Check DNS, Urls + Redirects, Certificates and Content of your Website

...

skip EDNS-Check

skip Content-Check

check links

old / weak connection

Checked:
13.06.2026 08:37:51

Older results

T - 12.05.2026 18:25:04

O - 07.05.2026 13:57:37

O - 29.04.2026 15:53:05

O - 24.12.2025 21:33:48

O - 02.12.2025 11:44:08

O - 04.11.2025 19:44:41

O - 16.10.2025 11:28:23

O - 28.09.2025 11:34:09

O - 03.09.2025 06:28:30

O - 28.08.2025 16:17:43

1. IP-Addresses

Host	Type	IP-Address	is auth.	∑ Queries	∑ Timeout
spotify.com	A	35.186.224.24 Kansas City/Missouri/United States (US) - Google LLC Hostname: 24.224.186.35.bc.googleusercontent.com	yes	1	0
	AAAA	2600:1901:1:7c5:: Montreal/Quebec/Canada (CA) - Google LLC	yes
www.spotify.com	CNAME	atc.spotify.map.fastly.net	yes	1	0
	A	151.101.7.42 Berlin/State of Berlin/Germany (DE) - Fastly, Inc. No Hostname found	yes
	AAAA	2a04:4e42:1::810 Berlin/State of Berlin/Germany (DE) - Fastly, Inc.	yes
*.spotify.com	A	Name Error	yes
	AAAA	Name Error	yes
	CNAME	Name Error	yes

2. DNSSEC

Zone (*)	DNSSEC - Informations

Zone: (root)
(root)	1 DS RR published


	DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest 4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=


	• Status: Valid because published


	3 DNSKEY RR found


	Public Key with Algorithm 8, KeyTag 20326, Flags 257 (SEP = Secure Entry Point)


	Public Key with Algorithm 8, KeyTag 38696, Flags 257 (SEP = Secure Entry Point)


	Public Key with Algorithm 8, KeyTag 54393, Flags 256


	1 RRSIG RR to validate DNSKEY RR found


	RRSIG-Owner (root), Algorithm: 8, 0 Labels, original TTL: 172800 sec, Signature-expiration: 01.07.2026, 00:00:00 +, Signature-Inception: 10.06.2026, 00:00:00 +, KeyTag 20326, Signer-Name: (root)


	• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 20326 used to validate the DNSKEY RRSet


	• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest "4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zone

Zone: com
com	1 DS RR in the parent zone found


	DS with Algorithm 13, KeyTag 19718, DigestType 2 and Digest isuwzSj0ElCoCkkTiUJNNBUi2Uaw2gwCkfLT13HXgFo=


	1 RRSIG RR to validate DS RR found


	RRSIG-Owner com., Algorithm: 8, 1 Labels, original TTL: 86400 sec, Signature-expiration: 26.06.2026, 05:00:00 +, Signature-Inception: 13.06.2026, 04:00:00 +, KeyTag 54393, Signer-Name: (root)


	• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 54393 used to validate the DS RRSet in the parent zone


	2 DNSKEY RR found


	Public Key with Algorithm 13, KeyTag 19718, Flags 257 (SEP = Secure Entry Point)


	Public Key with Algorithm 13, KeyTag 27677, Flags 256


	1 RRSIG RR to validate DNSKEY RR found


	RRSIG-Owner com., Algorithm: 13, 1 Labels, original TTL: 86400 sec, Signature-expiration: 21.06.2026, 14:02:35 +, Signature-Inception: 06.06.2026, 13:57:35 +, KeyTag 19718, Signer-Name: com


	• Status: Good - Algorithmus 13 and DNSKEY with KeyTag 19718 used to validate the DNSKEY RRSet


	• Status: Valid Chain of trust. Parent-DS with Algorithm 13, KeyTag 19718, DigestType 2 and Digest "isuwzSj0ElCoCkkTiUJNNBUi2Uaw2gwCkfLT13HXgFo=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zone

Zone: spotify.com
spotify.com	0 DS RR in the parent zone found


	DS-Query in the parent zone has a valid NSEC3 RR as result with the hashed query name "vb2hv9qb69qn4b3mcfau5qonvv9rsjko" between the hashed NSEC3-owner "vb2htrvh2999nj7aoqjund0cn7u5dcu8" and the hashed NextOwner "vb2i3npjd0iebep21vrb9me74q5gsrja". So the parent zone confirmes the not-existence of a DS RR. Bitmap: NS, DS, RRSIG Validated: RRSIG-Owner vb2htrvh2999nj7aoqjund0cn7u5dcu8.com., Algorithm: 13, 2 Labels, original TTL: 900 sec, Signature-expiration: 17.06.2026, 01:53:58 +, Signature-Inception: 10.06.2026, 00:43:58 +, KeyTag 27677, Signer-Name: com


	DS-Query in the parent zone sends valid NSEC3 RR with the Hash "ck0pojmg874ljref7efn8430qvit8bsm" as Owner. That's the Hash of "com" with the NextHashedOwnerName "ck0q3udg8cekkae7rukpgct1dvssh8ll". So that domain name is the Closest Encloser of "spotify.com". Opt-Out: True. Bitmap: NS, SOA, RRSIG, DNSKEY, NSEC3PARAM Validated: RRSIG-Owner ck0pojmg874ljref7efn8430qvit8bsm.com., Algorithm: 13, 2 Labels, original TTL: 900 sec, Signature-expiration: 19.06.2026, 00:26:30 +, Signature-Inception: 11.06.2026, 23:16:30 +, KeyTag 27677, Signer-Name: com


	0 DNSKEY RR found




Zone: www.spotify.com
www.spotify.com	0 DS RR in the parent zone found

Zone: (root)
(root)	1 DS RR published


	DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest 4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=


	• Status: Valid because published


	3 DNSKEY RR found


	Public Key with Algorithm 8, KeyTag 20326, Flags 257 (SEP = Secure Entry Point)


	Public Key with Algorithm 8, KeyTag 38696, Flags 257 (SEP = Secure Entry Point)


	Public Key with Algorithm 8, KeyTag 54393, Flags 256


	1 RRSIG RR to validate DNSKEY RR found


	RRSIG-Owner (root), Algorithm: 8, 0 Labels, original TTL: 172800 sec, Signature-expiration: 01.07.2026, 00:00:00 +, Signature-Inception: 10.06.2026, 00:00:00 +, KeyTag 20326, Signer-Name: (root)


	• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 20326 used to validate the DNSKEY RRSet


	• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest "4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zone

Zone: net
net	1 DS RR in the parent zone found


	DS with Algorithm 13, KeyTag 37331, DigestType 2 and Digest LwvsLW95370dCP0ho6+S0OOaS57x4/QRH/8oJJDaRTs=


	1 RRSIG RR to validate DS RR found


	RRSIG-Owner net., Algorithm: 8, 1 Labels, original TTL: 86400 sec, Signature-expiration: 26.06.2026, 05:00:00 +, Signature-Inception: 13.06.2026, 04:00:00 +, KeyTag 54393, Signer-Name: (root)


	• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 54393 used to validate the DS RRSet in the parent zone


	2 DNSKEY RR found


	Public Key with Algorithm 13, KeyTag 1560, Flags 256


	Public Key with Algorithm 13, KeyTag 37331, Flags 257 (SEP = Secure Entry Point)


	1 RRSIG RR to validate DNSKEY RR found


	RRSIG-Owner net., Algorithm: 13, 1 Labels, original TTL: 86400 sec, Signature-expiration: 21.06.2026, 14:10:35 +, Signature-Inception: 06.06.2026, 14:05:35 +, KeyTag 37331, Signer-Name: net


	• Status: Good - Algorithmus 13 and DNSKEY with KeyTag 37331 used to validate the DNSKEY RRSet


	• Status: Valid Chain of trust. Parent-DS with Algorithm 13, KeyTag 37331, DigestType 2 and Digest "LwvsLW95370dCP0ho6+S0OOaS57x4/QRH/8oJJDaRTs=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zone

Zone: fastly.net
fastly.net	0 DS RR in the parent zone found


	DS-Query in the parent zone has a valid NSEC3 RR as result with the hashed query name "ap27gbv43gq0pd0p7pujmpgv3q2t7q3o" between the hashed NSEC3-owner "ap22ie95pjt6ocm87u9k7g0ee9btj554" and the hashed NextOwner "ap2ap02rgisns1itfs5ngc3p41d41kpd". So the parent zone confirmes the not-existence of a DS RR. Bitmap: NS, DS, RRSIG Validated: RRSIG-Owner ap22ie95pjt6ocm87u9k7g0ee9btj554.net., Algorithm: 13, 2 Labels, original TTL: 900 sec, Signature-expiration: 20.06.2026, 03:31:12 +, Signature-Inception: 13.06.2026, 02:21:12 +, KeyTag 1560, Signer-Name: net


	DS-Query in the parent zone sends valid NSEC3 RR with the Hash "a1rt98bs5qgc9nfi51s9hci47uljg6jh" as Owner. That's the Hash of "net" with the NextHashedOwnerName "a1rtlnpgulogn7b9a62shje1u3ttp8dr". So that domain name is the Closest Encloser of "fastly.net". Opt-Out: True. Bitmap: NS, SOA, RRSIG, DNSKEY, NSEC3PARAM Validated: RRSIG-Owner a1rt98bs5qgc9nfi51s9hci47uljg6jh.net., Algorithm: 13, 2 Labels, original TTL: 900 sec, Signature-expiration: 19.06.2026, 03:35:36 +, Signature-Inception: 12.06.2026, 02:25:36 +, KeyTag 1560, Signer-Name: net


	0 DNSKEY RR found




Zone: map.fastly.net
map.fastly.net	0 DS RR in the parent zone found


	0 DNSKEY RR found




Zone: spotify.map.fastly.net
spotify.map.fastly.net	0 DS RR in the parent zone found


	0 DNSKEY RR found




Zone: atc.spotify.map.fastly.net
atc.spotify.map.fastly.net	0 DS RR in the parent zone found


	0 DNSKEY RR found

3. Name Servers

Domain	Nameserver	NS-IP
spotify.com	• dns1.p07.nsone.net / ns1dns-mrs01-11129-5304-0	198.51.44.7 New York/United States (US) - IBM	•
	•	2620:4d:4000:6259:7:7:0:1 Toronto/Ontario/Canada (CA) - IBM	•
	• ns-cloud-a1.googledomains.com / hex:AC 90 00 AC EB 6B 2E 02 12 9B F1 FD 4B 1E 2E 43	216.239.32.106 Mountain View/California/United States (US) - Google LLC	•
	•	2001:4860:4802:32::6a Montreal/Quebec/Canada (CA) - Google LLC	•
	• ns-cloud-a2.googledomains.com / hex:63 17 BE 6E DF EA D1 B7 ED B5 F5 EA 94 22 6E 00	216.239.34.106 Mountain View/California/United States (US) - Google LLC	•
	•	2001:4860:4802:34::6a Montreal/Quebec/Canada (CA) - Google LLC	•
	• ns-cloud-a3.googledomains.com / hex:D0 EA BC 8F 58 B4 BC 92 A6 12 5A D4 BB 23 B2 F8	216.239.36.106 Mountain View/California/United States (US) - Google LLC	•
	•	2001:4860:4802:36::6a Montreal/Quebec/Canada (CA) - Google LLC	•
	• ns-cloud-a4.googledomains.com / hex:7B 03 13 C3 B8 D9 C7 07 BE BE 75 9B AA 38 7C 54	216.239.38.106 Mountain View/California/United States (US) - Google LLC	•
	•	2001:4860:4802:38::6a Montreal/Quebec/Canada (CA) - Google LLC	•
com	• a.gtld-servers.net / nnn1-par6		•
	• b.gtld-servers.net / nnn1-elwaw4		•
	• c.gtld-servers.net / nnn1-defra-5		•
	• d.gtld-servers.net / nnn1-defra-5		•
	• e.gtld-servers.net / nnn1-par6		•
	• f.gtld-servers.net / nnn1-defra-4		•
	• g.gtld-servers.net / nnn1-defra-4		•
	• h.gtld-servers.net / nnn1-defra-4		•
	• i.gtld-servers.net / nnn1-defra-4		•
	• j.gtld-servers.net / nnn1-frmrs-2		•
	• k.gtld-servers.net / nnn1-frmrs-2		•
	• l.gtld-servers.net / nnn1-frmrs-2		•
	• m.gtld-servers.net / nnn1-ein1		•

atc.spotify.map.fastly.net	• ns1.fastly.net / cache-ber1080038	23.235.32.32 Montreal/Quebec/Canada (CA) - Fastly, Inc.	•
spotify.map.fastly.net	• ns1.fastly.net / cache-ber1080031	23.235.32.32 Montreal/Quebec/Canada (CA) - Fastly, Inc.	•
map.fastly.net	• ns1.fastly.net / cache-ber1080036	23.235.32.32 Montreal/Quebec/Canada (CA) - Fastly, Inc.	•
fastly.net	• ns1.fastly.net / cache-ber1080026	23.235.32.32 Montreal/Quebec/Canada (CA) - Fastly, Inc.	•
	• ns2.fastly.net / cache-ber1080029	104.156.80.32 Montreal/Quebec/Canada (CA) - Fastly, Inc.	•
	• ns3.fastly.net / cache-ber1080042	23.235.36.32 Montreal/Quebec/Canada (CA) - Fastly, Inc.	•
	• ns4.fastly.net / cache-ber1080058	104.156.84.32 Montreal/Quebec/Canada (CA) - Fastly, Inc.	•
net	• a.gtld-servers.net / nnn1-par6		•
	• b.gtld-servers.net / nnn1-elwaw4		•
	• c.gtld-servers.net / nnn1-defra-5		•
	• d.gtld-servers.net / nnn1-defra-5		•
	• e.gtld-servers.net / nnn1-par6		•
	• f.gtld-servers.net / nnn1-defra-4		•
	• g.gtld-servers.net / nnn1-defra-4		•
	• h.gtld-servers.net / nnn1-defra-4		•
	• i.gtld-servers.net / nnn1-defra-4		•
	• j.gtld-servers.net / nnn1-frmrs-2		•
	• k.gtld-servers.net / nnn1-frmrs-2		•
	• l.gtld-servers.net / nnn1-ein3		•
	• m.gtld-servers.net / nnn1-frmrs-2		•

4. SOA-Entries

Domain:	com
Zone-Name:	com
Primary:	a.gtld-servers.net
Mail:	nstld.verisign-grs.com
Serial:	1781332653
Refresh:	1800
Retry:	900
Expire:	604800
TTL:	900
num Entries:	12

Domain:	com
Zone-Name:	com
Primary:	a.gtld-servers.net
Mail:	nstld.verisign-grs.com
Serial:	1781332668
Refresh:	1800
Retry:	900
Expire:	604800
TTL:	900
num Entries:	1

Domain:	spotify.com
Zone-Name:	spotify.com
Primary:	dns1.p07.nsone.net
Mail:	hostmaster.nsone.net
Serial:	1655911284
Refresh:	43200
Retry:	7200
Expire:	1209600
TTL:	3600
num Entries:	2

Domain:	spotify.com
Zone-Name:	spotify.com
Primary:	ns-cloud-a1.googledomains.com
Mail:	cloud-dns-hostmaster.google.com
Serial:	1
Refresh:	21600
Retry:	3600
Expire:	259200
TTL:	300
num Entries:	8


Domain:	net
Zone-Name:	net
Primary:	a.gtld-servers.net
Mail:	nstld.verisign-grs.com
Serial:	1781332668
Refresh:	1800
Retry:	900
Expire:	604800
TTL:	900
num Entries:	2

Domain:	net
Zone-Name:	net
Primary:	a.gtld-servers.net
Mail:	nstld.verisign-grs.com
Serial:	1781332683
Refresh:	1800
Retry:	900
Expire:	604800
TTL:	900
num Entries:	11

Domain:	fastly.net
Zone-Name:	fastly.net
Primary:	ns1.fastly.net
Mail:	hostmaster.fastly.com
Serial:	2017052201
Refresh:	3600
Retry:	600
Expire:	604800
TTL:	30
num Entries:	4

Domain:	map.fastly.net
Zone-Name:	fastly.net
Primary:	ns1.fastly.net
Mail:	hostmaster.fastly.com
Serial:	2017052201
Refresh:	3600
Retry:	600
Expire:	604800
TTL:	30
num Entries:	1

Domain:	spotify.map.fastly.net
Zone-Name:	fastly.net
Primary:	ns1.fastly.net
Mail:	hostmaster.fastly.com
Serial:	2017052201
Refresh:	3600
Retry:	600
Expire:	604800
TTL:	30
num Entries:	1

Domain:	atc.spotify.map.fastly.net
Zone-Name:	fastly.net
Primary:	ns1.fastly.net
Mail:	hostmaster.fastly.com
Serial:	2017052201
Refresh:	3600
Retry:	600
Expire:	604800
TTL:	30
num Entries:	1

5. Screenshots

Startaddress: https://open.spotify.com/, address used: https://open.spotify.com/, Screenshot created 2026-06-13 08:43:31 +00:0

Mobil (412px x 732px)

788 milliseconds

Screenshot mobile - https://open.spotify.com/

Mobil + Landscape (732px x 412px)

795 milliseconds

Screenshot mobile landscape - https://open.spotify.com/

Screen (1280px x 1680px)

800 milliseconds

Screenshot Desktop - https://open.spotify.com/

Mobile- and other Chrome-Checks

	width	height
visual Viewport	412	732
content Size	800	732

Fatal: Horizontal scrollbar detected. Content-size width is greater then visual Viewport width.

