URL: https://a1-signin-test.roche.com.cn/
Submission: On August 16 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 10 HTTP transactions. The main IP is 2606:4700::6812:2c1, located in United States and belongs to CLOUDFLARENET, US. The main domain is a1-signin-test.roche.com.cn.
TLS certificate: Issued by E6 on August 16th 2024. Valid for: 3 months.
This is the only time a1-signin-test.roche.com.cn was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 2606:4700::68... 13335 (CLOUDFLAR...)
10 2
Apex Domain
Subdomains
Transfer
3 roche.com.cn
a1-signin-test.roche.com.cn
325 KB
0 smarteventcloud.cn Failed
spkg.smarteventcloud.cn Failed
10 2
Domain Requested by
3 a1-signin-test.roche.com.cn a1-signin-test.roche.com.cn
0 spkg.smarteventcloud.cn Failed a1-signin-test.roche.com.cn
10 2

This site contains no links.

Subject Issuer Validity Valid
a1-signin-test.roche.com.cn
E6
2024-08-16 -
2024-11-14
3 months crt.sh

This page contains 1 frames:

Primary Page: https://a1-signin-test.roche.com.cn/
Frame ID: 360E8A189C5820D8E7FB3B121C26C261
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

iaccount

Page Statistics

10
Requests

30 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

325 kB
Transfer

1814 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
a1-signin-test.roche.com.cn/
972 B
5 KB
Document
General
Full URL
https://a1-signin-test.roche.com.cn/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:2c1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
43faac036dd4f4365fcb4cf2b28916b68d840a3684f167a5e5a5999d5778280a
Security Headers
Name Value
Content-Security-Policy object-src 'self'; report-uri https://ayba8dhs.uriports.com/reports/report; report-to default
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

cf-cache-status
DYNAMIC
cf-ray
8b4149c4bc299bb0-FRA
content-encoding
br
content-security-policy
object-src 'self'; report-uri https://ayba8dhs.uriports.com/reports/report; report-to default
content-security-policy-report-only
default-src 'self' *.roche.com *.roche.net *.gene.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.roche.com *.roche.net *.gene.com cdn.walkme.com apis.google.com tpc.googlesyndication.com api.html5media.info workdevapp.com cdn-js.net gdata.youtube.com twitter.com geolocation.onetrust.com api.flickr.com graph.facebook.com sharecdn.social9.com maps.googleapis.com use.typekit.com munchkin.marketo.net img.en25.com w.likebtn.com cdn.mathjax.org sadmin.brightcove.com cdnjs.cloudflare.com releases.flowplayer.org script.crazyegg.com wi.likebtn.com pepperglobal.com analytics.twitter.com cdn.blueconic.net connect.facebook.net fullstory.com script.hotjar.com gnntch.blueconic.net rules.quantcount.com secure.quantserve.com static.hotjar.com www.youtube.com www.googletagmanager.com www.google-analytics.com google-analytics.com *.gstatic.com static.ads-twitter.com sjs.bizographics.com *.linkedin.com www.google.com w.soundcloud.com s.ytimg.com *.cloudflareaccess.com *.salesforceliveagent.com https://*.roche.com:8080 https://cdnjs.org https://service.force.com/* cdn.cookielaw.org static.cloudflareinsights.com googleads.g.doubleclick.net 7232514.collect.igodigital.com; style-src * 'self' 'unsafe-inline'; img-src * 'self' data:; font-src * 'self' data:; connect-src * 'self'; media-src * 'self' data:; object-src 'self'; child-src 'self' *.roche.com *.roche.net *.gene.com *.facebook.net qpcr.probefinder.com *.force.com *.hotjar.com www.facebook.com www.google.com www.googletagmanager.com www.youtube.com; frame-src 'self' *.roche.com *.roche.net *.gene.com www.youtube.com sites.google.com *.cloudfront.net *.facebook.net *.arcot.com live.sagepay.com player.vimeo.com tpc.googlesyndication.com players.brightcove.net qpcr.probefinder.com *.eloqua.com *.hotjar.com *.soundcloud.com *.facebook.com *.google.com *.googletagmanager.com *.youtube-nocookie.com *.youtube.com *.mendeley.com *.force.com https://cdn.walkme.com/*; worker-src 'self' *.roche.com *.roche.net *.gene.com; frame-ancestors 'self' *.roche.com *.roche.net *.gene.com datastudio.google.com sites.google.com content.bioclinicien.fr connect.facebook.net www.facebook.com s1691.t.eloqua.com *.cloudflareworkers.com; form-action 'self' *.roche.com *.roche.net *.gene.com content.bioclinicien.fr connect.facebook.net www.facebook.com s1691.t.eloqua.com; base-uri 'self' *.roche.com *.roche.net *.gene.com *.secure.roche.com; report-uri https://ayba8dhs.uriports.com/reports/report; report-to default
content-type
text/html; charset=utf-8
date
Fri, 16 Aug 2024 12:04:40 GMT
expect-staple
max-age=3600; includeSubDomains
feature-policy-report-only
geolocation 'none'; camera 'none'; fullscreen *; payment 'self'
nel
{"report_to":"default","max_age":3600,"include_subdomains":true,"failure_fraction": 0.15}
referrer-policy
strict-origin-when-cross-origin
report-to
{"group":"default","max_age":3600,"endpoints":[{"url":"https://ayba8dhs.uriports.com/reports"}],"include_subdomains":true}
server
cloudflare
strict-transport-security
max-age=2592000; includeSubDomains
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
1; mode=block
vue.min.js
spkg.smarteventcloud.cn/vue/2.5.16/
0
0

