571C096d2eBb092844645048d927
Recommendation · Verify the source of every contract users interact with on Sourcify and the relevant block explorer.
Why it matters ↓

Users should be able to read the code they're asked to interact with. Unverified addresses aren't necessarily unsafe, so this is informational only.

How we check: Extracts EVM addresses referenced in the page code (up to 6) and checks Sourcify for verified source on Ethereum, Base, Arbitrum, OP Mainnet, Polygon and BNB Chain.

https://docs.sourcify.dev/
No known-malicious releases referencedPassed
Checked 7 scripts and the homepage HTML against published malicious wallet-package releases.
No wallet code loaded from public CDNsPassed
Wallet and chain libraries are not fetched from public CDNs at runtime.
No source maps referencedPassed
None of the 7 scripts and the homepage HTML reference a source map.

Wallet stack detected

No wallet or chain libraries recognised in the inspected code.

Inspected 7 scripts (595 KB) that the homepage loads for every visitor, plus the HTML. Lazy-loaded code beyond these may not be covered.

Contracts referenced in page code

  • 0x0CEe…6E69no Sourcify match
  • 0x438b…4AB6no Sourcify match
  • 0x86f3…A04Eno Sourcify match
  • 0x2ab2…B9E2no Sourcify match
  • 0xCa3D…d927no Sourcify match

Verification status from Sourcify. Green chains link to the block explorer.

Agent trace

34 steps · every action the agent took
Show the full trace ↓
  1. 0.0s▸Public assessment of cookagents.fun · budget 60 requests
  2. 0.0s✓Resolved cookagents.fun → 104.21.78.86 (+3 more), all public
  3. 0.1s▸Probing HTTPS, HTTP and legacy TLS
  4. 1.5s✓GET https://cookagents.fun/ → 200 in 1413ms
  5. 1.5s·GET http://cookagents.fun/ → 301 https://cookagents.fun/
  6. 1.5s·TLS 1.0 probe not possible from this network
  7. 1.5s·TLS 1.1 probe not possible from this network
  8. 1.5s·Security headers present: strict-transport-security, content-security-policy, x-frame-options, x-content-type-options, referrer-policy, permissions-policy
  9. 1.5s·0 cookies set on the homepage
  10. 1.6s▸Reading DNS, security.txt and the page's JavaScript
  11. 1.6s·Homepage references 7 scripts; reading 1c5kx2r_esyfe.js, 23yyp3a7dax9q.js, 07m8lzdmul63n.js, turbopack-3-ry682tkyiqk.js
  12. 1.6s·Following imports: 3 more chunks found; reading 0imn0vx9m54cs.js, 0yuo-y1hjfcu_.js, 0cz1d0mv5g_q7.js
  13. 1.6s·DNS: DNSSEC off · CAA none · SPF none · DMARC none
  14. 1.6s·1c5kx2r_esyfe.js (17 KB)
  15. 1.6s·23yyp3a7dax9q.js (181 KB)
  16. 1.6s·07m8lzdmul63n.js (224 KB)
  17. 1.6s·turbopack-3-ry682tkyiqk.js (10 KB)
  18. 1.6s·0imn0vx9m54cs.js (14 KB)
  19. 1.6s·0yuo-y1hjfcu_.js (39 KB)
  20. 1.6s·0cz1d0mv5g_q7.js (110 KB)
  21. 1.6s·No wallet or chain libraries recognised
  22. 1.6s▸Found 5 contract addresses in page code; checking Sourcify on 6 chains
  23. 1.8s·security.txt not found (HTTP 404)
  24. 2.6s·0x0CEe…6E69: no Sourcify match
  25. 2.6s·0x438b…4AB6: no Sourcify match
  26. 2.6s·0x86f3…A04E: no Sourcify match
  27. 2.6s·0x2ab2…B9E2: no Sourcify match
  28. 2.6s·0xCa3D…d927: no Sourcify match
  29. 2.7s✓Graded C (74/100) · 0 high, 1 medium, 4 low · 19 requests to the target
  30. 7.4s✓Rendered the homepage in a browser and saved a screenshot: "Cook Agents · Launch a coin. Seven cooks start working for i"
  31. 7.4s·Domain registered 2026-10-14 (6 days ago) via HOSTINGER operations, UAB
  32. 7.5s◆Writing summary with meta/llama-3.3-70b-instruct-fp8-fast and checking the site's claims
  33. 16.1s◆Checked 10 claims: 3 match, 0 don't match, 7 can't be verified
  34. 16.2s◆Summary ready · 5 prioritized fixes

Scope & limitations

Assessment type
Public, non-invasive
Target
cookagents.fun
Final URL
https://cookagents.fun/
Resolved addresses
104.21.78.86, 172.67.219.15, 2606:4700:3033::6815:4e56, 2606:4700:3036::ac43:db0f
Scanned
Oct 21, 2026, 01:55 UTC
Duration
2.7s
Requests made
19 (budget 60)
Report ID
qfpy8bf2r2
  • This is a public, non-invasive assessment of externally visible configuration. It does not test application logic, authentication, APIs, smart contracts or wallet flows.
  • Only the homepage, up to 8 of the scripts it loads, and a few well-known paths were requested. Other pages, lazy-loaded code and subdomains may be configured differently.
  • A good grade means the checked controls are in place. It does not prove the application is secure.
  • 1 check could not be completed and was excluded from the score: Legacy TLS.

Own cookagents.fun? Verified owners will be able to request authorized deeper testing and receive findings privately. To dispute a result or opt out of public assessments, see opt-out & abuse reporting.