6. Url-Checks

show header:

Domainname	Http-Status	redirect	Sec.	G
• http://spotify.com/ 35.186.224.24	301	https://www.spotify.com/	0.050	E
Location: https://www.spotify.com/
Date: Sat, 13 Jun 2026 06:39:43 GMT
Server: envoy
Via: 1.1 google
Content-Length: 0

• http://spotify.com/ 2600:1901:1:7c5::	301	https://www.spotify.com/	0.050	E
Location: https://www.spotify.com/
Date: Sat, 13 Jun 2026 06:39:43 GMT
Server: envoy
Via: 1.1 google
Content-Length: 0

• http://www.spotify.com/ 151.101.7.42	301	https://www.spotify.com/	0.010	A
Connection: close
Server: Varnish
Retry-After: 0
Location: https://www.spotify.com/
Accept-Ranges: bytes
Date: Sat, 13 Jun 2026 06:39:43 GMT
Via: 1.1 varnish
X-Served-By: cache-ber1080033-BER
X-Cache: HIT
X-Cache-Hits: 0
X-Timer: S1781332784.726603,VS0,VE0
Content-Length: 0

• http://www.spotify.com/ 2a04:4e42:1::810	301	https://www.spotify.com/	0.013	A
Connection: close
Server: Varnish
Retry-After: 0
Location: https://www.spotify.com/
Accept-Ranges: bytes
Date: Sat, 13 Jun 2026 06:39:43 GMT
Via: 1.1 varnish
X-Served-By: cache-ber1080024-BER
X-Cache: HIT
X-Cache-Hits: 0
X-Timer: S1781332784.752671,VS0,VE0
Content-Length: 0

• https://spotify.com/ 35.186.224.24	301	https://www.spotify.com/	2.156	A
Location: https://www.spotify.com/
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3=":443"; ma=2592000
Vary: Accept-Encoding
Date: Sat, 13 Jun 2026 06:39:43 GMT
Server: envoy
Via: HTTP/2 edgeproxy,1.1 google
Content-Length: 0

• https://spotify.com/ 2600:1901:1:7c5::	301	https://www.spotify.com/	2.080	A
Location: https://www.spotify.com/
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Vary: Accept-Encoding
Date: Sat, 13 Jun 2026 06:39:46 GMT
Server: envoy
Via: HTTP/2 edgeproxy,1.1 google
Content-Length: 0

• https://www.spotify.com/ 151.101.7.42	301	https://open.spotify.com/	1.997	A
Connection: keep-alive
Server: envoy
Location: https://open.spotify.com/
X-Content-Type-Options: nosniff
Via: HTTP/2 edgeproxy,1.1 google,1.1 varnish
Strict-Transport-Security: max-age=31536000
Accept-Ranges: bytes
Date: Sat, 13 Jun 2026 06:39:50 GMT
X-Served-By: cache-ber1080022-BER, cache-ber1080022-BER
X-Cache: MISS, MISS
X-Cache-Hits: 0, 0
X-Timer: S1781332790.976787,VS0,VE82
Vary: Accept-Encoding
Alt-Svc: h3=":443",h3-29=":443",h3-27=":443"
Content-Length: 0

• https://www.spotify.com/ 2a04:4e42:1::810	301	https://open.spotify.com/	1.973	A
Connection: keep-alive
Location: https://open.spotify.com/
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: envoy
Via: HTTP/2 edgeproxy,1.1 google,1.1 varnish
Accept-Ranges: bytes
Date: Sat, 13 Jun 2026 06:39:53 GMT
X-Served-By: cache-ber1080033-BER, cache-ber1080033-BER
X-Cache: MISS, MISS
X-Cache-Hits: 0, 0
X-Timer: S1781332793.366834,VS0,VE73
Vary: Accept-Encoding
Alt-Svc: h3=":443",h3-29=":443",h3-27=":443"
Content-Length: 0

• https://open.spotify.com/ gzip used - 2208 / 5928 - 62.75 % Inline-JavaScript (∑/total): 0/0 Inline-CSS (∑/total): 1/46	200	Html is minified: 101.70 % Other inline scripts (∑/total): 4/1412	2.167	B
Connection: keep-alive
x-envoy-upstream-service-time: 19
Content-Security-Policy: script-src 'self' 'unsafe-eval' blob: open.spotifycdn.com open-review.spotifycdn.com quicksilver.scdn.co www.google-analytics.com www.googletagmanager.com static.ads-twitter.com analytics.twitter.com s.pinimg.com sc-static.net https://www.google.com/recaptcha/ cdn.ravenjs.com connect.facebook.net www.gstatic.com sb.scorecardresearch.com pixel-static.spotify.com cdn.cookielaw.org geolocation.onetrust.com www.fastly-insights.com static.hotjar.com script.hotjar.com https://www.googleadservices.com/pagead/conversion_async.js https://www.googleadservices.com/pagead/conversion/ https://analytics.tiktok.com/i18n/pixel/sdk.js https://analytics.tiktok.com/i18n/pixel/identify.js https://analytics.tiktok.com/i18n/pixel/config.js https://www.redditstatic.com/ads/pixel.js https://t.contentsquare.net/uxa/22f14577e19f3.js https://get.microsoft.com/badge/ms-store-badge.bundled.js https://cdn.us.heap-api.com https://heapanalytics.com 'sha256-WfsTi7oVogdF9vq5d14s2birjvCglqWF842fyHhzoNw=' 'sha256-KRzjHxCdT8icNaDOqPBdY0AlKiIh5F8r4bnbe1PQwss=' 'sha256-Z5wh7XXSBR1+mTxLSPFhywCZJt77+uP1GikAgPIsu2s=' 'sha256-o2wzIImHJ4+WWE5DCTR+myWU0UNml0+wwpDXRo++vII='; frame-ancestors 'self' https://adgen-dev.spotify.com/account//ad//details https://adgen-dev.spotify.com/preview/* https://local.spotify.net/account//ad//details https://local.spotify.net/preview/* https://app.smartly.io/*;
Set-Cookie: sp_t=3009a3e8-28c6-4c08-b8aa-7551164ffc9d; path=/; expires=Sun, 13 Jun 2027 06:40:09 GMT; domain=.spotify.com; samesite=none; secure,sp_landing=https%3A%2F%2Fopen.spotify.com%2F%3Fsp_cid%3D3009a3e8-28c6-4c08-b8aa-7551164ffc9d%26device%3Ddesktop; path=/; expires=Sun, 14 Jun 2026 06:40:09 GMT; domain=.spotify.com; samesite=none; secure; httponly,sp_t=3009a3e8-28c6-4c08-b8aa-7551164ffc9d; Max-Age=31536000; Path=/; Domain=.spotify.com; Secure,sp_new=1; Max-Age=86400; Path=/; Domain=.spotify.com; Secure,sp_landing=https%3A%2F%2Fopen.spotify.com%2F; Max-Age=86400; Path=/; Domain=.spotify.com; HttpOnly; Secure
Server: envoy
X-Content-Type-Options: nosniff
x-spotify-open-index: true
Via: HTTP/1.1 fringe,HTTP/2 edgeproxy,1.1 google,1.1 varnish
Strict-Transport-Security: max-age=31536000
Accept-Ranges: bytes
Date: Sat, 13 Jun 2026 06:40:09 GMT
X-Served-By: cache-ber1080052-BER, cache-ber1080050-BER
X-Cache: MISS, MISS
X-Cache-Hits: 0, 0
X-Timer: S1781332809.470043,VS0,VE126
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Content-Length: 2208

• http://spotify.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 35.186.224.24	301	https://www.spotify.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de	0.036	E
Visible Content:
Location: https://www.spotify.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
Date: Sat, 13 Jun 2026 06:39:56 GMT
Server: envoy
Via: 1.1 google
Content-Length: 0

• http://spotify.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 2600:1901:1:7c5::	301	https://www.spotify.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de	0.030	E
Visible Content:
Location: https://www.spotify.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
Date: Sat, 13 Jun 2026 06:39:56 GMT
Server: envoy
Via: 1.1 google
Content-Length: 0

• http://www.spotify.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 151.101.7.42	301	https://www.spotify.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de	0.010	A
Visible Content:
Connection: close
Server: Varnish
Retry-After: 0
Location: https://www.spotify.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
Accept-Ranges: bytes
Date: Sat, 13 Jun 2026 06:39:56 GMT
Via: 1.1 varnish
X-Served-By: cache-ber1080055-BER
X-Cache: HIT
X-Cache-Hits: 0
X-Timer: S1781332797.540051,VS0,VE0
Content-Length: 0

• http://www.spotify.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 2a04:4e42:1::810	301	https://www.spotify.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de	0.013	A
Visible Content:
Connection: close
Server: Varnish
Retry-After: 0
Location: https://www.spotify.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
Accept-Ranges: bytes
Date: Sat, 13 Jun 2026 06:39:56 GMT
Via: 1.1 varnish
X-Served-By: cache-ber1080043-BER
X-Cache: HIT
X-Cache-Hits: 0
X-Timer: S1781332797.585960,VS0,VE0
Content-Length: 0

• https://www.spotify.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de gzip used - 1251 / 3942 - 68.26 % Inline-JavaScript (∑/total): 0/0 Inline-CSS (∑/total): 1/221	404	Html is minified: 106.60 % Other inline scripts (∑/total): 1/271	1.987	A
Not Found
Visible Content:
Connection: keep-alive
x-envoy-upstream-service-time: 10
Strict-Transport-Security: max-age=31536000
X-Powered-By: Next.js
X-Content-Type-Options: nosniff
Cache-Control: no-store, must-revalidate, no-cache, max-age=0, private
ETag: "16yf5oglrcg31i"
Server: envoy
Via: HTTP/1.1 fringe,HTTP/2 edgeproxy,1.1 google,1.1 varnish
Accept-Ranges: bytes
Date: Sat, 13 Jun 2026 06:40:14 GMT
X-Served-By: cache-ber1080029-BER, cache-ber1080029-BER
X-Cache: MISS, MISS
X-Cache-Hits: 0, 0
X-Timer: S1781332814.963512,VS0,VE74
Vary: Accept-Encoding
Alt-Svc: h3=":443",h3-29=":443",h3-27=":443"
Transfer-Encoding: chunked
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Content-Length: 1251

• https://151.101.7.42/ 151.101.7.42	421	Html is minified: 102.11 %	1.830	N
Misdirected Request
Certificate error: RemoteCertificateNameMismatch
Connection: keep-alive
X-Served-By: cache-ber1080025
Content-Length: 291
Content-Type: text/plain; charset=utf-8

• https://35.186.224.24/ 35.186.224.24	404		2.140	N
Not Found
Certificate error: RemoteCertificateNameMismatch
Vary: Accept-Encoding
Date: Sat, 13 Jun 2026 06:39:56 GMT
Server: envoy
Via: HTTP/2 edgeproxy,1.1 google
Alt-Svc: h3=":443"; ma=2592000
Content-Length: 0

• https://[2600:1901:0001:07c5:0000:0000:0000:0000]/ 2600:1901:1:7c5::	404		2.093	N
Not Found
Certificate error: RemoteCertificateNameMismatch
Vary: Accept-Encoding
Date: Sat, 13 Jun 2026 06:40:00 GMT
Server: envoy
Via: HTTP/2 edgeproxy,1.1 google
Alt-Svc: h3=":443"; ma=2592000
Content-Length: 0

• https://[2a04:4e42:0001:0000:0000:0000:0000:0810]/ 2a04:4e42:1::810	421	Html is minified: 102.11 %	1.803	N
Misdirected Request
Certificate error: RemoteCertificateNameMismatch
Connection: keep-alive
X-Served-By: cache-ber1080041
Content-Length: 291
Content-Type: text/plain; charset=utf-8