vuex.min.js
spkg.smarteventcloud.cn/vuex/3.0.1/
0
0

vue-router.min.js
spkg.smarteventcloud.cn/vue-router/3.0.1/
0
0

style.css
spkg.smarteventcloud.cn/mint-ui/2.2.13/
0
0

index.js
spkg.smarteventcloud.cn/mint-ui/2.2.13/
0
0

axios.min.js
spkg.smarteventcloud.cn/axios/0.18.0/
0
0

qs.min.js
spkg.smarteventcloud.cn/qs/6.5.2/
0
0

main.js
a1-signin-test.roche.com.cn/dist/
2 MB
321 KB
Script
General
Full URL
https://a1-signin-test.roche.com.cn/dist/main.js?v=lNWqrCNc-NAIyrvfRde7IcLRCW5vrF33tSFbZJZafiw
Requested by
Host: a1-signin-test.roche.com.cn
URL: https://a1-signin-test.roche.com.cn/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:2c1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
94d5aaac235cf8d008cabbdf45d7bb21c2d1096e6fac5df7b5215b64965a7e2c
Security Headers
Name Value
Content-Security-Policy object-src 'self'; report-uri https://ayba8dhs.uriports.com/reports/report; report-to default
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://a1-signin-test.roche.com.cn/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 16 Aug 2024 12:04:40 GMT
strict-transport-security
max-age=2592000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"report_to":"default","max_age":3600,"include_subdomains":true,"failure_fraction": 0.15}
content-security-policy
object-src 'self'; report-uri https://ayba8dhs.uriports.com/reports/report; report-to default
content-encoding
br
content-security-policy-report-only
default-src 'self' *.roche.com *.roche.net *.gene.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.roche.com *.roche.net *.gene.com cdn.walkme.com apis.google.com tpc.googlesyndication.com api.html5media.info workdevapp.com cdn-js.net gdata.youtube.com twitter.com geolocation.onetrust.com api.flickr.com graph.facebook.com sharecdn.social9.com maps.googleapis.com use.typekit.com munchkin.marketo.net img.en25.com w.likebtn.com cdn.mathjax.org sadmin.brightcove.com cdnjs.cloudflare.com releases.flowplayer.org script.crazyegg.com wi.likebtn.com pepperglobal.com analytics.twitter.com cdn.blueconic.net connect.facebook.net fullstory.com script.hotjar.com gnntch.blueconic.net rules.quantcount.com secure.quantserve.com static.hotjar.com www.youtube.com www.googletagmanager.com www.google-analytics.com google-analytics.com *.gstatic.com static.ads-twitter.com sjs.bizographics.com *.linkedin.com www.google.com w.soundcloud.com s.ytimg.com *.cloudflareaccess.com *.salesforceliveagent.com https://*.roche.com:8080 https://cdnjs.org https://service.force.com/* cdn.cookielaw.org static.cloudflareinsights.com googleads.g.doubleclick.net 7232514.collect.igodigital.com; style-src * 'self' 'unsafe-inline'; img-src * 'self' data:; font-src * 'self' data:; connect-src * 'self'; media-src * 'self' data:; object-src 'self'; child-src 'self' *.roche.com *.roche.net *.gene.com *.facebook.net qpcr.probefinder.com *.force.com *.hotjar.com www.facebook.com