vw-baev.de
HTML metadata
Technology
- CDN
- Amazon CloudFront
- Server
- AmazonS3
Third-party hosts loaded (3)
- files.versorgungswerke.website×20
- api.scrivito.com×2
- cdn0.scrvt.com×1
Contact
- Phone
Registration
- Updated
- 2018-08-17
- Name servers
-
- ns1055.ui-dns.biz.
- ns1055.ui-dns.com.
- ns1055.ui-dns.de.
- ns1055.ui-dns.org.
DNS records live
- NS
-
- ns1055.ui-dns.biz
- ns1055.ui-dns.com
- ns1055.ui-dns.de
- ns1055.ui-dns.org
- MX
-
- 10 mx.versorgungswerke-berlin.de
- TXT
-
swisssign-check=wBAY03DcPuy6nv_kyOocnlXxIqkc83fadf1618fe5e8c96eabd3fa5cc6
- Verified for
-
Email authentication weak
- SPF
-
v=spf1 mx include:spf.versorgungswerke-berlin.de -allstrict (-all) - DMARC
- not published
- DKIM
- no key found at common selectors
Certificate (current)
Sectigo Public Server Authentication CA DV R36
Expires in 143 days
HTTP security headers
- present
-
- strict-transport-security
- content-security-policy
- x-frame-options
- x-content-type-options
- referrer-policy
- findings
-
- CSP allows unsafe inline scripts/styles
- CSP uses wildcard sources
- missing Permissions Policy
Header values
- referrer-policy
strict-origin-when-cross-origin- x-frame-options
sameorigin- x-content-type-options
nosniff- content-security-policy
base-uri 'none'; default-src 'self' data: https: wss:; img-src 'self' data: https: blob:; style-src 'self' data: https: wss: 'unsafe-inline'; frame-src 'self' tel: https://reg.versorgungswerke-berlin.de https://player.vimeo.com/ https://www.youtube-nocookie.com/ https://*.infopark.io; script-src 'self' 'unsafe-eval' https://api.scrivito.com https://app.intercom.io https://assets.scrivito.com https://js.intercomcdn.com https://widget.intercom.io https://www.google-analytics.com https://*.infopark.io; object-src 'none'; block-all-mixed-content; frame-ancestors 'self' https://*.scrivito.com- strict-transport-security
max-age=63072000; includeSubDomains; preload