7. Comments

	1. General Results, most used to calculate the result
A	name "spotify.com" is domain, public suffix is ".com", top-level-domain is ".com", top-level-domain-type is "generic", tld-manager is "VeriSign Global Registry Services", num .com-domains preloaded: 108094 (complete: 276475)
A	Good: All ip addresses are public addresses
A	Good: Minimal 2 ip addresses per domain name found: spotify.com has 2 different ip addresses (authoritative).
A	Good: Minimal 2 ip addresses per domain name found: www.spotify.com has 2 different ip addresses (authoritative).
A	Good: Ipv4 and Ipv6 addresses per domain name found: spotify.com has 1 ipv4, 1 ipv6 addresses
A	Good: Ipv4 and Ipv6 addresses per domain name found: www.spotify.com has 1 ipv4, 1 ipv6 addresses
A	Good: No asked Authoritative Name Server had a timeout
A	Good: destination is https
A	Good - only one version with Http-Status 200
A	Good: one preferred version: non-www is preferred
A	Good: No cookie sent via http.
A	Good: every cookie sent via https is marked as secure
	HSTS-Preload-Status: unknown. Domain never included in the Preload-list. Check https://hstspreload.org/ to learn some basics about the Google-Preload-List.
A	http://www.spotify.com/ 151.101.7.42	301	https://www.spotify.com/	Correct redirect http - https with the same domain name
A	http://www.spotify.com/ 2a04:4e42:1::810	301	https://www.spotify.com/	Correct redirect http - https with the same domain name
B	https://open.spotify.com/	200	sp_t=3009a3e8-28c6-4c08-b8aa-7551164ffc9d; Max-Age=31536000; Path=/; Domain=.spotify.com; Secure	Cookie without a SameSite-Attribute. Possible values are: Strict/Lax/None. Cookie may not work as expected, if "None" is wanted, but browsers use "Lax" as default value.
B	https://open.spotify.com/	200	sp_new=1; Max-Age=86400; Path=/; Domain=.spotify.com; Secure	Cookie without a SameSite-Attribute. Possible values are: Strict/Lax/None. Cookie may not work as expected, if "None" is wanted, but browsers use "Lax" as default value.
B	https://open.spotify.com/	200	sp_landing=https%3A%2F%2Fopen.spotify.com%2F; Max-Age=86400; Path=/; Domain=.spotify.com; HttpOnly; Secure	Cookie without a SameSite-Attribute. Possible values are: Strict/Lax/None. Cookie may not work as expected, if "None" is wanted, but browsers use "Lax" as default value.
E	http://spotify.com/ 35.186.224.24	301	https://www.spotify.com/	Wrong redirect one domain http to other domain https. First redirect to https without new dns query, so the server can send the HSTS header. That's fundamental using HSTS (Http Strict Transport Security). First step: Add correct redirects http ⇒ https. Perhaps in your port 80 vHost something like "RewriteEngine on" + "RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent]" (two rows, without the "). Don't add this in your port 443 vHost, that would create a loop. Then recheck your domain, should be Grade C. There is the rule to select one https version as preferred version.
E	http://spotify.com/ 2600:1901:1:7c5::	301	https://www.spotify.com/	Wrong redirect one domain http to other domain https. First redirect to https without new dns query, so the server can send the HSTS header. That's fundamental using HSTS (Http Strict Transport Security). First step: Add correct redirects http ⇒ https. Perhaps in your port 80 vHost something like "RewriteEngine on" + "RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent]" (two rows, without the "). Don't add this in your port 443 vHost, that would create a loop. Then recheck your domain, should be Grade C. There is the rule to select one https version as preferred version.
M	https://35.186.224.24/ 35.186.224.24	404		Misconfiguration - main pages should never send http status 400 - 499
M	https://[2600:1901:0001:07c5:0000:0000:0000:0000]/ 2600:1901:1:7c5::	404		Misconfiguration - main pages should never send http status 400 - 499
M	https://151.101.7.42/ 151.101.7.42	421		Misconfiguration - main pages should never send http status 400 - 499
M	https://[2a04:4e42:0001:0000:0000:0000:0000:0810]/ 2a04:4e42:1::810	421		Misconfiguration - main pages should never send http status 400 - 499
N	https://35.186.224.24/ 35.186.224.24	404		Error - Certificate isn't trusted, RemoteCertificateNameMismatch
N	https://[2600:1901:0001:07c5:0000:0000:0000:0000]/ 2600:1901:1:7c5::	404		Error - Certificate isn't trusted, RemoteCertificateNameMismatch
N	https://151.101.7.42/ 151.101.7.42	421		Error - Certificate isn't trusted, RemoteCertificateNameMismatch
N	https://[2a04:4e42:0001:0000:0000:0000:0000:0810]/ 2a04:4e42:1::810	421		Error - Certificate isn't trusted, RemoteCertificateNameMismatch
O	spotify.com / 35.186.224.24 / 443			Old connection: Cipher Suites without Forward Secrecy (FS) found. Remove all of these Cipher Suites, use only Cipher Suites with Forward Secrecy: Starting with ECDHE- or DHE - the last "E" says: "ephemeral". Or use Tls.1.3, then all Cipher Suites use FS. 5 Cipher Suites without Forward Secrecy found
O	spotify.com / 2600:1901:1:7c5:: / 443			Old connection: Cipher Suites without Forward Secrecy (FS) found. Remove all of these Cipher Suites, use only Cipher Suites with Forward Secrecy: Starting with ECDHE- or DHE - the last "E" says: "ephemeral". Or use Tls.1.3, then all Cipher Suites use FS. 5 Cipher Suites without Forward Secrecy found
A	Good: More then one ip address per domain name found, checking all ip addresses the same http status and the same certificate found: Domain spotify.com, 2 ip addresses.
A	Good: More then one ip address per domain name found, checking all ip addresses the same http status and the same certificate found: Domain www.spotify.com, 2 ip addresses.
	Info: Checking all ip addresses of that domain without sending the hostname only one certificate found. Checking all ip addresses and sending the hostname only one certificate found. Both certificates are different. So that domain requires Server Name Indication (SNI), so the server is able to select the correct certificate.: Domain spotify.com, 2 ip addresses.
	Info: Checking all ip addresses of that domain without sending the hostname only one certificate found. Checking all ip addresses and sending the hostname only one certificate found. Both certificates are different. So that domain requires Server Name Indication (SNI), so the server is able to select the correct certificate.: Domain www.spotify.com, 2 ip addresses.
B	No _mta-sts TXT record found (mta-sts: Mail Transfer Agent Strict Transport Security - see RFC 8461). Read the result of server-daten.de (Url-Checks, Comments, Connections and DomainServiceRecords) to see a complete definition. Domainname: _mta-sts.spotify.com
	2. Header-Checks
A	open.spotify.com	Content-Security-Policy		Ok: Header without syntax errors found: script-src 'self' 'unsafe-eval' blob: open.spotifycdn.com open-review.spotifycdn.com quicksilver.scdn.co www.google-analytics.com www.googletagmanager.com static.ads-twitter.com analytics.twitter.com s.pinimg.com sc-static.net https://www.google.com/recaptcha/ cdn.ravenjs.com connect.facebook.net www.gstatic.com sb.scorecardresearch.com pixel-static.spotify.com cdn.cookielaw.org geolocation.onetrust.com www.fastly-insights.com static.hotjar.com script.hotjar.com https://www.googleadservices.com/pagead/conversion_async.js https://www.googleadservices.com/pagead/conversion/ https://analytics.tiktok.com/i18n/pixel/sdk.js https://analytics.tiktok.com/i18n/pixel/identify.js https://analytics.tiktok.com/i18n/pixel/config.js https://www.redditstatic.com/ads/pixel.js https://t.contentsquare.net/uxa/22f14577e19f3.js https://get.microsoft.com/badge/ms-store-badge.bundled.js https://cdn.us.heap-api.com https://heapanalytics.com 'sha256-WfsTi7oVogdF9vq5d14s2birjvCglqWF842fyHhzoNw=' 'sha256-KRzjHxCdT8icNaDOqPBdY0AlKiIh5F8r4bnbe1PQwss=' 'sha256-Z5wh7XXSBR1+mTxLSPFhywCZJt77+uP1GikAgPIsu2s=' 'sha256-o2wzIImHJ4+WWE5DCTR+myWU0UNml0+wwpDXRo++vII='; frame-ancestors 'self' https://adgen-dev.spotify.com/account//ad//details https://adgen-dev.spotify.com/preview/* https://local.spotify.net/account//ad//details https://local.spotify.net/preview/* https://app.smartly.io/*;
F				Bad: Missing default-src directive. A default-src directive is used if one of the specialized fetch directives (child-src, connect-src, font-src, frame-src, img-src, manifest-src, media-src, object-src, prefetch-src, script-src, style-src, worker-src) isn't defined. Missing default-src, all sources are allowed, that's bad. A default-src with 'none' or 'self' blocks that.
E				Bad: No form-action directive found. Use one to limit the form - action - destinations. form-action is a navigation-directive, so default-src isn't used.
A				Good: frame-ancestors directive found. That limits pages who are allowed to use this page in a frame / iframe / object / embed / applet. frame-ancestors is a navigation-directive, so default-src isn't used.
E				Bad: No base-uri directive found. Use one to limit the URLs which can be used in a document's <base> element. Because it's a document directive, default-src isn't used, so an own directive is required.
F				Critical: No object-src and no default-src as fallback defined. So object / embed / applet can load every resource. That's fatal.
F				Critical: script-src with 'unsafe-inline' or 'unsafe-eval' and without a nonce found. That's dangerous, don't use it. If you really need one of these unsafe directives, add a nonce.
F				Critical: script-src with * or a scheme found. Never allow wildcard - sources.
A				Good: script-src without data: schema found. Why is this important? The data: schema allows hidden code injection. Insert <script src='data:application/javascript;base64,YWxlcnQoJ1hTUycpOw=='></script> in your page and see what happens.
A		X-Content-Type-Options		Ok: Header without syntax errors found: nosniff
F	open.spotify.com	Referrer-Policy		Critical: Missing Header:
F	open.spotify.com	Permissions-Policy		Critical: Missing Header:
B	open.spotify.com	Cross-Origin-Embedder-Policy		Info: Missing Header
B	open.spotify.com	Cross-Origin-Opener-Policy		Info: Missing Header
B	open.spotify.com	Cross-Origin-Resource-Policy		Info: Missing Header
	3. DNS- and NameServer - Checks
A	Info:: 17 Root-climbing DNS Queries required to find all IPv4- and IPv6-Addresses of 5 Name Servers.
A	Info:: 17 Queries complete, 16 with IPv6, 1 with IPv4.
	Warning: Only some DNS Queries done via ipv6. IPv6 is the future, so the name servers of your name servers should have ipv6 addresses.
	Ok (4 - 8):: An average of 3.4 queries per domain name server required to find all ip addresses of all name servers.
A	Info:: 5 different Name Servers found: dns1.p07.nsone.net, ns-cloud-a1.googledomains.com, ns-cloud-a2.googledomains.com, ns-cloud-a3.googledomains.com, ns-cloud-a4.googledomains.com, 5 Name Servers included in Delegation: dns1.p07.nsone.net, ns-cloud-a1.googledomains.com, ns-cloud-a2.googledomains.com, ns-cloud-a3.googledomains.com, ns-cloud-a4.googledomains.com, 5 Name Servers included in 1 Zone definitions: dns1.p07.nsone.net, ns-cloud-a1.googledomains.com, ns-cloud-a2.googledomains.com, ns-cloud-a3.googledomains.com, ns-cloud-a4.googledomains.com, 2 Name Servers listed in SOA.Primary: dns1.p07.nsone.net, ns-cloud-a1.googledomains.com.
	Error: Different SOA.Primary Name Servers found, different SOA Definitions.: dns1.p07.nsone.net,ns-cloud-a1.googledomains.com.
A	Good: SOA.Primary Name Server included in the delegation set.: dns1.p07.nsone.net,ns-cloud-a1.googledomains.com.
A	Good: Consistency between delegation and zone. The set of NS records served by the authoritative name servers must match those proposed for the delegation in the parent zone. Ordered list of name servers: dns1.p07.nsone.net, ns-cloud-a1.googledomains.com, ns-cloud-a2.googledomains.com, ns-cloud-a3.googledomains.com, ns-cloud-a4.googledomains.com
A	Good: All Name Server Domain Names have a Public Suffix.
A	Good: All Name Server Domain Names ending with a Public Suffix have minimal one IPv4- or IPv6 address.
A	Good: All Name Server ip addresses are public.
A	Good: Minimal 2 different name servers (public suffix and public ip address) found: 5 different Name Servers found
A	Good: All name servers have ipv4- and ipv6-addresses.: 5 different Name Servers found
A	Good: Name servers with different Top Level Domains / Public Suffix List entries found: 5 Name Servers, 2 Top Level Domains: net, com
A	Good: Name Servers with different domain names found.: 2 different Domains found
A	Good: Name servers with different Country locations found: 5 Name Servers, 2 Countries: CA, US
A	Info: Ipv4-Subnet-list: 5 Name Servers, 2 different subnets (first Byte): 198., 216., 2 different subnets (first two Bytes): 198.51., 216.239., 5 different subnets (first three Bytes): 198.51.44., 216.239.32., 216.239.34., 216.239.36., 216.239.38.
A	Good: Name Server IPv4-addresses from different subnet found:
A	Info: IPv6-Subnet-list: 5 Name Servers with IPv6, 2 different subnets (first block): 2001:, 2620:, 2 different subnets (first two blocks): 2001:4860:, 2620:004d:, 2 different subnets (first three blocks): 2001:4860:4802:, 2620:004d:4000:, 5 different subnets (first four blocks): 2001:4860:4802:0032:, 2001:4860:4802:0034:, 2001:4860:4802:0036:, 2001:4860:4802:0038:, 2620:004d:4000:6259:
A	Good: Name Server IPv6 addresses from different subnets found.
A	Good: Nameserver supports TCP connections: 10 good Nameserver
A	Info: Nameserver mit different domain names found. May be a problem with DNS-Updates
A	Good: Nameserver supports Echo Capitalization: 10 good Nameserver
A	Good: Nameserver supports EDNS with max. 512 Byte Udp payload, message is smaller: 10 good Nameserver
A	Good: Nameserver has passed 10 EDNS-Checks (OP100, FLAGS, V1, V1OP100, V1FLAGS, DNSSEC, V1DNSSEC, NSID, COOKIE, CLIENTSUBNET): 10 good Nameserver
X	Fatal error: Nameservers with different SOA Serial Numbers
A	Good: CAA entries found, creating certificate is limited: certainly.com is allowed to create certificates
A	Good: CAA entries found, creating certificate is limited: globalsign.com is allowed to create certificates
A	Good: CAA entries found, creating certificate is limited: letsencrypt.org is allowed to create certificates
	Warning: Unknown CAA found: certainly.com isn't defined. Unknown entry. May be wrong written, may be not longer valid. May be a missing entry in this tool.
	4. Content- and Performance-critical Checks
A	Good: All checks /.well-known/acme-challenge/random-filename without redirects answer with the expected http status 404 - Not Found. Creating a Letsencrypt certificate via http-01 challenge should work. If it doesn't work: Check your vHost configuration (apachectl -S, httpd -S, nginx -T). Every combination of port and ServerName / ServerAlias (Apache) or Server (Nginx) must be unique. Merge duplicated entries in one vHost. If you use an IIS, extensionless files must be allowed in the /.well-known/acme-challenge subdirectory. Create a web.config in that directory. Content: <configuration><system.webServer><staticContent><mimeMap fileExtension="." mimeType="text/plain" /></staticContent></system.webServer></configuration>. If you have a redirect http ⇒ https, that's ok, Letsencrypt follows such redirects to port 80 / 443 (same or other server). There must be a certificate. But the certificate may be expired, self signed or with a not matching domain name. Checking the validation file Letsencrypt ignores such certificate errors. Trouble creating a certificate? Use https://community.letsencrypt.org/ to ask.
A	Good: Every https result with status 200 and greater 1024 Bytes is compressed (gzip, deflate, br checked).
	https://open.spotify.com/	200		Warning: Https + http status 200 + Inline CSS / JavaScript found. Don't use inline CSS / JavaScript. These are compiled and re-used ressources, save these with a long Cache-Control max-age - header.
A	Good: Every https result with status 200 has a minified Html-Content with a quota lower then 110 %.
A	Good: Every https connection via port 443 supports the http/2 protocol via ALPN.
A	Good: Some script Elements (type text/javascript) with a src-Attribute have a defer / async - Attribute. So loading and executing these JavaScripts doesn't block parsing and rendering the Html-Output.
	https://open.spotify.com/	200		Critical: Some script Elements (type text/javascript) with a src-Attribute don't have a defer / async - Attribute. Loading and executing these JavaScripts blocks parsing and rendering the Html-Output. That's bad if your site is large or the connection is slow / mobile usage. Use "async" if the js file has only functions (so nothing is executed after parsing the file) or is independend. Use "defer" if the order of the scripts is important. All "defer" scripts are executed before the DOMContentLoaded event is fired. Check https://developer.mozilla.org/en-US/docs/Web/HTML/Element/script to see some details.: 3 script elements without defer/async.
A	Good: All CSS / JavaScript files are sent compressed (gzip, deflate, br checked). That reduces the content of the files. 21 external CSS / JavaScript files found
	Warning: CSS / JavaScript files with a missing or too short Cache-Control header found. Browsers should cache and re-use these files. 0 external CSS / JavaScript files without Cache-Control-Header, 0 with Cache-Control, but no max-age, 1 with Cache-Control max-age too short (minimum 7 days), 19 with Cache-Control long enough, 20 complete.
A	Good: All checked attribute values are enclosed in quotation marks (" or ').
A	Info: No img element found, no alt attribute checked
A	Good: Domainname is not on the "Specially Designated Nationals And Blocked Persons List" (SDN). That's an US-list of individuals and companies owned or controlled by, or acting for or on behalf of, targeted countries. It also lists individuals, groups, and entities, such as terrorists and narcotics traffickers designated under programs that are not country-specific. Collectively, such individuals and companies are called "Specially Designated Nationals" or "SDNs." Their assets are blocked and U.S. persons are generally prohibited from dealing with them. So if a domain name is on that list, it's impossible to create a Letsencrypt certificate with that domain name. Check the list manual - https://www.treasury.gov/resource-center/sanctions/sdn-list/pages/default.aspx
	https://www.spotify.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de	404	1.987 seconds	Warning: 404 needs more then one second
	https://35.186.224.24/ 35.186.224.24	404	2.140 seconds	Warning: 404 needs more then one second
	https://[2600:1901:0001:07c5:0000:0000:0000:0000]/ 2600:1901:1:7c5::	404	2.093 seconds	Warning: 404 needs more then one second
A	Info: Different Server-Headers found
A	Duration: 346894 milliseconds, 346.894 seconds

8. Connections

Domain

Port

Cert.

Protocol

KeyExchange

Strength

Cipher

Strength

HashAlgorithm

OCSP stapling

Domain/KeyExchange

IP/Strength

Port/Cipher

Cert./Strength

Protocol/HashAlgorithm

OCSP stapling

spotify.com

35.186.224.24

443

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

spotify.com

35.186.224.24

443

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

http/2 via ALPN supported
SNI required

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

http/2 via ALPN supported
SNI required

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

Chain - incomplete	1	CN=*.spotify.com, O=Spotify AB, L=Stockholm, C=SE
	2	CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US

spotify.com

2600:1901:1:7c5::

443

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

spotify.com

2600:1901:1:7c5::

443

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

http/2 via ALPN supported
SNI required

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

http/2 via ALPN supported
SNI required

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

Chain - incomplete	1	CN=*.spotify.com, O=Spotify AB, L=Stockholm, C=SE
	2	CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US

www.spotify.com

151.101.7.42

443

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

www.spotify.com

151.101.7.42

443

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

http/2 via ALPN supported
SNI required

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

http/2 via ALPN supported
SNI required

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

Chain (complete)	1	CN=www.spotify.com
	2	CN=YR1, O=Let's Encrypt, C=US
	3	CN=Root YR, O=ISRG, C=US

www.spotify.com

2a04:4e42:1::810

443

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

www.spotify.com

2a04:4e42:1::810

443

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

http/2 via ALPN supported
SNI required

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

http/2 via ALPN supported
SNI required

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

Chain (complete)	1	CN=www.spotify.com
	2	CN=YR1, O=Let's Encrypt, C=US
	3	CN=Root YR, O=ISRG, C=US

open.spotify.com

443

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

open.spotify.com

443

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

http/2 via ALPN supported

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

http/2 via ALPN supported

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

Chain (complete)	1	CN=open.spotify.com
	2	CN=Certainly Intermediate R1, O=Certainly, C=US

www.spotify.com

443

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

www.spotify.com

443

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

http/2 via ALPN supported

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

http/2 via ALPN supported

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

Chain (complete)	1	CN=www.spotify.com
	2	CN=YR1, O=Let's Encrypt, C=US
	3	CN=Root YR, O=ISRG, C=US

151.101.7.42

443

name does not match

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

151.101.7.42

443

name does not match

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

http/2 via ALPN supported
Cert sent without SNI

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

http/2 via ALPN supported
Cert sent without SNI

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

Chain (complete)	1	CN=s.sni-810-default.ssl.fastly.net
	2	CN=Certainly Intermediate R1, O=Certainly, C=US

35.186.224.24

443

name does not match

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

35.186.224.24

443

name does not match

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

http/2 via ALPN supported
Cert sent without SNI

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

http/2 via ALPN supported
Cert sent without SNI

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

Chain - incomplete	1	CN=canary-certificate-for-noop.spotify.com, O=Spotify AB, L=Stockholm, C=SE
	2	CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US

[2600:1901:0001:07c5:0000:0000:0000:0000]

2600:1901:1:7c5::

443

name does not match

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

[2600:1901:0001:07c5:0000:0000:0000:0000]

2600:1901:1:7c5::

443

name does not match

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

http/2 via ALPN supported
Cert sent without SNI

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

http/2 via ALPN supported
Cert sent without SNI

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

Chain - incomplete	1	CN=canary-certificate-for-noop.spotify.com, O=Spotify AB, L=Stockholm, C=SE
	2	CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US

[2a04:4e42:0001:0000:0000:0000:0000:0810]

2a04:4e42:1::810

443

name does not match

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

[2a04:4e42:0001:0000:0000:0000:0000:0810]

2a04:4e42:1::810

443

name does not match

Tls12

ECDH Ephermal

255

Aes128

128

Sha256

not supported

http/2 via ALPN supported
Cert sent without SNI

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

http/2 via ALPN supported
Cert sent without SNI

Tls.1.2
no Tls.1.1
no Tls.1.0
no Ssl3
no Ssl2

Chain (complete)	1	CN=s.sni-810-default.ssl.fastly.net
	2	CN=Certainly Intermediate R1, O=Certainly, C=US

9. Certificates

CN=*.spotify.com, O=Spotify AB, L=Stockholm, C=SE

08.12.2025

09.12.2026
expires in 123 days

*.spotify.com, spotify.com - 2 entries

CN=*.spotify.com, O=Spotify AB, L=Stockholm, C=SE

08.12.2025

09.12.2026
expires in 123 days

*.spotify.com, spotify.com - 2 entries

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	04A7B6CCEC54B36CF146C0E8D8CC3839
Thumbprint:	BF967ACEE4F690B656416372FB6409A51C55D578
SHA256 / Certificate:	0lnAcbIu6EUj57JW5LATr/PHtPJe7bGutagrk1iNY8Y=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	3c36abf09c89a64177011018700f8439923be80ded5ee4cd69e8082698fff385
SHA256 hex / Subject Public Key Information (SPKI):	3c36abf09c89a64177011018700f8439923be80ded5ee4cd69e8082698fff385 (is buggy, ignore the result)
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Good: Key isn't compromised
OCSP - Url:	http://ocsp.digicert.com
OCSP - must staple:	no
Certificate Transparency:	yes
Enhanced Key Usage:	Serverauthentifizierung (1.3.6.1.5.5.7.3.1)

CN=*.spotify.com, O=Spotify AB, L=Stockholm, C=SE

08.12.2025

09.12.2026
expires in 123 days

*.spotify.com, spotify.com - 2 entries

CN=*.spotify.com, O=Spotify AB, L=Stockholm, C=SE

08.12.2025

09.12.2026
expires in 123 days

*.spotify.com, spotify.com - 2 entries

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	04A7B6CCEC54B36CF146C0E8D8CC3839
Thumbprint:	BF967ACEE4F690B656416372FB6409A51C55D578
SHA256 / Certificate:	0lnAcbIu6EUj57JW5LATr/PHtPJe7bGutagrk1iNY8Y=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	3c36abf09c89a64177011018700f8439923be80ded5ee4cd69e8082698fff385
SHA256 hex / Subject Public Key Information (SPKI):	3c36abf09c89a64177011018700f8439923be80ded5ee4cd69e8082698fff385 (is buggy, ignore the result)
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Good: Key isn't compromised
OCSP - Url:	http://ocsp.digicert.com
OCSP - must staple:	no
Certificate Transparency:	yes
Enhanced Key Usage:	Serverauthentifizierung (1.3.6.1.5.5.7.3.1)

CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US

30.03.2021

30.03.2031
expires in 1695 days

CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US

30.03.2021

30.03.2031
expires in 1695 days

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	0CF5BD062B5602F47AB8502C23CCF066
Thumbprint:	1B511ABEAD59C6CE207077C0BF0E0043B1382612
SHA256 / Certificate:	yAJfn8Zf38lbPKjMeGe5pYe1J3lzlXkXRj/IE9C2Jak=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	59e738e674221702af1edb87c5200c1a4b75f64fae3d2c3d265124c61bd83c79
SHA256 hex / Subject Public Key Information (SPKI):
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Check unknown. No result 404 / 200
OCSP - Url:	http://ocsp.digicert.com
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:	Serverauthentifizierung (1.3.6.1.5.5.7.3.1), Clientauthentifizierung (1.3.6.1.5.5.7.3.2)

CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US

30.03.2021

30.03.2031
expires in 1695 days

CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US

30.03.2021

30.03.2031
expires in 1695 days

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	0CF5BD062B5602F47AB8502C23CCF066
Thumbprint:	1B511ABEAD59C6CE207077C0BF0E0043B1382612
SHA256 / Certificate:	yAJfn8Zf38lbPKjMeGe5pYe1J3lzlXkXRj/IE9C2Jak=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	59e738e674221702af1edb87c5200c1a4b75f64fae3d2c3d265124c61bd83c79
SHA256 hex / Subject Public Key Information (SPKI):
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Check unknown. No result 404 / 200
OCSP - Url:	http://ocsp.digicert.com
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:	Serverauthentifizierung (1.3.6.1.5.5.7.3.1), Clientauthentifizierung (1.3.6.1.5.5.7.3.2)

CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US

29.10.2024

09.11.2031
expires in 1919 days

CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US

29.10.2024

09.11.2031
expires in 1919 days

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	0E7D75235CA83761577F4CCD24CD6D1D
Thumbprint:	B7402517EEAAC80AB04681186E8247BD7851CD0A
SHA256 / Certificate:	oNYJp+PENOh4qaHBvQZbjc8zqn7+4bEbx1zOXloEIIA=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	8bb593a93be1d0e8a822bb887c547890c3e706aad2dab76254f97fb36b82fc26
SHA256 hex / Subject Public Key Information (SPKI):
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Check unknown. No result 404 / 200
OCSP - Url:	http://ocsp.digicert.cn
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:

CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US

01.08.2013

15.01.2038
expires in 4178 days

CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US

01.08.2013

15.01.2038
expires in 4178 days

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	033AF1E6A711A9A0BB2864B11D09FAE5
Thumbprint:	DF3C24F9BFD666761B268073FE06D1CC8D4F82A4
SHA256 / Certificate:	yzzLt2Ax5eATj43TmiP53kf/w15DwRRM6ifUalqxy18=
SHA256 hex / Cert (DANE * 0 1):	cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA256 hex / PublicKey (DANE * 1 1):	8bb593a93be1d0e8a822bb887c547890c3e706aad2dab76254f97fb36b82fc26
SHA256 hex / Subject Public Key Information (SPKI):	8bb593a93be1d0e8a822bb887c547890c3e706aad2dab76254f97fb36b82fc26
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Good: Key isn't compromised
OCSP - Url:
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:

CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US

10.11.2006

10.11.2031
expires in 1920 days

CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US

10.11.2006

10.11.2031
expires in 1920 days

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA-1 with RSA Encryption
Serial Number:	02AC5C266A0B409B8F0B79F2AE462577
Thumbprint:	5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25
SHA256 / Certificate:	dDHl9MPBzkaQd08LYeBUQIg7qaAe0Aumq9eAbtOxGM8=
SHA256 hex / Cert (DANE * 0 1):	7431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf
SHA256 hex / PublicKey (DANE * 1 1):	5a889647220e54d6bd8a16817224520bb5c78e58984bd570506388b9de0f075f
SHA256 hex / Subject Public Key Information (SPKI):	5a889647220e54d6bd8a16817224520bb5c78e58984bd570506388b9de0f075f
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Good: Key isn't compromised
OCSP - Url:
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:

CN=www.spotify.com

03.06.2026

01.09.2026
expires in 24 days

www.spotify.com - 1 entry

CN=www.spotify.com

03.06.2026

01.09.2026
expires in 24 days

www.spotify.com - 1 entry

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	05AE3B8EDF465D185DD208E94DDDE24B59E6
Thumbprint:	A0972DC52FA996663A912A803C590699890057A4
SHA256 / Certificate:	L0wKncCTPAG4sMaJi28DzQSURFgOKKL1GoMbuNDgYY0=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	29bdbbe0c4e977cd2e7e6350173814dfc39e3c3c255ffe532bced0407a0c5278
SHA256 hex / Subject Public Key Information (SPKI):	29bdbbe0c4e977cd2e7e6350173814dfc39e3c3c255ffe532bced0407a0c5278 (is buggy, ignore the result)
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Good: Key isn't compromised
OCSP - Url:
OCSP - must staple:	no
Certificate Transparency:	yes
Enhanced Key Usage:	Serverauthentifizierung (1.3.6.1.5.5.7.3.1)

CN=www.spotify.com

03.06.2026

01.09.2026
expires in 24 days

www.spotify.com - 1 entry

CN=www.spotify.com

03.06.2026

01.09.2026
expires in 24 days

www.spotify.com - 1 entry

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	05AE3B8EDF465D185DD208E94DDDE24B59E6
Thumbprint:	A0972DC52FA996663A912A803C590699890057A4
SHA256 / Certificate:	L0wKncCTPAG4sMaJi28DzQSURFgOKKL1GoMbuNDgYY0=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	29bdbbe0c4e977cd2e7e6350173814dfc39e3c3c255ffe532bced0407a0c5278
SHA256 hex / Subject Public Key Information (SPKI):	29bdbbe0c4e977cd2e7e6350173814dfc39e3c3c255ffe532bced0407a0c5278 (is buggy, ignore the result)
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Good: Key isn't compromised
OCSP - Url:
OCSP - must staple:	no
Certificate Transparency:	yes
Enhanced Key Usage:	Serverauthentifizierung (1.3.6.1.5.5.7.3.1)

CN=YR1, O=Let's Encrypt, C=US

03.09.2025

03.09.2028
expires in 757 days

CN=YR1, O=Let's Encrypt, C=US

03.09.2025

03.09.2028
expires in 757 days

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	00A20253F15F2691C05DC1CE13B9BCCA4E
Thumbprint:	CBCFD09CE3CD22D99D94E58F92E9898FBEE51A5E
SHA256 / Certificate:	E5SWNNmc1v1qqAvANP76zOsZaf7vmGWGcT7NuwV1jT8=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	2e8307068b6db620e4a39d068b5dee5d6ef5788cbb2c0b6d23ead84fcc17178c
SHA256 hex / Subject Public Key Information (SPKI):
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Check unknown. No result 404 / 200
OCSP - Url:
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:	Serverauthentifizierung (1.3.6.1.5.5.7.3.1)

CN=YR1, O=Let's Encrypt, C=US

03.09.2025

03.09.2028
expires in 757 days

CN=YR1, O=Let's Encrypt, C=US

03.09.2025

03.09.2028
expires in 757 days

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	00A20253F15F2691C05DC1CE13B9BCCA4E
Thumbprint:	CBCFD09CE3CD22D99D94E58F92E9898FBEE51A5E
SHA256 / Certificate:	E5SWNNmc1v1qqAvANP76zOsZaf7vmGWGcT7NuwV1jT8=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	2e8307068b6db620e4a39d068b5dee5d6ef5788cbb2c0b6d23ead84fcc17178c
SHA256 hex / Subject Public Key Information (SPKI):
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Check unknown. No result 404 / 200
OCSP - Url:
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:	Serverauthentifizierung (1.3.6.1.5.5.7.3.1)

CN=Root YR, O=ISRG, C=US

03.09.2025

03.09.2032
expires in 2218 days

CN=Root YR, O=ISRG, C=US

03.09.2025

03.09.2032
expires in 2218 days

Keyalgorithm	RSA encryption (4096 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	00FAA6275DC258431D9766EC3045EF24AC
Thumbprint:	18F47BAE342367CBBF120681E6721D6AADC386C7
SHA256 / Certificate:	JwxktroarpSwdW6D2NsHMvW1NLzcVF1E4zTV3U0Q/sA=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	7e4e8838a8add6295de7ae3b047d3aba3488ab95db0a0aa56d897a00d8618bcf
SHA256 hex / Subject Public Key Information (SPKI):
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Check unknown. No result 404 / 200
OCSP - Url:
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:

CN=Root YR, O=ISRG, C=US

13.05.2026

03.09.2032
expires in 2218 days

CN=Root YR, O=ISRG, C=US

13.05.2026

03.09.2032
expires in 2218 days

Keyalgorithm	RSA encryption (4096 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	00F24B6D17F9D9AD7CB1C9FEA78782699F
Thumbprint:	AB9D0263244DD0326EB67015705A667E79CFE998
SHA256 / Certificate:	ByY50LFA1b/64WrZw/bMYIYEBiH1HuYabUaokVwHz3Y=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	7e4e8838a8add6295de7ae3b047d3aba3488ab95db0a0aa56d897a00d8618bcf
SHA256 hex / Subject Public Key Information (SPKI):
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Check unknown. No result 404 / 200
OCSP - Url:
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:	Serverauthentifizierung (1.3.6.1.5.5.7.3.1)

CN=ISRG Root X1, O=Internet Security Research Group, C=US

04.06.2015

04.06.2035
expires in 3222 days

CN=ISRG Root X1, O=Internet Security Research Group, C=US

04.06.2015

04.06.2035
expires in 3222 days

Keyalgorithm	RSA encryption (4096 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	008210CFB0D240E3594463E0BB63828B00
Thumbprint:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA256 / Certificate:	lrzsBiZJdvN0YHeazyjFp8/oo8Cq4RqP/O4FwL3fCMY=
SHA256 hex / Cert (DANE * 0 1):	96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6
SHA256 hex / PublicKey (DANE * 1 1):	0b9fa5a59eed715c26c1020c711b4f6ec42d58b0015e14337a39dad301c5afc3
SHA256 hex / Subject Public Key Information (SPKI):	0b9fa5a59eed715c26c1020c711b4f6ec42d58b0015e14337a39dad301c5afc3
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Good: Key isn't compromised
OCSP - Url:
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:

CN=ISRG Root X1, O=Internet Security Research Group, C=US

04.06.2015

04.06.2035
expires in 3222 days

CN=ISRG Root X1, O=Internet Security Research Group, C=US

04.06.2015

04.06.2035
expires in 3222 days

Keyalgorithm	RSA encryption (4096 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	008210CFB0D240E3594463E0BB63828B00
Thumbprint:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA256 / Certificate:	lrzsBiZJdvN0YHeazyjFp8/oo8Cq4RqP/O4FwL3fCMY=
SHA256 hex / Cert (DANE * 0 1):	96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6
SHA256 hex / PublicKey (DANE * 1 1):	0b9fa5a59eed715c26c1020c711b4f6ec42d58b0015e14337a39dad301c5afc3
SHA256 hex / Subject Public Key Information (SPKI):	0b9fa5a59eed715c26c1020c711b4f6ec42d58b0015e14337a39dad301c5afc3
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Good: Key isn't compromised
OCSP - Url:
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:

CN=canary-certificate-for-noop.spotify.com, O=Spotify AB, L=Stockholm, C=SE

08.06.2026

15.07.2026
24 days expired

canary-certificate-for-noop.spotify.com - 1 entry

CN=canary-certificate-for-noop.spotify.com, O=Spotify AB, L=Stockholm, C=SE

08.06.2026

15.07.2026
24 days expired

canary-certificate-for-noop.spotify.com - 1 entry

Keyalgorithm	EC Public Key (256 bit, prime256v1)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	0111F27164ED6798D5FB156692F9B2DD
Thumbprint:	29AA40F110BA8E965F7AC5E0688A1C1CB95E73E3
SHA256 / Certificate:	Flnbk4EOAt4VXKdccatGMuJpnhsFPKax/gqnCFJbrJ4=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	3fc2b54fa58005691a5ca6d0627b56b30ae7cd39134912a83109ab3fc7f717fd
SHA256 hex / Subject Public Key Information (SPKI):	3fc2b54fa58005691a5ca6d0627b56b30ae7cd39134912a83109ab3fc7f717fd (is buggy, ignore the result)
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Good: Key isn't compromised
OCSP - Url:	http://ocsp.digicert.com
OCSP - must staple:	no
Certificate Transparency:	yes
Enhanced Key Usage:	Serverauthentifizierung (1.3.6.1.5.5.7.3.1)

CN=canary-certificate-for-noop.spotify.com, O=Spotify AB, L=Stockholm, C=SE

08.06.2026

15.07.2026
24 days expired

canary-certificate-for-noop.spotify.com - 1 entry

CN=canary-certificate-for-noop.spotify.com, O=Spotify AB, L=Stockholm, C=SE

08.06.2026

15.07.2026
24 days expired

canary-certificate-for-noop.spotify.com - 1 entry

Keyalgorithm	EC Public Key (256 bit, prime256v1)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	0111F27164ED6798D5FB156692F9B2DD
Thumbprint:	29AA40F110BA8E965F7AC5E0688A1C1CB95E73E3
SHA256 / Certificate:	Flnbk4EOAt4VXKdccatGMuJpnhsFPKax/gqnCFJbrJ4=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	3fc2b54fa58005691a5ca6d0627b56b30ae7cd39134912a83109ab3fc7f717fd
SHA256 hex / Subject Public Key Information (SPKI):	3fc2b54fa58005691a5ca6d0627b56b30ae7cd39134912a83109ab3fc7f717fd (is buggy, ignore the result)
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Good: Key isn't compromised
OCSP - Url:	http://ocsp.digicert.com
OCSP - must staple:	no
Certificate Transparency:	yes
Enhanced Key Usage:	Serverauthentifizierung (1.3.6.1.5.5.7.3.1)

CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US

30.03.2021

30.03.2031
expires in 1695 days

CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US

30.03.2021

30.03.2031
expires in 1695 days

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	0CF5BD062B5602F47AB8502C23CCF066
Thumbprint:	1B511ABEAD59C6CE207077C0BF0E0043B1382612
SHA256 / Certificate:	yAJfn8Zf38lbPKjMeGe5pYe1J3lzlXkXRj/IE9C2Jak=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	59e738e674221702af1edb87c5200c1a4b75f64fae3d2c3d265124c61bd83c79
SHA256 hex / Subject Public Key Information (SPKI):
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Check unknown. No result 404 / 200
OCSP - Url:	http://ocsp.digicert.com
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:	Serverauthentifizierung (1.3.6.1.5.5.7.3.1), Clientauthentifizierung (1.3.6.1.5.5.7.3.2)

CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US

30.03.2021

30.03.2031
expires in 1695 days

CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US

30.03.2021

30.03.2031
expires in 1695 days

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	0CF5BD062B5602F47AB8502C23CCF066
Thumbprint:	1B511ABEAD59C6CE207077C0BF0E0043B1382612
SHA256 / Certificate:	yAJfn8Zf38lbPKjMeGe5pYe1J3lzlXkXRj/IE9C2Jak=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	59e738e674221702af1edb87c5200c1a4b75f64fae3d2c3d265124c61bd83c79
SHA256 hex / Subject Public Key Information (SPKI):
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Check unknown. No result 404 / 200
OCSP - Url:	http://ocsp.digicert.com
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:	Serverauthentifizierung (1.3.6.1.5.5.7.3.1), Clientauthentifizierung (1.3.6.1.5.5.7.3.2)

CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US

01.08.2013

15.01.2038
expires in 4178 days

CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US

01.08.2013

15.01.2038
expires in 4178 days

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	033AF1E6A711A9A0BB2864B11D09FAE5
Thumbprint:	DF3C24F9BFD666761B268073FE06D1CC8D4F82A4
SHA256 / Certificate:	yzzLt2Ax5eATj43TmiP53kf/w15DwRRM6ifUalqxy18=
SHA256 hex / Cert (DANE * 0 1):	cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA256 hex / PublicKey (DANE * 1 1):	8bb593a93be1d0e8a822bb887c547890c3e706aad2dab76254f97fb36b82fc26
SHA256 hex / Subject Public Key Information (SPKI):	8bb593a93be1d0e8a822bb887c547890c3e706aad2dab76254f97fb36b82fc26
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Good: Key isn't compromised
OCSP - Url:
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:

CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US

29.10.2024

09.11.2031
expires in 1919 days

CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US

29.10.2024

09.11.2031
expires in 1919 days

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	0E7D75235CA83761577F4CCD24CD6D1D
Thumbprint:	B7402517EEAAC80AB04681186E8247BD7851CD0A
SHA256 / Certificate:	oNYJp+PENOh4qaHBvQZbjc8zqn7+4bEbx1zOXloEIIA=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	8bb593a93be1d0e8a822bb887c547890c3e706aad2dab76254f97fb36b82fc26
SHA256 hex / Subject Public Key Information (SPKI):
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Check unknown. No result 404 / 200
OCSP - Url:	http://ocsp.digicert.cn
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:

CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US

10.11.2006

10.11.2031
expires in 1920 days

CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US

10.11.2006

10.11.2031
expires in 1920 days

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA-1 with RSA Encryption
Serial Number:	02AC5C266A0B409B8F0B79F2AE462577
Thumbprint:	5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25
SHA256 / Certificate:	dDHl9MPBzkaQd08LYeBUQIg7qaAe0Aumq9eAbtOxGM8=
SHA256 hex / Cert (DANE * 0 1):	7431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf
SHA256 hex / PublicKey (DANE * 1 1):	5a889647220e54d6bd8a16817224520bb5c78e58984bd570506388b9de0f075f
SHA256 hex / Subject Public Key Information (SPKI):	5a889647220e54d6bd8a16817224520bb5c78e58984bd570506388b9de0f075f
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Good: Key isn't compromised
OCSP - Url:
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:

CN=s.sni-810-default.ssl.fastly.net

11.06.2026

11.07.2026
28 days expired

s.sni-810-default.ssl.fastly.net - 1 entry

CN=s.sni-810-default.ssl.fastly.net

11.06.2026

11.07.2026
28 days expired

s.sni-810-default.ssl.fastly.net - 1 entry

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	78675DF43A1C7B8289EBF0787A863888C9FA
Thumbprint:	97B68E95C3BFC5C534DCE12D3AB882C0BDDFDC0C
SHA256 / Certificate:	wnwX0FMpTkLkdXiuTaQkjmW20S0SN5pdLLlx2+cZeUg=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	cf389b613dc87737646952da7d4d91c9465a866fbcace34117988c07c4cda552
SHA256 hex / Subject Public Key Information (SPKI):	cf389b613dc87737646952da7d4d91c9465a866fbcace34117988c07c4cda552 (is buggy, ignore the result)
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Good: Key isn't compromised
OCSP - Url:
OCSP - must staple:	no
Certificate Transparency:	yes
Enhanced Key Usage:	Serverauthentifizierung (1.3.6.1.5.5.7.3.1)

