This domain is under defensive control by a security researcher. It was registered after Route 53 confirmed it had lapsed back to the registry, while still being referenced in the Content Security Policy of one or more production sites. The trust position is preserved — held safely — until the affected operators remove the reference.
If a site you operate <script src>'s, fetch'es, sets a CSP report-uri at,
or otherwise references www.sap-espresso.com, that reference now points at the researcher's server, not at the
service it was originally configured for. The fix is to remove the reference (or repoint it at infrastructure
you control) on every CSP and HTML template that lists it.
A small Go server that returns benign content per CSP directive class — JavaScript that prints a single console message, CSS with one no-op custom property, a transparent 1×1 PNG, an inert SVG, etc. No data is captured beyond the standard access-log line (timestamp, IP, host, path, status, headers); no exploitation is attempted against any third-party application; no traffic is forwarded anywhere.
pre-submissionIf you operate the affected origin (or this domain) and want the artifact removed or the trust position released, the HackerOne profile above accepts coordinated disclosure. The domain will be transferred, parked, or unbound at your direction.
No tracking. No third-party requests. View source — there is nothing else.