technology software

corporate business

documentation technical

corporate

English

_dd_s

_ga_C3ML9RZE0W

_gcl_au

Domain 'brego.io' uses the British Indian Ocean Territory country-code top-level domain (.io) with no subdomain. Its registrable label 'brego' stretches across 5 characters split between 2 vowels and 3 consonants. Breaking it apart gives two words: bre, go. Median word length comes out to 2.5 characters. No strong language cues emerged from the frequency lists.

html/28/53/2853e6b4-7b62-4e0f-baf3-77aba91fb483.html.gz

script-src 'unsafe-eval' 'self' 'unsafe-inline' https://www.google.com https://apis.google.com https://ssl.gstatic.com https://www.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://*.youtube.com https://*.google.com https://*.gstatic.com https://youtube.com https://www.youtube.com https://google.com https://*.doubleclick.net https://*.googleapis.com https://www.googleadservices.com https://tpc.googlesyndication.com https://www.youtubekids.com https://www.youtube-nocookie.com https://www.youtubeeducation.com https://www-onepick-opensocial.googleusercontent.com;report-uri https://csp.withgoogle.com/csp/youtube_main/allowlist
require-trusted-types-for 'script'

report-uri https://csp.withgoogle.com/csp/youtube_main/strict;base-uri 'self';object-src 'none';script-src 'report-sample' 'nonce-_FAOEBCKkBtlr7zFXeu5Eg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval'

script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:171:0

script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:139:0

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes

Introduction to Brego Video

99fd9df74fa1aad5214aafd3d01bdd072ca1e048eeb7619720e897a2b531990c

fe305c044c93b1c1a06fb3b120d5f76934773b076164222f473e03c794e3c1f1

eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

c05c500c3b5967233bfcd8684e9920a51a91aa352504bc9e31710770b7d0c833

6b362bb61c02a40ebd9b799c34edd94071dc4741582bf55ff33c056df5156d7b

12e2e81d4ee8d64b8248b299265c56316a52b75e5f959d1631c89662d4b2f485

3edbe217bce7cf846042bdbff609a51d77e46c9d3ba768a1705b49d049f6c5f0

cbfec9933a0cf2545fe669821f9f0d70652599928f965378ed305c000f45e977

ef09daad306c5cd55afe0a5b97ddd4e60be12be9ac4a66d86a21cd21e9959092

70a79a4146c94c75d4c9734f4df6fd84c0abd1fb9e88b37dbf5f53e07abe8f88

3a66de393c0261c2b0e76148b8442e7c9114321ae7701c91f7a1d8acc3242063

84b43703561ea51869270781d4d143ef57409e8ba70fc1e6a70add50369d2273

960c075079dd091c57e51c1f24908741ab44bc11278d210758f06989691c9c20

66f195c43678584a3940e6778d4b6a016caeee6b59d7c35b43e8355f9d88e0d4

49f9a6fe57f1a03ce4bd4d5bd348d4fbf0bb64bb2f7714bf52d547fa44be9015

02f0fbdc11143a8ddf5be120ef268a9fedb0f4eac8b04b078d9032068d9a9fd6

c8b0df3a3b3e27d29314b5a59c13f51e9cbc9670a0142709b5a7bc5a085888a5

405546af92a9e1ef2f35547c89f487a7f12457c8a420e73edce88f0a7af08755

fd5e947335062b7b1c0bdbe2a702c23b43746ffe04279553bd63cf13f8da9619

2814bd764346fed9ca5cf9212b3768370e1f40d4f21cdb7efd8fdac0a1a0ba39

7fe8e0bb929daf6111b6cc7a979b815a608f84dfd7d6bb8da431f6ca5d0fdd1b

e1ab1b0468219ba58fbbe349b3c1f63542472bd3b75b4773d067a58c552c29aa

701fe1d5e105047d750bf7c25281b081757e3eae37a10a5bd1433fb7d375ab7e

8f210524abd5bf81a631f263e70e03c081875d9b6eb7b62571fbdff578ce3bbf

8de182fbb3c6bfe255799126cb7fdcd55e302041dc49f60c1ff1c55685414111

a38c428eb0d501578bed9932ef3c4497a4f8acabe578ff4479f3c073129db14f

77d07c521849bbfb2768c171e4f1b6ac6de1b706572f24bb757ebef77589df61

c288d7b00f7173a311853e992dc15e806fc8bacaf32fb861745df6d9f6c99ab0

7503567ddaceefce51e0edcc53054f8d374851d6bd554ca1a8f18e487eba3bd0

765d26d525d388cae49838cd00fbe9afce262f763f3def60425a766077393844

06cba8676dc86709b4801ab33ecc4faa53835eda7617ce1af94dbf3d07efd22c

372beb921ab84a88dba9c1a4c1a17859731baf267d6ebd1264ba7082d0529f8d

A DoS vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.

Strongly consider upgrading to 15.5.10 and 16.1.5 to reduce risk and prevent availability issues in Next applications.

A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:

1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory.

2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.

Both attack vectors result in a fatal V8 out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.

To be affected, an application must run with `experimental.ppr: true` or `cacheComponents: true` configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.

Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.

A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23864](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg).

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.

eb31e5e01bdc60f933f3be4f0cdca5f38573c4d0c3b8f0f5b97fe618884fd182

55173cb0afae4091c96f973bb49763c1fa3eca48bc29759e0d501f392766adb9

fd73ce621c428d67687e761b8364accfd868ff819a0342437655a048def0d5f1

width=device-width, initial-scale=1, minimum-scale=1, shrink-to-fit=no

viewport

author

Brego - Vehicle Valuations, Analytics and Data powered by AI

twitter:title

Brego uses artificial intelligence to accurately predict automotive depreciation and ownership costs.

twitter:description

description

brego,artificial intelligence,machine learning,cars,automotive,finance,depreciation

https://www.brego.io/images/brego-cover.png

apple-mobile-web-app-capable

html/28/53/2853e6b4-7b62-4e0f-baf3-77aba91fb483_nodriver.html.gz

Brego Ltd

Gandi SAS

brego.io

Amazon EC2 Abuse

IP Management

Amazon AWS Network Operations

Amazon.com, Inc.

AWS RPKI Management POC

IP Routing

Amazon EC2 Network Operations

AMAZON-CF


              window.dataLayer = window.dataLayer || [];
              function gtag(){dataLayer.push(arguments);}
              gtag('js', new Date());
              gtag('config', 'G-C3ML9RZE0W', {
                page_path: window.location.pathname,
              });
          

Requests	IP Address	Location	AS Autonomous System
10	104.18.42.227	United States	AS13335Cloudflare, Inc.
9	13.43.5.75	City of London, England, United Kingdom	AS16509Amazon.com, Inc.
9	3.167.227.52	United States	AS16509Amazon.com, Inc.
9	142.250.186.35	United States	AS15169Google LLC
9	18.171.15.195	City of London, England, United Kingdom	AS16509Amazon.com, Inc.
9	92.205.229.143	Germany	AS21499Host Europe GmbH
9	142.251.141.106	United States	AS15169Google LLC
9	142.251.141.78	Unknown	Unknown
9	142.251.141.136	United States	AS15169Google LLC
82	9	-	-

Security Scan Report: brego.io

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History