CN=Certainly Intermediate R1, O=Certainly, C=US

22.06.2022

22.06.2032
expires in 2145 days

CN=Certainly Intermediate R1, O=Certainly, C=US

22.06.2022

22.06.2032
expires in 2145 days

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	11831CDE4CB573E5
Thumbprint:	FEDEA3AA3B69BF9B84DB1FBE46855AF990EDBDB1
SHA256 / Certificate:	/sQeMsp1wpWmJA+mOdOr47+1yxMdZpDiMxoXa+0uW9I=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	a16eec98284c251727cd339b17b2be1f322745e00f4f107f2f587a7994e6c3d4
SHA256 hex / Subject Public Key Information (SPKI):
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Check unknown. No result 404 / 200
OCSP - Url:
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:	Serverauthentifizierung (1.3.6.1.5.5.7.3.1), Clientauthentifizierung (1.3.6.1.5.5.7.3.2)

CN=Starfield Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

01.09.2009

01.01.2038
expires in 4164 days

CN=Starfield Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

01.09.2009

01.01.2038
expires in 4164 days

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	00
Thumbprint:	B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E
SHA256 / Certificate:	LOHLC/nS+eECmT++IVFSw7LdDKveHGjlMZuDkVTbt/U=
SHA256 hex / Cert (DANE * 0 1):	2ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f5
SHA256 hex / PublicKey (DANE * 1 1):	808d68b3fab4884a5f971ace7d10550d7a95a163774f3ec36afffb213fbe4c74
SHA256 hex / Subject Public Key Information (SPKI):	808d68b3fab4884a5f971ace7d10550d7a95a163774f3ec36afffb213fbe4c74
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Good: Key isn't compromised
OCSP - Url:
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:

CN=open.spotify.com

31.05.2026

30.06.2026
39 days expired

open.spotify.com - 1 entry

CN=open.spotify.com

31.05.2026

30.06.2026
39 days expired

open.spotify.com - 1 entry

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	787B1B0E9371D613649B25EFAF84DF455D88
Thumbprint:	609854AB3587FB87ABA7A328EB73C489435D4CD0
SHA256 / Certificate:	KX0wAdthm9OeB193oN42QQg7u8eQRqJh7wvmO5mdDyQ=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	29bdbbe0c4e977cd2e7e6350173814dfc39e3c3c255ffe532bced0407a0c5278
SHA256 hex / Subject Public Key Information (SPKI):	29bdbbe0c4e977cd2e7e6350173814dfc39e3c3c255ffe532bced0407a0c5278 (is buggy, ignore the result)
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Check unknown. No result 404 / 200
OCSP - Url:
OCSP - must staple:	no
Certificate Transparency:	yes
Enhanced Key Usage:	Serverauthentifizierung (1.3.6.1.5.5.7.3.1)

CN=Certainly Intermediate R1, O=Certainly, C=US

22.06.2022

22.06.2032
expires in 2145 days

CN=Certainly Intermediate R1, O=Certainly, C=US

22.06.2022

22.06.2032
expires in 2145 days

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	11831CDE4CB573E5
Thumbprint:	FEDEA3AA3B69BF9B84DB1FBE46855AF990EDBDB1
SHA256 / Certificate:	/sQeMsp1wpWmJA+mOdOr47+1yxMdZpDiMxoXa+0uW9I=
SHA256 hex / Cert (DANE * 0 1):	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA256 hex / PublicKey (DANE * 1 1):	a16eec98284c251727cd339b17b2be1f322745e00f4f107f2f587a7994e6c3d4
SHA256 hex / Subject Public Key Information (SPKI):
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Check unknown. No result 404 / 200
OCSP - Url:
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:	Serverauthentifizierung (1.3.6.1.5.5.7.3.1), Clientauthentifizierung (1.3.6.1.5.5.7.3.2)

CN=Starfield Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

01.09.2009

01.01.2038
expires in 4164 days

CN=Starfield Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

01.09.2009

01.01.2038
expires in 4164 days

Keyalgorithm	RSA encryption (2048 bit)
Signatur:	SHA256 With RSA-Encryption
Serial Number:	00
Thumbprint:	B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E
SHA256 / Certificate:	LOHLC/nS+eECmT++IVFSw7LdDKveHGjlMZuDkVTbt/U=
SHA256 hex / Cert (DANE * 0 1):	2ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f5
SHA256 hex / PublicKey (DANE * 1 1):	808d68b3fab4884a5f971ace7d10550d7a95a163774f3ec36afffb213fbe4c74
SHA256 hex / Subject Public Key Information (SPKI):	808d68b3fab4884a5f971ace7d10550d7a95a163774f3ec36afffb213fbe4c74
SPKI checked via https://v1.pwnedkeys.com/spki-hash:	Good: Key isn't compromised
OCSP - Url:
OCSP - must staple:	no
Certificate Transparency:	no
Enhanced Key Usage:

10. Last Certificates - Certificate Transparency Log Check

1. Source CertSpotter - active certificates (one check per day)

Issuer				last 7 days	active	num Certs
CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US				0	3	7
CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US				0	0	3
CN=R13, O=Let's Encrypt, C=US				0	0	2
CN=YR1, O=Let's Encrypt, C=US				0	1	1
CN=R12, O=Let's Encrypt, C=US				0	0	1

CertSpotter-Id	Issuer	not before	not after	Domain names	LE-Duplicate	next LE
15194387681 leaf cert	CN=YR1, O=Let's Encrypt, C=US	2026-06-03 12:53:27	2026-09-01 12:53:26	www.spotify.com - 1 entries
14411977877 precert	CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	2026-04-07 00:00:00	2026-10-22 23:59:59	*.spotify.com, spotify.com - 2 entries
14378060084 leaf cert	CN=R13, O=Let's Encrypt, C=US	2026-04-04 13:48:21	2026-07-03 13:48:20	www.spotify.com - 1 entries
13665573826 leaf cert	CN=R13, O=Let's Encrypt, C=US	2026-02-03 14:42:54	2026-05-04 14:42:53	www.spotify.com - 1 entries
13006671943 precert	CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	2025-12-08 00:00:00	2026-12-08 23:59:59	*.spotify.com, spotify.com - 2 entries
12979675934 leaf cert	CN=R12, O=Let's Encrypt, C=US	2025-12-05 15:38:09	2026-03-05 15:38:08	www.spotify.com - 1 entries
12855023715 precert	CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	2025-11-24 00:00:00	2026-12-22 23:59:59	*.spotify.com, spotify.com - 2 entries
9138718401 precert	CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	2025-01-06 00:00:00	2026-01-06 23:59:59	*.spotify.com, spotify.com - 2 entries
8716526011 precert	CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	2024-11-21 00:00:00	2025-12-22 23:59:59	*.spotify.com, spotify.com - 2 entries
6698012004 leaf cert	CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	2024-02-05 00:00:00	2025-02-04 23:59:59	*.spotify.com, spotify.com - 2 entries
6202744961 precert	CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	2023-11-17 00:00:00	2024-12-17 23:59:59	*.spotify.com, spotify.com - 2 entries
4913758515 leaf cert	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	2023-03-07 00:00:00	2024-03-06 23:59:59	*.spotify.com, spotify.com - 2 entries
4520310063 precert	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	2022-12-07 00:00:00	2024-01-07 23:59:59	*.spotify.com, spotify.com - 2 entries
3596182627 leaf cert	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	2022-04-06 00:00:00	2023-04-06 23:59:59	*.spotify.com, spotify.com - 2 entries

2. Source crt.sh - old and new certificates, sometimes very slow - only certificates with "not after" > of the last months are listed

Issuer				last 7 days	active	num Certs
CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US				0	0	4
CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US				0	0	2
CN=DigiCert Verified Mark RSA4096 SHA256 2021 CA1, O="DigiCert, Inc.", C=US				0	0	1

CRT-Id	Issuer	not before	not after	Domain names	LE-Duplicate	next LE
17397406883 leaf cert	CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	2025-01-05 23:00:00	2026-01-06 22:59:59	*.spotify.com, spotify.com 2 entries
15510164796 leaf cert	CN=DigiCert Verified Mark RSA4096 SHA256 2021 CA1, O="DigiCert, Inc.", C=US	2024-11-21 23:00:00	2025-11-22 22:59:59	alerts.spotify.com, hello.spotify.com, legal.spotify.com, spotify.com 4 entries
15443159976 precert	CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	2024-11-20 23:00:00	2025-12-22 22:59:59	*.spotify.com, spotify.com 2 entries
12353226115 leaf cert	CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	2024-02-04 23:00:00	2025-02-04 22:59:59	*.spotify.com, spotify.com 2 entries
11125174506 precert	CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	2023-11-16 23:00:00	2024-12-17 22:59:59	*.spotify.com, spotify.com 2 entries
8933358827 leaf cert	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	2023-03-06 23:00:00	2024-03-06 22:59:59	*.spotify.com, spotify.com 2 entries
8145511282 precert	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	2022-12-06 23:00:00	2024-01-07 22:59:59	*.spotify.com, spotify.com 2 entries

11. Html-Content - Entries

Summary

							Subresource Integrity (SRI)
Domainname	HtmlElement	rel/property	∑	∑ size	∑ problems	∑ int.	∑ ext.	∑ Origin poss.	∑ SRI ParseErrors	∑ SRI valid	∑ SRI missing
https://open.spotify.com/	link	stylesheet	1	78,394 Bytes	0	0	1	1	0	0	-1
	link	other	28	908,895 Bytes	0	0	9	9	0	0	-9
	meta	og	1		0			0	0	0
	meta	other	4		0			0	0	0
	script		6	1,458,647 Bytes	0	0	6	5	0	0	-5

Details (currently limited to 500 rows - some problems with spam users)

Domainname	Html-Element	name/equiv/ property/rel	href/src/content	HttpStatus	∑
https://open.spotify.com/	link	canonical	https://open.spotify.com/			1	ok
							ok


	link	icon	https://open.spotifycdn.com/cdn/images/favicon.4d96e91d.ico		200	1	ok
				image/vnd.microsoft.icon missing X-Content-Type-Options nosniff			ok
	Cache-Control: public, max-age=31536000 with long duration found.			102 Bytes
	ETag: "cfcfb0148ad61de065fd2602f8a8ace6"
	Server-Header Access-Control-Allow-Origin: *			Cross-Origin Resource Sharing (CORS) supported
	missing crossorigin=anonymous\|use-credentials and integrity - attribute, possible hash-values: sha256-TZbpHWlDWLpyItiMOXkm7BsD4lScfxSE4ocu83Xp3Cg= sha384-UFYopefMo69M0gF9QRPDmgBJ1y1/CmhV/YeNO2o021+p9iKAVNOdCu7ngmWEPH0H sha512-zjEfU7+WIrdEMNYjZ3FtK7tw6yG8rZBIvO/sSspvAhZy3pPQSzYlPt0STrRjYhcNDHxeT6q0dft+KTIq6H+hHw== <link rel="icon" href="https://open.spotifycdn.com/cdn/images/favicon.4d96e91d.ico" crossorigin="anonymous" integrity="sha256-TZbpHWlDWLpyItiMOXkm7BsD4lScfxSE4ocu83Xp3Cg=" />

	link	icon	https://open.spotifycdn.com/cdn/images/favicon16.802ae4b2.png		200	1	ok
				image/png missing X-Content-Type-Options nosniff			ok
	Cache-Control: public, max-age=31536000 with long duration found.			No Compression - 128 Bytes
	ETag: "52cf3fd3cf99e28cb040232637a4e1b7"
	Server-Header Access-Control-Allow-Origin: *			Cross-Origin Resource Sharing (CORS) supported
	missing crossorigin=anonymous\|use-credentials and integrity - attribute, possible hash-values: sha256-gCrksh39BLyCAijuNkEdTrz+YDC0hvq1uAHQavwisV4= sha384-Z5yNiEMd8U2ZMwcCfT8SQ6WR0YTdU94jdNMFVW1brp9SibcOTNP2AtHccEHy5T8q sha512-N/eg4YmSVO4fu7Hv09zNWZQ3FSxIEYv5st8ydecpd667esP5ObG8C+dC4EHykSOUY53X0BsobXgokYp+Gd9KwA== <link rel="icon" href="https://open.spotifycdn.com/cdn/images/favicon16.802ae4b2.png" crossorigin="anonymous" integrity="sha256-gCrksh39BLyCAijuNkEdTrz+YDC0hvq1uAHQavwisV4=" />

	link	icon	https://open.spotifycdn.com/cdn/images/favicon32.59cc0c02.png		200	1	ok
				image/png missing X-Content-Type-Options nosniff			ok
	Cache-Control: public, max-age=31536000 with long duration found.			No Compression - 129 Bytes
	ETag: "100477ad281e0a565caa3a1a7d08be31"
	Server-Header Access-Control-Allow-Origin: *			Cross-Origin Resource Sharing (CORS) supported
	missing crossorigin=anonymous\|use-credentials and integrity - attribute, possible hash-values: sha256-WcwMApKY6LExff7UrcNpQv+TTN1lUyWq9ACoop43DMM= sha384-R8K6s6YN1Ic4OjA/NmWHBaexjMUVjTfMpfP/VjUuryF/uDlbUP7ObilYh45rGM0I sha512-S3UX2zwc9co521szjwOXs3LF5BdAIpCNs7MKaw/sEzTLYZDY7RDByz0srNzTDXFpXQhpxl/jhrssJ3zhlkxskQ== <link rel="icon" href="https://open.spotifycdn.com/cdn/images/favicon32.59cc0c02.png" crossorigin="anonymous" integrity="sha256-WcwMApKY6LExff7UrcNpQv+TTN1lUyWq9ACoop43DMM=" />

	link	manifest	https://open.spotifycdn.com/cdn/generated/manifest-web-player.1609946b.json			1	ok
							ok


	link	preconnect	https://api.spotify.com			1	ok
							ok


	link	preconnect	https://api-partner.spotify.com			1	ok
							ok


	link	preconnect	https://apresolve.spotify.com			1	ok
							ok


	link	preconnect	https://clienttoken.spotify.com			1	ok
							ok


	link	preconnect	https://daily-mix.scdn.co			1	ok
							ok


	link	preconnect	https://exp.wg.spotify.com			1	ok
							ok


	link	preconnect	https://gew4-dealer.g2.spotify.com			1	ok
							ok


	link	preconnect	https://gew4-spclient.spotify.com			1	ok
							ok


	link	preconnect	https://i.scdn.co			1	ok
							ok


	link	preconnect	https://lineup-images.scdn.co			1	ok
							ok


	link	preconnect	https://mosaic.scdn.co			1	ok
							ok


	link	preconnect	https://open.spotifycdn.com			1	ok
							ok


	link	preconnect	https://pixel.spotify.com			1	ok
							ok


	link	preconnect	https://pixel-static.spotify.com			1	ok
							ok


	link	preconnect	https://pl.scdn.co			1	ok
							ok


	link	preconnect	https://spclient.wg.spotify.com			1	ok
							ok


	link	preload	https://encore.scdn.co/fonts/SpotifyMixMono-Regular-134eeb986fc0f94a9f0acb9cedaeb584.woff2		200	1	ok
				font/woff missing X-Content-Type-Options nosniff			ok
	Cache-Control: public, max-age=31536000 with long duration found.			Wrong Compression (gzip): 34329/34296 Bytes, font already compressed
	ETag: "267b483d6857667e722548efc37100e1"
	Server-Header Access-Control-Allow-Origin: *			Cross-Origin Resource Sharing (CORS) supported
	missing crossorigin=anonymous\|use-credentials and integrity - attribute, possible hash-values: sha256-dgw4NO2+leoQZIMz2i0NTC+vZ/dJs3ywNsdbUv/ZO30= sha384-l0ft2PtjghHuJvBVMFFPmkPu/yl/4gpJA8w6NAs4fObEaEBGXXOVRAeLAjy2ltf+ sha512-QixtxmZmHRfO45toTI83mFBVYVXZbDiNxSx8GRwf2/VY5oHHxctz9jJdjnhUA+pR2dnjtvKXe4wzFFTXEy0bHg== <link rel="preload" href="https://encore.scdn.co/fonts/SpotifyMixMono-Regular-134eeb986fc0f94a9f0acb9cedaeb584.woff2" crossorigin="anonymous" integrity="sha256-dgw4NO2+leoQZIMz2i0NTC+vZ/dJs3ywNsdbUv/ZO30=" />

	link	preload	https://encore.scdn.co/fonts/SpotifyMixUI-Bold-09c45a3a0ce9d2971e62cb26e97760fb.woff2		200	1	ok
				font/woff missing X-Content-Type-Options nosniff			ok
	Cache-Control: public, max-age=31536000 with long duration found.			Wrong Compression (gzip): 47495/47576 Bytes, font already compressed
	ETag: "482de7090b9145a06410d0d9762a8500"
	Server-Header Access-Control-Allow-Origin: *			Cross-Origin Resource Sharing (CORS) supported
	missing crossorigin=anonymous\|use-credentials and integrity - attribute, possible hash-values: sha256-Z24buQkZ7CkQoL+UDGNF6elpR1EC/jVamN7RBieiAVI= sha384-NJaxxvAv3OZcre7Fhklhgi6fIfPioOWMsT2+tkAQyxfpkg6Pt3zJ5HoV6zlR9cvF sha512-NlykF7l/MMyuEIFBZ+ksP1RCnGFylHEqIhxlShAzkZ7oFhrLduIkDEu1UyP8ZJKybiJp+Odlr/37M+zt59yXvA== <link rel="preload" href="https://encore.scdn.co/fonts/SpotifyMixUI-Bold-09c45a3a0ce9d2971e62cb26e97760fb.woff2" crossorigin="anonymous" integrity="sha256-Z24buQkZ7CkQoL+UDGNF6elpR1EC/jVamN7RBieiAVI=" />

