The response sets session cookies that belong to mainstream web application frameworks, such as JSESSIONID, PHPSESSID or a generic session identifier. It shows that a real application with server side state is running behind the domain.
The questions every analyst asks before acting on this signal.
The response sets session cookies that belong to mainstream web application frameworks, such as JSESSIONID, PHPSESSID or a generic session identifier. It shows that a real application with server side state is running behind the domain.
Anti forgery cookies are part of a working application security design and are set by frameworks rather than by static or throwaway pages. Phishing kits almost never carry them, so a session cookie combined with an XSRF or CSRF cookie moves the domain further towards ordinary application behaviour.
No. It is a supporting safe signal about the application stack, not a verdict. It is read together with the other header labels, and it says nothing about the content the application serves.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "hardened_session_cookie_profile",
"name": "Standard Session Cookie Stack",
"group": "http_crawling_history",
"subgroup": "http_header_behaviors",
"direction": "safe",
"evidence": {
"missing_security_headers": 4,
"cors_origin": "*",
"cors_credentials_allowed": true,
"provider_type": "self_hosted",
"risky_cookie_count": 2
}
}12 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates the presence of baseline hardening signals such as standard security headers (e.g., HSTS, X-Content-Type-Op…
It indicates that the site sets cookies issued by specific edge protection providers whose cookies appear far more often…
It identifies who actually serves the domain: a CDN, a managed website platform, a free hosting platform, a security pro…
The response does not come from a real site but from a domain parking, for-sale or traffic monetization platform: a park…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
1,000 verdicts/month on the free tier, LLM layer included. No card required.