avantiwestcoast.co.uk

HTML metadata

Title: Avanti West Coast | Buy Train Tickets | No Booking Fee
Description: Welcome to Avanti West Coast. Buy train tickets and find train times with no booking fees and rewards when you travel. Travel in style across the UK.
Language: en
Canonical: https://www.avantiwestcoast.co.uk

Technology

CDN: Amazon CloudFront
Server: Microsoft-IIS

Analytics

Google Tag Manager

Cookie consent

TrustArc

Third-party hosts loaded (6)

cdnjs.cloudflare.com×3
www.googletagmanager.com×2
consent.trustarc.com×1
consent.truste.com×1
js.adsrvr.org×1
se.monetate.net×1

Social

Contact

Address: st updated on 27 March 2026

Registration

Registrar

CSC Corporate Domains, Inc

Created

2018-06-05

Expires

2026-06-05 15 days left

Updated

2025-06-01

Name servers

udns1.cscdns.net.
udns2.cscdns.uk.

DNS records live

NS

udns1.cscdns.net
udns2.cscdns.uk

MX

10 eu-smtp-inbound-1.mimecast.com
10 eu-smtp-inbound-2.mimecast.com

TXT

Show 24 TXT records

41h6nbvbc4k13ysrcm9qw3c2bmd7kdbv
wc15bd0bqfk85sd2twfhtm8t02fpw2hf
tqvwnjmbjm3k4vy3k0pblx7b2qv89n53
_5ud8lxz97ehr5j7bl70dfv99b355mde
_5dj8yb7iyyrhc40yvsdy2oh1r1qfav2
_6pzr4zmkqhxpckztn4cdqbafa0dwqzo
_6jaq7p6l8w5a9uhdv4x8w4wu0hcl3x7
_bppqvxyl9o0jreowgi841d5mes1c93k
_qbt7rm8kju3vez43ia9153wzj3p0bqz
8cw6l9x2ptcs4pzwj8gg4bj33h6s6d5z
lb0wdkwrjrgd69p816zbbhqpn718wz3q
amazonses:tGNJ/9M61Npbp+IgTHfIHj88B5zwmMtbR7UiMYINPb4=
pd5cq6d09cztmh9s7gnj4zzlxgyg9872
amazonses:NlUeAg343hnqiBIrO1svo30/8DFxgNpxGsd0oYjYeMA=
p82sjh3mgkz2pqpc6qvx4nd49yjqs1qk
_gcqeqnkp8k01lf57bgmyx87e5sg4msn
bcy9hmtbv0j44xy1cpnhzdkmwc8ltgl1
_kgnaoql23z3f4xc614fdrn14k83q4a8
_4lgb7nthl6tjsl6h3girvgkczvx90yr
qmmb2pdq045xwf95mvl7lyrcsrrpl06q
_y5hval8ru9dpqkb4hi4rfyjv8t3959j
Validity-Domain-Verification=QAGg0zwVvh4pVFQ8oKkv1XEkErc=
_zxxuytsgcgdtixmo73nqs041vym4sgq
3wqswbnzvyqfrm2dm9rwvr7z1blmqy1j

Verified for

Apple
DocuSign
Google
Meta
Microsoft 365
OneTrust
Zoom

Email authentication strong

SPF

v=spf1 include:spf-002e6a03.pphosted.com include:eu._netblocks.mimecast.com include:amazonses.com include:spf.tractivity.co.uk ip4:129.35.117.23 ip4:129.35.117.24 ip4:198.37.159.2 ip4:168.245.16.120 -all

strict (-all)

DMARC

v=DMARC1;p=none;rua=mailto:easy664093@easydmarc.com;ruf=mailto:infosec@avantiwestcoast.co.uk;fo=0

policy: none (monitoring only)

DKIM

s1: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtInjJK7jx7D9Gf7S6a9Hcq//N2zDMC4yvnTKzODmS+bIFp0dx/kxK9cwCkEpxUlxuueb7uSEMbv8al5bCq…
s2: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDIzjjseXSfRf5gE7oxo10LHCko0Rhjyl/wnhtxqYzxYBuj2OAALhm+ThZpG/dgJvIwETG7OukSep4q6+OUzKxOwt…

selectors probed

Certificate (current)

Amazon RSA 2048 M04

from 2026-02-19 to 2026-09-05

Expires in 107 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 80/100 Checked live page: https://www.avantiwestcoast.co.uk/

present

strict-transport-security
content-security-policy
x-content-type-options
referrer-policy
permissions-policy

findings

CSP allows unsafe inline scripts/styles
CSP uses wildcard sources
missing frame protection

Header values

referrer-policy: strict-origin-when-cross-origin
permissions-policy: camera=(), microphone=(), geolocation=(), payment=()
x-content-type-options: nosniff
content-security-policy: script-src 'self' 'unsafe-eval' 'unsafe-inline' px.gumgum.com ads-engagement.presage.io px4.ads.linkedin.com *.qubit.com *.qubitproducts.com applepay.cdn-apple.com pay.google.com *.gbqofs.com static.goqubit.com *.cloudfront.net *.laiye.com ws.sessioncam.com console.sessioncam.com *.sojern.com ad.doubleclick.net *.google.com *.adsrvr.org *.twitter.com *.youtube.com *.instagram.com google.co.uk sessioncam.com daysoutguide.co.uk swrap.tradedoubler.com *.google-analytics.com *.consentric.io *.googletagmanager.com *.pcapredict.com *.yieldify.com *.trustarc.com *.truste.com *.facebook.net *.sub2tech.com *.scevent.min.js paperplaneslive.com *.usabilla.com *.klick2contact.com *.reciteme.com *.visualwebsiteoptimizer.com *.googleapis.com *.gstatic.com *.tiqcdn.com wctrainid.co.uk *.azurewebsites.net *.mindsay.com *.destygo.com github.com unpkg.com bat.bing.com *.paypal.com *.clarity.ms *.gbss.io *.tiktok.com *.mimecast.com *.adnxs.com *.prgloo.com *.monetate.net blis.com *.quantserve.com *.the-o
strict-transport-security: max-age=31536000; includeSubDomains; preload