	link	preload	https://encore.scdn.co/fonts/SpotifyMixUI-Regular-76c92fb1a35c462f73429fa8865163eb.woff2		200	1	ok
				font/woff missing X-Content-Type-Options nosniff			ok
	Cache-Control: public, max-age=31536000 with long duration found.			Wrong Compression (gzip): 44413/44408 Bytes, font already compressed
	ETag: "3dcb7675cd470080b73ea26ab47b08d5"
	Server-Header Access-Control-Allow-Origin: *			Cross-Origin Resource Sharing (CORS) supported
	missing crossorigin=anonymous\|use-credentials and integrity - attribute, possible hash-values: sha256-ZN/y6B3p2IpKN9Ba75j0yoIgslyFsA1SB35tmb0KZRo= sha384-a3UQCF5jD6mvnO267yjbI6hTtNx1c60gZUPh1CibihGc0ZweNV9ai7rQM27l6+m5 sha512-9xoKamnLaofDaJ49aWoBGrhTwYEazloFdCAJBKowDOU3ytT/fWzXg4o6rZTrUy9rdYQO1s3U0aRiBiZSvG56KQ== <link rel="preload" href="https://encore.scdn.co/fonts/SpotifyMixUI-Regular-76c92fb1a35c462f73429fa8865163eb.woff2" crossorigin="anonymous" integrity="sha256-ZN/y6B3p2IpKN9Ba75j0yoIgslyFsA1SB35tmb0KZRo=" />

	link	preload	https://encore.scdn.co/fonts/SpotifyMixUITitleVariable-08bab3354d40f74e5177917b5ae80894.woff2		200	2	ok
				font/woff missing X-Content-Type-Options nosniff			ok
	Cache-Control: public, max-age=31536000 with long duration found.			Wrong Compression (gzip): 370108/371036 Bytes, font already compressed
	ETag: "94592570578299bcdc953e1c2bbf6e78"
	Server-Header Access-Control-Allow-Origin: *			Cross-Origin Resource Sharing (CORS) supported
	missing crossorigin=anonymous\|use-credentials and integrity - attribute, possible hash-values: sha256-fHdRp2fflUsB6O8o6YP7jxZXgj1NHyZ4+xYzpVkQp3g= sha384-p0nPVeuExhQvaozpKCth41T91Vu+UD70dlM4U3UsTTWDHA5knEN9cLsXzNYFaTow sha512-BZQV7CapHj+JR9uZhxNxrvkTRf3+FQNL02+xYeQBUgVTBAdhriKH/oMvgUIwyGg/2El/2lIq98vVdfmQW1NVzg== <link rel="preload" href="https://encore.scdn.co/fonts/SpotifyMixUITitleVariable-08bab3354d40f74e5177917b5ae80894.woff2" crossorigin="anonymous" integrity="sha256-fHdRp2fflUsB6O8o6YP7jxZXgj1NHyZ4+xYzpVkQp3g=" />

	link	preload	https://open.spotifycdn.com/cdn/generated-locales/web-player/en.66cd6fcb.json		200	1	ok
				application/json missing X-Content-Type-Options nosniff			ok
				42083 Bytes
	ETag: "4f094016b1baa6aa47bd296d481f9ed6"
	Server-Header Access-Control-Allow-Origin: *			Cross-Origin Resource Sharing (CORS) supported
	missing crossorigin=anonymous\|use-credentials and integrity - attribute, possible hash-values: sha256-Zs1vy8VEF7inMtXDYDgsbCd1G1eimvI/jsnnsH+uQuU= sha384-t3cQKc9P/V3eUNbWVvd3fl8Ff9Lyr83hBSccAvSqAv1uLmzmFlEgMMFrm8zXZ4Du sha512-VsLPX+oMQWXbNlIALyFLID8wVxKrBQmLMHx8OBXDK1noDKO/YAPBvlpXDuHiysNKntzYA3MNTotMqWZQYOskiQ== <link rel="preload" href="https://open.spotifycdn.com/cdn/generated-locales/web-player/en.66cd6fcb.json" crossorigin="anonymous" integrity="sha256-Zs1vy8VEF7inMtXDYDgsbCd1G1eimvI/jsnnsH+uQuU=" />

	link	search	https://open.spotifycdn.com/cdn/generated/opensearch.ebe56467.xml			1	ok
							ok


	link	stylesheet	https://open.spotifycdn.com/cdn/build/web-player/web-player.cc8532d1.css		200	1	ok
				text/css missing X-Content-Type-Options nosniff			ok
	Cache-Control: public, max-age=31536000 - with long duration found.			Compression (br): 78394/459361 Bytes
	ETag: "aa2c8619bdb83f9784e44b0b59190bcf"
	Server-Header Access-Control-Allow-Origin: *			Cross-Origin Resource Sharing (CORS) supported
	missing crossorigin=anonymous\|use-credentials and integrity - attribute, possible hash-values: sha256-o/lxVYHdzyXeZuas5bZoPUD48V4ikUATewGqPJUQ+s0= sha384-IQ2kxPgeVL1wajsWOwY8EFpvJnYMyVaBxXDzwpIkQG5gR/0nvDV6X93zBqBFVOwN sha512-ZAxjPdolFTS7QI8P/m1P8VoYOvuz0tTPCS3gwzxm8/t4+HOtcMkj0oNlKxX6Ym7uIbQ0QXcLYzLD0u2hjtR0ow== <link rel="stylesheet" href="https://open.spotifycdn.com/cdn/build/web-player/web-player.cc8532d1.css" crossorigin="anonymous" integrity="sha256-o/lxVYHdzyXeZuas5bZoPUD48V4ikUATewGqPJUQ+s0=" />

	meta	charset	utf-8			1	ok
							ok


	meta	fb:app_id	174829003346			1	ok
							ok


	meta	og:site_name	Spotify			1	ok
							ok


	meta	X-UA-Compatible	IE=9			1	ok
							ok


	meta	viewport	width=device-width, initial-scale=1, maximum-scale=1			1	ok
							ok


	script	src	https://open.spotifycdn.com/cdn/build/web-player/encore~web-player.69f99a3d.js		200	1	ok
	Missing defer / async attribute.			text/javascript missing X-Content-Type-Options nosniff			ok
	Cache-Control: public, max-age=31536000 - with long duration found.			Compression (br): 87759/442463 Bytes
	ETag: "9c2bd36a5eccc92b79676351e8bb08bc"
	Server-Header Access-Control-Allow-Origin: *			Cross-Origin Resource Sharing (CORS) supported
	missing crossorigin=anonymous\|use-credentials and integrity - attribute, possible hash-values: sha256-2BOpGAYZkSww2hQJCBDwcQjTSK7jiUB2XmTHbTgqDK4= sha384-Z3MV9Vgt0WETIWZ51AMf+guIQo+KQwafz/BwwB5LD35vKvS46Ggl/0mBy3ZcdtLl sha512-TB6vY1foe0RNye7TzFU+gSg6Ww7ahQrnlvdTZfmbFA5A0DW2a4bSQ5l1m3Ry9lJk9k6LrRgdyoDpOnvY6UNJ2A== <script src="https://open.spotifycdn.com/cdn/build/web-player/encore~web-player.69f99a3d.js" crossorigin="anonymous" integrity="sha256-2BOpGAYZkSww2hQJCBDwcQjTSK7jiUB2XmTHbTgqDK4=" />

	script	src	https://open.spotifycdn.com/cdn/build/web-player/vendor~web-player.cc652155.js		200	1	ok
	Missing defer / async attribute.			text/javascript missing X-Content-Type-Options nosniff			ok
	Cache-Control: public, max-age=31536000 - with long duration found.			Compression (br): 239521/1567743 Bytes
	ETag: "c88c6a7e16fce9795c33e372e650ddcc"
	Server-Header Access-Control-Allow-Origin: *			Cross-Origin Resource Sharing (CORS) supported
	missing crossorigin=anonymous\|use-credentials and integrity - attribute, possible hash-values: sha256-ITKMFzKAxdAmcA5tCq7KVRO/xv+Jfhlk+ZjcIdNAU4o= sha384-Y/w75ZhrEO+UBLElsVuileCiTjCwpCD4eqQxK1TtQ3WnaLGI0fbjNRz0XbcKvfzn sha512-4qVgG+hJ3jkPonyK2Gbf6p84Si3AZ0CZCdgY7E4e9R5LzKCkaQPbFU++w/CelTlIHVYJyYR2dG5a2xOGn6Gr0w== <script src="https://open.spotifycdn.com/cdn/build/web-player/vendor~web-player.cc652155.js" crossorigin="anonymous" integrity="sha256-ITKMFzKAxdAmcA5tCq7KVRO/xv+Jfhlk+ZjcIdNAU4o=" />

	script	src	https://open.spotifycdn.com/cdn/build/web-player/web-player.e439eaca.js		200	1	ok
	Missing defer / async attribute.			text/javascript missing X-Content-Type-Options nosniff			ok
	Cache-Control: public, max-age=31536000 - with long duration found.			Compression (br): 1128635/4977047 Bytes
	ETag: "e62c23bc901c08c304251574d5168e7c"
	Server-Header Access-Control-Allow-Origin: *			Cross-Origin Resource Sharing (CORS) supported
	missing crossorigin=anonymous\|use-credentials and integrity - attribute, possible hash-values: sha256-qdmXGtrAUhhpq7xlJv9uBEhveefa4eklBymaN/XE1uc= sha384-2QcS3DC+uoP38TgNaq5B+t8p049nOS0U9iBW0WjF9NYcRwZK3YgRYCN0QPzEs6q4 sha512-YiApuMLqRuqg3lmenFTz0hIFMJEgxltJQM3bw274xMzuC/hk1LRWTiYP5mTXjHXsCwDBmxmGQUYmxB3Z3+ll1Q== <script src="https://open.spotifycdn.com/cdn/build/web-player/web-player.e439eaca.js" crossorigin="anonymous" integrity="sha256-qdmXGtrAUhhpq7xlJv9uBEhveefa4eklBymaN/XE1uc=" />

	script	src	https://open.spotifycdn.com/cdn/js/gtm.96d60fd6.js		200	1	ok
	defer attribute found			text/javascript missing X-Content-Type-Options nosniff			ok
	Cache-Control: public, max-age=31536000 - with long duration found.			Compression (gzip): 1480/4245 Bytes
	ETag: "e5a202315dbe7d9dcdb9b1dcd29b6a4a"
	Server-Header Access-Control-Allow-Origin: *			Cross-Origin Resource Sharing (CORS) supported
	missing crossorigin=anonymous\|use-credentials and integrity - attribute, possible hash-values: sha256-ltYP1qZqX/r/l7Bionsp/LWUvISUot2Vxp1aFfhtnqg= sha384-4Fub48EGYZCnfo2W1h9hdWhOMZDcHqswkPOuBjBCSCvM6IxaN1iKGrLvN0CH4yt4 sha512-v81vgx8gNIWjFqXt2zm3hrHNEqGhBsnYpgEun1MxZfRbucgWxAmFMVo+9OMfGqt49zyhbd4JHLe7Cd8fvaRyXA== <script src="https://open.spotifycdn.com/cdn/js/gtm.96d60fd6.js" crossorigin="anonymous" integrity="sha256-ltYP1qZqX/r/l7Bionsp/LWUvISUot2Vxp1aFfhtnqg=" />

	script	src	https://open.spotifycdn.com/cdn/js/retargeting-pixels.02346b5d.js		200	1	ok
	defer attribute found			text/javascript missing X-Content-Type-Options nosniff			ok
	Cache-Control: public, max-age=31536000 - with long duration found.			Compression (gzip): 577/1172 Bytes
	ETag: "b660253ae2174233bb70ee5ccde61d9d"
	Server-Header Access-Control-Allow-Origin: *			Cross-Origin Resource Sharing (CORS) supported
	missing crossorigin=anonymous\|use-credentials and integrity - attribute, possible hash-values: sha256-AjRrXW/EFhhIfUWOe28UTrU6E0Nq3tU+YQ9wc2IWZ5U= sha384-3upJKlE27EonK4YV56jFu+hcQIbHpoU9X3Myn14Zg87VxlladmIaUR6YejkT9tKv sha512-UjQ1fPmNE8Rzr4ZHPBIEqP9Vq2J2CCHdBYPwBb+8Hb58007ubTYH/9S9dC1oDHEhifB+bQ+uK+mYuTwJ88viuQ== <script src="https://open.spotifycdn.com/cdn/js/retargeting-pixels.02346b5d.js" crossorigin="anonymous" integrity="sha256-AjRrXW/EFhhIfUWOe28UTrU6E0Nq3tU+YQ9wc2IWZ5U=" />

	script	src	https://www.google.com/recaptcha/enterprise.js?render=6LfCVLAUAAAAALFwwRnnCJ12DalriUGbj8FW_J39		200	1	ok
	defer attribute found async attribute found			text/javascript; charset=utf-8 X-Content-Type-Options nosniff found			ok
	Cache-Control: max-age=300, private - max-age too short.			Compression (gzip): 675/1159 Bytes
	Server-Header Access-Control-Allow-Origin: https://open.spotify.com			Cross-Origin Resource Sharing (CORS) not supported

12. Html-Parsing via https://validator.w3.org/nu/

	Type	Message	num found
Url used (first standard-https-result with http status 200): https://open.spotify.com/

Summary
	Good: No non-document-errors
	1 errors
	0 warnings
1.	error	A `meta` element with an `http-equiv` attribute whose value is `X-UA-Compatible` must have a `content` attribute with the value `IE=edge`.	1
Details
	Type	Message + Sample
1	error	A `meta` element with an `http-equiv` attribute whose value is `X-UA-Compatible` must have a `content` attribute with the value `IE=edge`.
		From line 1, column 474 to line 1, column 524
		91d.ico"/><meta http-equiv="X-UA-Compatible" content="IE=9"/><meta

13. Nameserver - IP-Adresses

Required Root-climbing DNS-Queries to find ip addresses of all Name Servers: dns1.p07.nsone.net, ns-cloud-a1.googledomains.com, ns-cloud-a2.googledomains.com, ns-cloud-a3.googledomains.com, ns-cloud-a4.googledomains.com

QNr.	Domain	Type	NS used
1	net	NS	b.root-servers.net (199.9.14.201)
	Answer: a.gtld-servers.net, b.gtld-servers.net, c.gtld-servers.net, d.gtld-servers.net, e.gtld-servers.net, f.gtld-servers.net, g.gtld-servers.net, h.gtld-servers.net, i.gtld-servers.net, j.gtld-servers.net, k.gtld-servers.net, l.gtld-servers.net, m.gtld-servers.net
2	dns1.p07.nsone.net	NS	a.gtld-servers.net (2001:503:a83e::2:30)
	Answer: dns1.p01.nsone.net, dns2.p01.nsone.net, dns3.p01.nsone.net, dns4.p01.nsone.net
	Answer: dns4.p01.nsone.net 198.51.45.65, 2a00:edc0:6259:7:1::4
	Answer: dns3.p01.nsone.net 198.51.44.65, 2620:4d:4000:6259:7:1:0:3
	Answer: dns2.p01.nsone.net 198.51.45.1, 2a00:edc0:6259:7:1::2
	Answer: dns1.p01.nsone.net 198.51.44.1, 2620:4d:4000:6259:7:1:0:1
3	com	NS	d.root-servers.net (2001:500:2d::d)
	Answer: a.gtld-servers.net, b.gtld-servers.net, c.gtld-servers.net, d.gtld-servers.net, e.gtld-servers.net, f.gtld-servers.net, g.gtld-servers.net, h.gtld-servers.net, i.gtld-servers.net, j.gtld-servers.net, k.gtld-servers.net, l.gtld-servers.net, m.gtld-servers.net
4	ns-cloud-a1.googledomains.com	NS	a.gtld-servers.net (2001:503:a83e::2:30)
	Answer: ns5.googledomains.com, ns6.googledomains.com, ns7.googledomains.com, ns8.googledomains.com
	Answer: ns8.googledomains.com 2001:4860:4802:38::a, 216.239.38.10
	Answer: ns7.googledomains.com 2001:4860:4802:36::a, 216.239.36.10
	Answer: ns6.googledomains.com 2001:4860:4802:34::a, 216.239.34.10
	Answer: ns5.googledomains.com 2001:4860:4802:32::a, 216.239.32.10
5	ns-cloud-a2.googledomains.com	NS	a.gtld-servers.net (2001:503:a83e::2:30)
	Answer: ns5.googledomains.com, ns6.googledomains.com, ns7.googledomains.com, ns8.googledomains.com
	Answer: ns8.googledomains.com 2001:4860:4802:38::a, 216.239.38.10
	Answer: ns7.googledomains.com 2001:4860:4802:36::a, 216.239.36.10
	Answer: ns6.googledomains.com 2001:4860:4802:34::a, 216.239.34.10
	Answer: ns5.googledomains.com 2001:4860:4802:32::a, 216.239.32.10
6	ns-cloud-a3.googledomains.com	NS	a.gtld-servers.net (2001:503:a83e::2:30)
	Answer: ns5.googledomains.com, ns6.googledomains.com, ns7.googledomains.com, ns8.googledomains.com
	Answer: ns8.googledomains.com 2001:4860:4802:38::a, 216.239.38.10
	Answer: ns7.googledomains.com 2001:4860:4802:36::a, 216.239.36.10
	Answer: ns6.googledomains.com 2001:4860:4802:34::a, 216.239.34.10
	Answer: ns5.googledomains.com 2001:4860:4802:32::a, 216.239.32.10
7	ns-cloud-a4.googledomains.com	NS	a.gtld-servers.net (2001:503:a83e::2:30)
	Answer: ns5.googledomains.com, ns6.googledomains.com, ns7.googledomains.com, ns8.googledomains.com
	Answer: ns5.googledomains.com 2001:4860:4802:32::a, 216.239.32.10
	Answer: ns6.googledomains.com 2001:4860:4802:34::a, 216.239.34.10
	Answer: ns7.googledomains.com 2001:4860:4802:36::a, 216.239.36.10
	Answer: ns8.googledomains.com 2001:4860:4802:38::a, 216.239.38.10
8	dns1.p07.nsone.net: 198.51.44.7	A	dns1.p01.nsone.net (2620:4d:4000:6259:7:1:0:1)
9	dns1.p07.nsone.net: 2620:4d:4000:6259:7:7:0:1	AAAA	dns1.p01.nsone.net (2620:4d:4000:6259:7:1:0:1)
10	ns-cloud-a1.googledomains.com: 216.239.32.106	A	ns5.googledomains.com (2001:4860:4802:32::a)
11	ns-cloud-a1.googledomains.com: 2001:4860:4802:32::6a	AAAA	ns5.googledomains.com (2001:4860:4802:32::a)
12	ns-cloud-a2.googledomains.com: 216.239.34.106	A	ns5.googledomains.com (2001:4860:4802:32::a)
13	ns-cloud-a2.googledomains.com: 2001:4860:4802:34::6a	AAAA	ns5.googledomains.com (2001:4860:4802:32::a)
14	ns-cloud-a3.googledomains.com: 216.239.36.106	A	ns5.googledomains.com (2001:4860:4802:32::a)
15	ns-cloud-a3.googledomains.com: 2001:4860:4802:36::6a	AAAA	ns5.googledomains.com (2001:4860:4802:32::a)
16	ns-cloud-a4.googledomains.com: 216.239.38.106	A	ns5.googledomains.com (2001:4860:4802:32::a)
17	ns-cloud-a4.googledomains.com: 2001:4860:4802:38::6a	AAAA	ns5.googledomains.com (2001:4860:4802:32::a)

