tivolicasino.dk
HTML metadata
Technology
- Stack
- ASP.NET
Third-party hosts loaded (4)
- tc-static.dk×6
- kundecrm.my.site.com×1
- nexus.ensighten.com×1
- operationsmessengerservices.azurewebsites.net×1
DNS records live
- NS
-
- a1-34.akam.net
- a10-64.akam.net
- a11-66.akam.net
- a12-67.akam.net
- a4-64.akam.net
- a5-67.akam.net
- MX
-
- 10 tivolicasino-dk.mail.protection.outlook.com
- TXT
-
Show 7 TXT records
_fjt7hnohoo69vqry41ny88uyj3frzs913ptr9wy3h5w8pht2jmqs2sc96jlk2sxcrg70x6bzdhy5vjkz94ksjhb18x1mrz1pyjm4hnltyysbn9cdgzvs35sr9rxqfx1d3kmvhtbh4mymry3qqnjlzn2d4vnrwp8v=spf1include:_spf.salesforce.cominclude:spf.protection.outlook.com-all2h34gkjdpr9vvfdzrx2k9zh0knplvkdf
- Verified for
-
- Microsoft 365
Email authentication weak
- SPF
-
v=spf1include:_spf.salesforce.cominclude:spf.protection.outlook.com-allmissing all - DMARC
- not published
- DKIM
- no key found at common selectors
Certificate (current)
R12
Expires in 22 days
HTTP security headers
- present
-
- strict-transport-security
- content-security-policy
- content-security-policy-report-only
- x-frame-options
- x-content-type-options
- findings
-
- CSP allows unsafe inline scripts/styles
- CSP uses wildcard sources
- missing Referrer Policy
- missing Permissions Policy
Header values
- x-frame-options
SAMEORIGIN- x-content-type-options
nosniff- content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://kundecrm.my.site.com https://kundecrm.my.salesforce.com; script-src-elem 'self' 'unsafe-inline' 'unsafe-eval' https://kundecrm.my.site.com https://kundecrm.my.salesforce.com https://service.force.com https://operationsmessengerservices.azurewebsites.net https://nexus.ensighten.com https://www.googletagmanager.com https://*.salesforceliveagent.com https://bs.serving-sys.com https://img.en25.com https://files.cdn.leadfamly.com https://*.snapchat.com https://app.varify.io https://*.clarity.ms https://*.hotjar.com https://sc-static.net https://connect.facebook.net https://collect.danskespil.dk https://tags.danskespil.dk; style-src * 'unsafe-inline'; style-src-elem * 'unsafe-inline'; font-src 'self' data: https://fonts.gstatic.com https://operationsmessengerservices.azurewebsites.net; img-src * data:; connect-src 'self' https://kundecrm.my.site.com https://kundecrm.my.salesforce-scrt.com https://kundecrm.secure.forc- strict-transport-security
max-age=31536000; includeSubDomains- content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' https://kundecrm.my.site.com https://kundecrm.my.salesforce.com; script-src-elem 'self' 'unsafe-inline' https://kundecrm.my.site.com https://kundecrm.my.salesforce.com https://service.force.com https://operationsmessengerservices.azurewebsites.net https://nexus.ensighten.com https://www.googletagmanager.com https://*.salesforceliveagent.com https://bs.serving-sys.com https://img.en25.com https://files.cdn.leadfamly.com https://*.snapchat.com https://app.varify.io https://*.clarity.ms https://*.hotjar.com https://sc-static.net https://connect.facebook.net https://collect.danskespil.dk https://tags.danskespil.dk; style-src * 'unsafe-inline'; style-src-elem * 'unsafe-inline'; font-src 'self' data: https://fonts.gstatic.com https://operationsmessengerservices.azurewebsites.net; img-src 'self' data: https://track.adform.net https://www.facebook.com https://s166423343.t.eloqua.com https://ad.doubleclick.net https://*.clarity.ms https://tc