14. CAA - Entries

Domainname	flag	Name	Value	∑ Queries
atc.spotify.map.fastly.net	0		no CAA entry found	1
spotify.map.fastly.net	0		no CAA entry found	1
www.spotify.com				1
map.fastly.net	0		no CAA entry found	1
spotify.com	0		no CAA entry found	1
fastly.net	5	issue	certainly.com;validationmethods=dns-01	1
	5	issue	globalsign.com	1
	5	issue	letsencrypt.org;validationmethods=dns-01	1
	5	iodef	mailto:security@fastly.com	1
net	0		no CAA entry found	1
com	0		no CAA entry found	1

15. TXT - Entries

Domainname	TXT Entry	Status	∑ Queries
spotify.com	_anz60jg9dhixqlmcv20ntnooz9m0k8x	ok	1
spotify.com	anthropic-domain-verification-mqtmtz=BSac9xfxvigNt4Ralt2KPkt1V	ok	1
spotify.com	apple-domain-verification=Dxae2sKJD2O5TKGK	ok	1
spotify.com	atlassian-domain-verification=1My5WsxLluUY8uIjgbLs4MY3ySFp32k9aYNW2IR4ihM64k58CxpFnB5R9SEiJAnR	ok	1
spotify.com	atlassian-sending-domain-verification=d90f2e0c-fa57-43b6-910f-065cc4d6a0e3	ok	1
spotify.com	cloudflare_dashboard_sso=19cd522a4fc20281209f03663d34ee76	ok	1
spotify.com	cursor-domain-verification-985xgr=7ROYkkLIfunrK2GtW0spMGDNw	ok	1
spotify.com	docker-verification=82f3553a-fb50-4d4e-9607-8a8079ee354f	ok	1
spotify.com	facebook-domain-verification=qyrvuca7h4s7wevhzbprtt3tdyyhf1	ok	1
spotify.com	facebook-domain-verification=wtgn9pdvjdhs21j9gz6knsnpkafvs5	ok	1
spotify.com	google-site-verification=0wmxUE7T2OWPhtwjco6oCyqqbYgtosjQdywAr4G4kU0	ok	1
spotify.com	google-site-verification=buTP-BbGUoP8lPntqskvSbeS68M4PDoIFkiUtQEA5n8	ok	1
spotify.com	google-site-verification=ehIHBRyAOKdOfUyw_ONXT0TMuUsdk1gDGSYfk8YhRgw	ok	1
spotify.com	google-site-verification=ESiNWockZgSgTPSsrsAdMX9afsj2-_8504nQ0qIHkDA	ok	1
spotify.com	google-site-verification=uD4f4k01lFWX3qwVbqnVaJg8atpKgAgc-_RYcyT3ofU	ok	1
spotify.com	have-i-been-pwned-verification=33b7ae688099ee8cca63259b769a0ea8	ok	1
spotify.com	jamf-site-verification=1kKxrm0glhWvrA0YiABH_w	ok	1
spotify.com	liveramp-site-verification=IAXPTLlWofr4aaKtwVqirrHvOqUMiXnaMW8WMmuz1v0	ok	1
spotify.com	loom-site-verification=3ee9ca8c2df34d08abbb7be5185bc768	ok	1
spotify.com	MS=ms38184034	ok	1
spotify.com	notion-domain-verification=AqUDuql68X5rQ1qLwho6huUjf4QteXZlyvTIKS1txnq	ok	1
spotify.com	onetrust-domain-verification=508849d40e2b4b8fba2b7eaf84f1bddc	ok	1
spotify.com	openai-domain-verification=dv-VNYvLsJIttFvRz7ymxFgjrPC	ok	1
spotify.com	parallels-domain-verification=7bb3a358f26f4e23a5077648266570c873182a57d6d44e47a55ef6cf72cdb470	ok	1
spotify.com	reachdesk-verification=v0DuUrKxORfyqxIOMkJm57GlQtvaAv0watqt7x7ylMN21LAHqR6dEhUpSxOp7DCh	ok	1
spotify.com	status-page-domain-verification=wq4jns7ydgbb	ok	1
spotify.com	tiktok-developers-site-verification=98xFqMKsOJ51nNJpUCGPGbo7m17gtf7f	ok	1
spotify.com	tiktok-developers-site-verification=pZNawVY3o5Ma80MRCC6Fref1NiLzuEVU	ok	1
spotify.com	tiktok-developers-site-verification=ttGXJxgq1HQKquomgiljzFq53uoLHcUC	ok	1
spotify.com	v=spf1 ip4:80.76.146.172 ip4:80.76.146.173 include:_spf.google.com include:servers.mcsv.net include:_spf.salesforce.com include:_spf.netigate.se include:21894833.spf06.hubspotemail.net ~all	ok	1
spotify.com	vmware-cloud-verification-dab4c35d-1819-4431-add3-d3c382ee32bc	ok	1
spotify.com	windsurf-verification=LRBAV_kH3G5aleY1GIc1jMUg_8iBpigIm2qYF00bRps=	ok	1
spotify.com	wiz-domain-verification=370862886b04dfa626d54d2c4cc955174c6f3164a104a85d725ae5ece72ea3ef	ok	1
spotify.com	yahoo-verification-key=bdudmGyddArwRiVafgItrfYq8nrhd5vzNZ7Ik/G0ILM=	ok	1
spotify.com	zapier-domain-verification-challenge=db8a0b98-bb6a-4f84-a699-344dc23fef3b	ok	1
www.spotify.com			1
atc.spotify.map.fastly.net		ok	1
_acme-challenge.spotify.com		Name Error - The domain name does not exist	1
_acme-challenge.www.spotify.com			1
_acme-challenge.spotify.com.spotify.com		Name Error - The domain name does not exist	1
_acme-challenge.atc.spotify.map.fastly.net		Name Error - The domain name does not exist	1
_acme-challenge.www.spotify.com.spotify.com		Name Error - The domain name does not exist	1
_acme-challenge.www.spotify.com.www.spotify.com		Name Error - The domain name does not exist	1
_acme-challenge.atc.spotify.map.fastly.net.atc.spotify.map.fastly.net		Name Error - The domain name does not exist	1

16. DomainService - Entries

Type		Domain	Pref	Value	DNS-error	num Answers	Status	Description
MX		spotify.com	1	aspmx.l.google.com	0	7	ok
	A			142.251.127.27	0	1	ok
	AAAA			2a00:1450:4001:c21::1a	0	1	ok
	CNAME				0	0	ok
MX		spotify.com	5	alt1.aspmx.l.google.com	0	7	ok
	A			172.253.152.26	0	1	ok
	AAAA			2a00:1450:4010:c22::1b	0	1	ok
	CNAME				0	0	ok
MX		spotify.com	5	alt2.aspmx.l.google.com	0	7	ok
	A			192.178.211.27	0	1	ok
	AAAA			2404:6800:4000:1025::1a	0	1	ok
	CNAME				0	0	ok
MX		spotify.com	10	aspmx2.googlemail.com	0	7	ok
	A			172.253.152.26	0	1	ok
	AAAA			2a00:1450:4010:c22::1a	0	1	ok
	CNAME				0	0	ok
MX		spotify.com	10	aspmx3.googlemail.com	0	7	ok
	A			192.178.211.26	0	1	ok
	AAAA			2404:6800:4000:1025::1a	0	1	ok
	CNAME				0	0	ok
MX		spotify.com	10	aspmx4.googlemail.com	0	7	ok
	A			172.253.158.26	0	1	ok
	AAAA			2404:6800:4003:c26::1a	0	1	ok
	CNAME				0	0	ok
MX		spotify.com	10	aspmx5.googlemail.com	0	7	ok
	A			108.177.125.26	0	1	ok
	AAAA			2404:6800:4008:c01::1a	0	1	ok
	CNAME				0	0	ok
SPF	TXT	spotify.com		v=spf1 ip4:80.76.146.172 ip4:80.76.146.173 include:_spf.google.com include:servers.mcsv.net include:_spf.salesforce.com include:_spf.netigate.se include:21894833.spf06.hubspotemail.net ~all			ok
	TXT	_spf.google.com		v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all			ok
	TXT	servers.mcsv.net		v=spf1 ip4:205.201.128.0/20 ip4:198.2.128.0/18 ip4:148.105.0.0/16 -all			ok
	TXT	_spf.salesforce.com		v=spf1 exists:%{i}._spf.mta.salesforce.com -all			ok
	TXT	_spf.netigate.se		v=spf1 ip4:89.45.227.221 ip4:89.45.227.195 ip4:86.107.243.139 ip4:143.55.236.39 ip4:141.193.32.19 -all			ok
	TXT	21894833.spf06.hubspotemail.net		v=spf1 ip4:3.93.157.0/24 ip4:3.210.190.0/24 ip4:18.208.124.128/25 ip4:54.174.52.0/24 ip4:54.174.57.0/24 ip4:54.174.59.0/24 ip4:54.174.60.0/23 ip4:54.174.63.0/24 ip4:108.179.144.0/20 ip4:139.180.17.0/24 ip4:141.193.184.32/27 ip4:141.193.184.64/26 ip4:141.193.184.128/25 ip4:141.193.185.32/27 ip4:141.193.185.64/26 ip4:141.193.185.128/25 ip4:143.244.80.0/20 ip4:158.247.16.0/20 ip4:216.139.64.0/19 -all			ok
_dmarc	TXT	_dmarc.spotify.com		v=DMARC1; p=reject; sp=reject; pct=100; fo=1; rf=afrf; rua=mailto:6jxge2ly@ag.eu.dmarcian.com;			ok
	TXT	spotify.com._report._dmarc.ag.eu.dmarcian.com		mailto:6jxge2ly@ag.eu.dmarcian.com			ok	Mail domain unequal current domain. Check required, if there is a confirming _report._dmarc-Record. See RFC 7489, 7.1.
	TXT	spotify.com._report._dmarc.ag.eu.dmarcian.com		v=DMARC1;			ok	Confirmed. Sending reports to external domain is allowed.

17. Cipher Suites

Summary
Domain	IP	Port	num Ciphers	time	Std.Protocol	Forward Secrecy
spotify.com	35.186.224.24	443	10 Ciphers	50.97 sec		5 without, 5 FS	50.00 %
spotify.com	2600:1901:1:7c5::	443	10 Ciphers	46.27 sec		5 without, 5 FS	50.00 %
www.spotify.com	151.101.7.42	443	3 Ciphers	21.87 sec		0 without, 3 FS	100.00 %
www.spotify.com	2a04:4e42:1::810	443	3 Ciphers	17.91 sec		0 without, 3 FS	100.00 %
Complete		4	26 Ciphers 6.50 Ciphers/Check	137.02 sec	34.26 sec/Check	10 without, 16 FS	61.54 %

Details
Domain	IP	Port	Cipher (OpenSsl / IANA)
spotify.com	35.186.224.24	443	ECDHE-RSA-CHACHA20-POLY1305		(Secure)	TLSv1.2	0xCC,0xA8	FS
10 Ciphers, 50.97 sec			TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
			ECDH		RSA	CHACHA20/POLY1305(256)	AEAD
			ECDHE-RSA-AES256-GCM-SHA384		(Secure)	TLSv1.2	0xC0,0x30	FS
			TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
			ECDH		RSA	AESGCM(256)	AEAD
			ECDHE-RSA-AES128-GCM-SHA256		(Secure)	TLSv1.2	0xC0,0x2F	FS
			TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
			ECDH		RSA	AESGCM(128)	AEAD
			AES256-GCM-SHA384		(Weak)	TLSv1.2	0x00,0x9D	No FS
			TLS_RSA_WITH_AES_256_GCM_SHA384
			RSA		RSA	AESGCM(256)	AEAD
			AES128-GCM-SHA256		(Weak)	TLSv1.2	0x00,0x9C	No FS
			TLS_RSA_WITH_AES_128_GCM_SHA256
			RSA		RSA	AESGCM(128)	AEAD
			ECDHE-RSA-AES256-SHA		(Weak)	TLSv1	0xC0,0x14	FS
			TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
			ECDH		RSA	AES(256)	SHA1
			ECDHE-RSA-AES128-SHA		(Weak)	TLSv1	0xC0,0x13	FS
			TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
			ECDH		RSA	AES(128)	SHA1
			AES256-SHA		(Weak)	SSLv3	0x00,0x35	No FS
			TLS_RSA_WITH_AES_256_CBC_SHA
			RSA		RSA	AES(256)	SHA1
			DES-CBC3-SHA		(Weak)	SSLv3	0x00,0x0A	No FS
			TLS_RSA_WITH_3DES_EDE_CBC_SHA
			RSA		RSA	3DES(168)	SHA1
			AES128-SHA		(Weak)	SSLv3	0x00,0x2F	No FS
			TLS_RSA_WITH_AES_128_CBC_SHA
			RSA		RSA	AES(128)	SHA1
	2600:1901:1:7c5::	443	ECDHE-RSA-CHACHA20-POLY1305		(Secure)	TLSv1.2	0xCC,0xA8	FS
10 Ciphers, 46.27 sec			TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
			ECDH		RSA	CHACHA20/POLY1305(256)	AEAD
			ECDHE-RSA-AES256-GCM-SHA384		(Secure)	TLSv1.2	0xC0,0x30	FS
			TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
			ECDH		RSA	AESGCM(256)	AEAD
			ECDHE-RSA-AES128-GCM-SHA256		(Secure)	TLSv1.2	0xC0,0x2F	FS
			TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
			ECDH		RSA	AESGCM(128)	AEAD
			AES256-GCM-SHA384		(Weak)	TLSv1.2	0x00,0x9D	No FS
			TLS_RSA_WITH_AES_256_GCM_SHA384
			RSA		RSA	AESGCM(256)	AEAD
			AES128-GCM-SHA256		(Weak)	TLSv1.2	0x00,0x9C	No FS
			TLS_RSA_WITH_AES_128_GCM_SHA256
			RSA		RSA	AESGCM(128)	AEAD
			ECDHE-RSA-AES256-SHA		(Weak)	TLSv1	0xC0,0x14	FS
			TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
			ECDH		RSA	AES(256)	SHA1
			ECDHE-RSA-AES128-SHA		(Weak)	TLSv1	0xC0,0x13	FS
			TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
			ECDH		RSA	AES(128)	SHA1
			AES256-SHA		(Weak)	SSLv3	0x00,0x35	No FS
			TLS_RSA_WITH_AES_256_CBC_SHA
			RSA		RSA	AES(256)	SHA1
			DES-CBC3-SHA		(Weak)	SSLv3	0x00,0x0A	No FS
			TLS_RSA_WITH_3DES_EDE_CBC_SHA
			RSA		RSA	3DES(168)	SHA1
			AES128-SHA		(Weak)	SSLv3	0x00,0x2F	No FS
			TLS_RSA_WITH_AES_128_CBC_SHA
			RSA		RSA	AES(128)	SHA1
www.spotify.com	151.101.7.42	443	ECDHE-RSA-CHACHA20-POLY1305		(Secure)	TLSv1.2	0xCC,0xA8	FS
3 Ciphers, 21.87 sec			TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
			ECDH		RSA	CHACHA20/POLY1305(256)	AEAD
			ECDHE-RSA-AES256-GCM-SHA384		(Secure)	TLSv1.2	0xC0,0x30	FS
			TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
			ECDH		RSA	AESGCM(256)	AEAD
			ECDHE-RSA-AES128-GCM-SHA256		(Secure)	TLSv1.2	0xC0,0x2F	FS
			TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
			ECDH		RSA	AESGCM(128)	AEAD
	2a04:4e42:1::810	443	ECDHE-RSA-CHACHA20-POLY1305		(Secure)	TLSv1.2	0xCC,0xA8	FS
3 Ciphers, 17.91 sec			TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
			ECDH		RSA	CHACHA20/POLY1305(256)	AEAD
			ECDHE-RSA-AES256-GCM-SHA384		(Secure)	TLSv1.2	0xC0,0x30	FS
			TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
			ECDH		RSA	AESGCM(256)	AEAD
			ECDHE-RSA-AES128-GCM-SHA256		(Secure)	TLSv1.2	0xC0,0x2F	FS
			TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
			ECDH		RSA	AESGCM(128)	AEAD

18. Portchecks

Domain	IP	Port	Description	Result	Answer
spotify.com	35.186.224.24	21	FTP

spotify.com	35.186.224.24	21	FTP
spotify.com	35.186.224.24	22	SSH

spotify.com	35.186.224.24	22	SSH
spotify.com	35.186.224.24	25	SMTP

spotify.com	35.186.224.24	25	SMTP
spotify.com	35.186.224.24	53	DNS

spotify.com	35.186.224.24	53	DNS
spotify.com	35.186.224.24	110	POP3

spotify.com	35.186.224.24	110	POP3
spotify.com	35.186.224.24	143	IMAP

spotify.com	35.186.224.24	143	IMAP
spotify.com	35.186.224.24	465	SMTP (encrypted)

spotify.com	35.186.224.24	465	SMTP (encrypted)
spotify.com	35.186.224.24	587	SMTP (encrypted, submission)

spotify.com	35.186.224.24	587	SMTP (encrypted, submission)
spotify.com	35.186.224.24	993	IMAP (encrypted)

spotify.com	35.186.224.24	993	IMAP (encrypted)
spotify.com	35.186.224.24	995	POP3 (encrypted)

spotify.com	35.186.224.24	995	POP3 (encrypted)
spotify.com	35.186.224.24	1433	MS SQL

spotify.com	35.186.224.24	1433	MS SQL
spotify.com	35.186.224.24	2082	cPanel (http)

spotify.com	35.186.224.24	2082	cPanel (http)
spotify.com	35.186.224.24	2083	cPanel (https)

spotify.com	35.186.224.24	2083	cPanel (https)
spotify.com	35.186.224.24	2086	WHM (http)

spotify.com	35.186.224.24	2086	WHM (http)
spotify.com	35.186.224.24	2087	WHM (https)

spotify.com	35.186.224.24	2087	WHM (https)
spotify.com	35.186.224.24	2089	cPanel Licensing

spotify.com	35.186.224.24	2089	cPanel Licensing
spotify.com	35.186.224.24	2095	cPanel Webmail (http)

spotify.com	35.186.224.24	2095	cPanel Webmail (http)
spotify.com	35.186.224.24	2096	cPanel Webmail (https)

spotify.com	35.186.224.24	2096	cPanel Webmail (https)
spotify.com	35.186.224.24	2222	DirectAdmin (http)

spotify.com	35.186.224.24	2222	DirectAdmin (http)
spotify.com	35.186.224.24	2222	DirectAdmin (https)

spotify.com	35.186.224.24	2222	DirectAdmin (https)
spotify.com	35.186.224.24	3306	mySql

spotify.com	35.186.224.24	3306	mySql
spotify.com	35.186.224.24	5224	Plesk Licensing

spotify.com	35.186.224.24	5224	Plesk Licensing
spotify.com	35.186.224.24	5432	PostgreSQL

spotify.com	35.186.224.24	5432	PostgreSQL
spotify.com	35.186.224.24	8080	Ookla Speedtest (http)

spotify.com	35.186.224.24	8080	Ookla Speedtest (http)
spotify.com	35.186.224.24	8080	Ookla Speedtest (https)

spotify.com	35.186.224.24	8080	Ookla Speedtest (https)
spotify.com	35.186.224.24	8083	VestaCP http

spotify.com	35.186.224.24	8083	VestaCP http
spotify.com	35.186.224.24	8083	VestaCP https

spotify.com	35.186.224.24	8083	VestaCP https
spotify.com	35.186.224.24	8443	Plesk Administration (https)

spotify.com	35.186.224.24	8443	Plesk Administration (https)
spotify.com	35.186.224.24	8447	Plesk Installer + Updates

spotify.com	35.186.224.24	8447	Plesk Installer + Updates
spotify.com	35.186.224.24	8880	Plesk Administration (http)

spotify.com	35.186.224.24	8880	Plesk Administration (http)
spotify.com	35.186.224.24	10000	Webmin (http)

spotify.com	35.186.224.24	10000	Webmin (http)
spotify.com	35.186.224.24	10000	Webmin (https)

spotify.com	35.186.224.24	10000	Webmin (https)
spotify.com	2600:1901:1:7c5::	21	FTP

spotify.com	2600:1901:1:7c5::	21	FTP
spotify.com	2600:1901:1:7c5::	22	SSH

spotify.com	2600:1901:1:7c5::	22	SSH
spotify.com	2600:1901:1:7c5::	25	SMTP

spotify.com	2600:1901:1:7c5::	25	SMTP
spotify.com	2600:1901:1:7c5::	53	DNS

spotify.com	2600:1901:1:7c5::	53	DNS
spotify.com	2600:1901:1:7c5::	110	POP3

spotify.com	2600:1901:1:7c5::	110	POP3
spotify.com	2600:1901:1:7c5::	143	IMAP

spotify.com	2600:1901:1:7c5::	143	IMAP
spotify.com	2600:1901:1:7c5::	465	SMTP (encrypted)

spotify.com	2600:1901:1:7c5::	465	SMTP (encrypted)
spotify.com	2600:1901:1:7c5::	587	SMTP (encrypted, submission)

spotify.com	2600:1901:1:7c5::	587	SMTP (encrypted, submission)
spotify.com	2600:1901:1:7c5::	993	IMAP (encrypted)

spotify.com	2600:1901:1:7c5::	993	IMAP (encrypted)
spotify.com	2600:1901:1:7c5::	995	POP3 (encrypted)

spotify.com	2600:1901:1:7c5::	995	POP3 (encrypted)
spotify.com	2600:1901:1:7c5::	1433	MS SQL

spotify.com	2600:1901:1:7c5::	1433	MS SQL
spotify.com	2600:1901:1:7c5::	2082	cPanel (http)

spotify.com	2600:1901:1:7c5::	2082	cPanel (http)
spotify.com	2600:1901:1:7c5::	2083	cPanel (https)

spotify.com	2600:1901:1:7c5::	2083	cPanel (https)
spotify.com	2600:1901:1:7c5::	2086	WHM (http)

spotify.com	2600:1901:1:7c5::	2086	WHM (http)
spotify.com	2600:1901:1:7c5::	2087	WHM (https)

spotify.com	2600:1901:1:7c5::	2087	WHM (https)
spotify.com	2600:1901:1:7c5::	2089	cPanel Licensing

spotify.com	2600:1901:1:7c5::	2089	cPanel Licensing
spotify.com	2600:1901:1:7c5::	2095	cPanel Webmail (http)

spotify.com	2600:1901:1:7c5::	2095	cPanel Webmail (http)
spotify.com	2600:1901:1:7c5::	2096	cPanel Webmail (https)

spotify.com	2600:1901:1:7c5::	2096	cPanel Webmail (https)
spotify.com	2600:1901:1:7c5::	2222	DirectAdmin (http)

spotify.com	2600:1901:1:7c5::	2222	DirectAdmin (http)
spotify.com	2600:1901:1:7c5::	2222	DirectAdmin (https)

spotify.com	2600:1901:1:7c5::	2222	DirectAdmin (https)
spotify.com	2600:1901:1:7c5::	3306	mySql

spotify.com	2600:1901:1:7c5::	3306	mySql
spotify.com	2600:1901:1:7c5::	5224	Plesk Licensing

spotify.com	2600:1901:1:7c5::	5224	Plesk Licensing
spotify.com	2600:1901:1:7c5::	5432	PostgreSQL

spotify.com	2600:1901:1:7c5::	5432	PostgreSQL
spotify.com	2600:1901:1:7c5::	8080	Ookla Speedtest (http)

spotify.com	2600:1901:1:7c5::	8080	Ookla Speedtest (http)
spotify.com	2600:1901:1:7c5::	8080	Ookla Speedtest (https)

spotify.com	2600:1901:1:7c5::	8080	Ookla Speedtest (https)
spotify.com	2600:1901:1:7c5::	8083	VestaCP http

spotify.com	2600:1901:1:7c5::	8083	VestaCP http
spotify.com	2600:1901:1:7c5::	8083	VestaCP https

spotify.com	2600:1901:1:7c5::	8083	VestaCP https
spotify.com	2600:1901:1:7c5::	8443	Plesk Administration (https)

spotify.com	2600:1901:1:7c5::	8443	Plesk Administration (https)
spotify.com	2600:1901:1:7c5::	8447	Plesk Installer + Updates

spotify.com	2600:1901:1:7c5::	8447	Plesk Installer + Updates
spotify.com	2600:1901:1:7c5::	8880	Plesk Administration (http)

spotify.com	2600:1901:1:7c5::	8880	Plesk Administration (http)
spotify.com	2600:1901:1:7c5::	10000	Webmin (http)

spotify.com	2600:1901:1:7c5::	10000	Webmin (http)
spotify.com	2600:1901:1:7c5::	10000	Webmin (https)

spotify.com	2600:1901:1:7c5::	10000	Webmin (https)
www.spotify.com	151.101.7.42	21	FTP

www.spotify.com	151.101.7.42	21	FTP
www.spotify.com	151.101.7.42	22	SSH

www.spotify.com	151.101.7.42	22	SSH
www.spotify.com	151.101.7.42	25	SMTP

www.spotify.com	151.101.7.42	25	SMTP
www.spotify.com	151.101.7.42	53	DNS

www.spotify.com	151.101.7.42	53	DNS
www.spotify.com	151.101.7.42	110	POP3

www.spotify.com	151.101.7.42	110	POP3
www.spotify.com	151.101.7.42	143	IMAP

www.spotify.com	151.101.7.42	143	IMAP
www.spotify.com	151.101.7.42	465	SMTP (encrypted)

www.spotify.com	151.101.7.42	465	SMTP (encrypted)
www.spotify.com	151.101.7.42	587	SMTP (encrypted, submission)

www.spotify.com	151.101.7.42	587	SMTP (encrypted, submission)
www.spotify.com	151.101.7.42	993	IMAP (encrypted)

www.spotify.com	151.101.7.42	993	IMAP (encrypted)
www.spotify.com	151.101.7.42	995	POP3 (encrypted)

www.spotify.com	151.101.7.42	995	POP3 (encrypted)
www.spotify.com	151.101.7.42	1433	MS SQL

www.spotify.com	151.101.7.42	1433	MS SQL
www.spotify.com	151.101.7.42	2082	cPanel (http)

www.spotify.com	151.101.7.42	2082	cPanel (http)
www.spotify.com	151.101.7.42	2083	cPanel (https)

www.spotify.com	151.101.7.42	2083	cPanel (https)
www.spotify.com	151.101.7.42	2086	WHM (http)

www.spotify.com	151.101.7.42	2086	WHM (http)
www.spotify.com	151.101.7.42	2087	WHM (https)

www.spotify.com	151.101.7.42	2087	WHM (https)
www.spotify.com	151.101.7.42	2089	cPanel Licensing

www.spotify.com	151.101.7.42	2089	cPanel Licensing
www.spotify.com	151.101.7.42	2095	cPanel Webmail (http)

www.spotify.com	151.101.7.42	2095	cPanel Webmail (http)
www.spotify.com	151.101.7.42	2096	cPanel Webmail (https)

www.spotify.com	151.101.7.42	2096	cPanel Webmail (https)
www.spotify.com	151.101.7.42	2222	DirectAdmin (http)

www.spotify.com	151.101.7.42	2222	DirectAdmin (http)
www.spotify.com	151.101.7.42	2222	DirectAdmin (https)

www.spotify.com	151.101.7.42	2222	DirectAdmin (https)
www.spotify.com	151.101.7.42	3306	mySql

www.spotify.com	151.101.7.42	3306	mySql
www.spotify.com	151.101.7.42	5224	Plesk Licensing

www.spotify.com	151.101.7.42	5224	Plesk Licensing
www.spotify.com	151.101.7.42	5432	PostgreSQL

www.spotify.com	151.101.7.42	5432	PostgreSQL
www.spotify.com	151.101.7.42	8080	Ookla Speedtest (http)

www.spotify.com	151.101.7.42	8080	Ookla Speedtest (http)
www.spotify.com	151.101.7.42	8080	Ookla Speedtest (https)

www.spotify.com	151.101.7.42	8080	Ookla Speedtest (https)
www.spotify.com	151.101.7.42	8083	VestaCP http

www.spotify.com	151.101.7.42	8083	VestaCP http
www.spotify.com	151.101.7.42	8083	VestaCP https

www.spotify.com	151.101.7.42	8083	VestaCP https
www.spotify.com	151.101.7.42	8443	Plesk Administration (https)

www.spotify.com	151.101.7.42	8443	Plesk Administration (https)
www.spotify.com	151.101.7.42	8447	Plesk Installer + Updates

www.spotify.com	151.101.7.42	8447	Plesk Installer + Updates
www.spotify.com	151.101.7.42	8880	Plesk Administration (http)

www.spotify.com	151.101.7.42	8880	Plesk Administration (http)
www.spotify.com	151.101.7.42	10000	Webmin (http)

www.spotify.com	151.101.7.42	10000	Webmin (http)
www.spotify.com	151.101.7.42	10000	Webmin (https)

www.spotify.com	151.101.7.42	10000	Webmin (https)
www.spotify.com	2a04:4e42:1::810	21	FTP

www.spotify.com	2a04:4e42:1::810	21	FTP
www.spotify.com	2a04:4e42:1::810	22	SSH

www.spotify.com	2a04:4e42:1::810	22	SSH
www.spotify.com	2a04:4e42:1::810	25	SMTP

www.spotify.com	2a04:4e42:1::810	25	SMTP
www.spotify.com	2a04:4e42:1::810	53	DNS

www.spotify.com	2a04:4e42:1::810	53	DNS
www.spotify.com	2a04:4e42:1::810	110	POP3

www.spotify.com	2a04:4e42:1::810	110	POP3
www.spotify.com	2a04:4e42:1::810	143	IMAP

www.spotify.com	2a04:4e42:1::810	143	IMAP
www.spotify.com	2a04:4e42:1::810	465	SMTP (encrypted)

www.spotify.com	2a04:4e42:1::810	465	SMTP (encrypted)
www.spotify.com	2a04:4e42:1::810	587	SMTP (encrypted, submission)

www.spotify.com	2a04:4e42:1::810	587	SMTP (encrypted, submission)
www.spotify.com	2a04:4e42:1::810	993	IMAP (encrypted)

www.spotify.com	2a04:4e42:1::810	993	IMAP (encrypted)
www.spotify.com	2a04:4e42:1::810	995	POP3 (encrypted)

www.spotify.com	2a04:4e42:1::810	995	POP3 (encrypted)
www.spotify.com	2a04:4e42:1::810	1433	MS SQL

www.spotify.com	2a04:4e42:1::810	1433	MS SQL
www.spotify.com	2a04:4e42:1::810	2082	cPanel (http)

www.spotify.com	2a04:4e42:1::810	2082	cPanel (http)
www.spotify.com	2a04:4e42:1::810	2083	cPanel (https)

www.spotify.com	2a04:4e42:1::810	2083	cPanel (https)
www.spotify.com	2a04:4e42:1::810	2086	WHM (http)

www.spotify.com	2a04:4e42:1::810	2086	WHM (http)
www.spotify.com	2a04:4e42:1::810	2087	WHM (https)

www.spotify.com	2a04:4e42:1::810	2087	WHM (https)
www.spotify.com	2a04:4e42:1::810	2089	cPanel Licensing

www.spotify.com	2a04:4e42:1::810	2089	cPanel Licensing
www.spotify.com	2a04:4e42:1::810	2095	cPanel Webmail (http)

www.spotify.com	2a04:4e42:1::810	2095	cPanel Webmail (http)
www.spotify.com	2a04:4e42:1::810	2096	cPanel Webmail (https)

www.spotify.com	2a04:4e42:1::810	2096	cPanel Webmail (https)
www.spotify.com	2a04:4e42:1::810	2222	DirectAdmin (http)

www.spotify.com	2a04:4e42:1::810	2222	DirectAdmin (http)
www.spotify.com	2a04:4e42:1::810	2222	DirectAdmin (https)

www.spotify.com	2a04:4e42:1::810	2222	DirectAdmin (https)
www.spotify.com	2a04:4e42:1::810	3306	mySql

www.spotify.com	2a04:4e42:1::810	3306	mySql
www.spotify.com	2a04:4e42:1::810	5224	Plesk Licensing

www.spotify.com	2a04:4e42:1::810	5224	Plesk Licensing
www.spotify.com	2a04:4e42:1::810	5432	PostgreSQL

www.spotify.com	2a04:4e42:1::810	5432	PostgreSQL
www.spotify.com	2a04:4e42:1::810	8080	Ookla Speedtest (http)

www.spotify.com	2a04:4e42:1::810	8080	Ookla Speedtest (http)
www.spotify.com	2a04:4e42:1::810	8080	Ookla Speedtest (https)

www.spotify.com	2a04:4e42:1::810	8080	Ookla Speedtest (https)
www.spotify.com	2a04:4e42:1::810	8083	VestaCP http

www.spotify.com	2a04:4e42:1::810	8083	VestaCP http
www.spotify.com	2a04:4e42:1::810	8083	VestaCP https

www.spotify.com	2a04:4e42:1::810	8083	VestaCP https
www.spotify.com	2a04:4e42:1::810	8443	Plesk Administration (https)	open
https://[2a04:4e42:1::810]:8443/ Http-Status: -103 SecureConnectionError (3, 0x80131620). The SSL connection could not be established, see inner exception. Unable to read data from the transport connection (FF: PR_CONNECT_RESET_ERROR)
www.spotify.com	2a04:4e42:1::810	8443	Plesk Administration (https)	open	https://[2a04:4e42:1::810]:8443/ Http-Status: -103 SecureConnectionError (3, 0x80131620). The SSL connection could not be established, see inner exception. Unable to read data from the transport connection (FF: PR_CONNECT_RESET_ERROR)
www.spotify.com	2a04:4e42:1::810	8447	Plesk Installer + Updates

www.spotify.com	2a04:4e42:1::810	8447	Plesk Installer + Updates
www.spotify.com	2a04:4e42:1::810	8880	Plesk Administration (http)

www.spotify.com	2a04:4e42:1::810	8880	Plesk Administration (http)
www.spotify.com	2a04:4e42:1::810	10000	Webmin (http)

www.spotify.com	2a04:4e42:1::810	10000	Webmin (http)
www.spotify.com	2a04:4e42:1::810	10000	Webmin (https)

www.spotify.com	2a04:4e42:1::810	10000	Webmin (https)

Permalink: https://check-your-website.server-daten.de/?i=207c1560-dc0e-430f-94ce-2b91c548e278

Last Result: https://check-your-website.server-daten.de/?q=spotify.com - 2026-06-13 08:37:51

Do you like this page? Support this tool, add a link on your page:

<a href="https://check-your-website.server-daten.de/?q=spotify.com" target="_blank">Check this Site: spotify.com</a>

Do you really want to support this project? Donate: Check-your-website, IBAN DE98 1001 0010 0575 2211 07, SWIFT/BIC PBNKDEFF, Euro

QR-Code of this page - https://check-your-website.server-daten.de/?d=spotify.com

Check DNS, Urls + Redirects, Certificates and Content of your Website

Older results

1. IP-Addresses

2. DNSSEC

3. Name Servers

4. SOA-Entries

5. Screenshots

Mobile- and other Chrome-Checks

6. Url-Checks

7. Comments

1. General Results, most used to calculate the result

2. Header-Checks

3. DNS- and NameServer - Checks

4. Content- and Performance-critical Checks

8. Connections

9. Certificates

10. Last Certificates - Certificate Transparency Log Check

1. Source CertSpotter - active certificates (one check per day)

2. Source crt.sh - old and new certificates, sometimes very slow - only certificates with "not after" > of the last months are listed

11. Html-Content - Entries

Summary

Details (currently limited to 500 rows - some problems with spam users)

12. Html-Parsing via https://validator.w3.org/nu/

Summary

Details

13. Nameserver - IP-Adresses

14. CAA - Entries

15. TXT - Entries

16. DomainService - Entries

17. Cipher Suites

18. Portchecks