www.google.com www.googletagmanager.com www.youtube.com; frame-src 'self' *.roche.com *.roche.net *.gene.com www.youtube.com sites.google.com *.cloudfront.net *.facebook.net *.arcot.com live.sagepay.com player.vimeo.com tpc.googlesyndication.com players.brightcove.net qpcr.probefinder.com *.eloqua.com *.hotjar.com *.soundcloud.com *.facebook.com *.google.com *.googletagmanager.com *.youtube-nocookie.com *.youtube.com *.mendeley.com *.force.com https://cdn.walkme.com/*; worker-src 'self' *.roche.com *.roche.net *.gene.com; frame-ancestors 'self' *.roche.com *.roche.net *.gene.com datastudio.google.com sites.google.com content.bioclinicien.fr connect.facebook.net www.facebook.com s1691.t.eloqua.com *.cloudflareworkers.com; form-action 'self' *.roche.com *.roche.net *.gene.com content.bioclinicien.fr connect.facebook.net www.facebook.com s1691.t.eloqua.com; base-uri 'self' *.roche.com *.roche.net *.gene.com *.secure.roche.com; report-uri https://ayba8dhs.uriports.com/reports/report; report-to default
feature-policy-report-only
geolocation 'none'; camera 'none'; fullscreen *; payment 'self'
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Sun, 08 Mar 2020 15:20:21 GMT
server
cloudflare
etag
W/"1d5f55d14e67ba4"
vary
Accept-Encoding
report-to
{"group":"default","max_age":3600,"endpoints":[{"url":"https://ayba8dhs.uriports.com/reports"}],"include_subdomains":true}
content-type
application/javascript
expect-staple
max-age=3600; includeSubDomains
cf-ray
8b4149c9da899bb0-FRA
favicon.ico
a1-signin-test.roche.com.cn/
0
96 B
Other
General
Full URL
https://a1-signin-test.roche.com.cn/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:2c1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy object-src 'self'; report-uri https://ayba8dhs.uriports.com/reports/report; report-to default
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://a1-signin-test.roche.com.cn/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 16 Aug 2024 12:04:41 GMT
strict-transport-security
max-age=2592000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"report_to":"default","max_age":3600,"include_subdomains":true,"failure_fraction": 0.15}
content-security-policy
object-src 'self'; report-uri https://ayba8dhs.uriports.com/reports/report; report-to default
age
1
content-security-policy-report-only
default-src 'self' *.roche.com *.roche.net *.gene.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.roche.com *.roche.net *.gene.com cdn.walkme.com apis.google.com tpc.googlesyndication.com api.html5media.info workdevapp.com cdn-js.net gdata.youtube.com twitter.com geolocation.onetrust.com api.flickr.com graph.facebook.com sharecdn.social9.com maps.googleapis.com use.typekit.com munchkin.marketo.net img.en25.com w.likebtn.com cdn.mathjax.org sadmin.brightcove.com cdnjs.cloudflare.com releases.flowplayer.org script.crazyegg.com wi.likebtn.com pepperglobal.com analytics.twitter.com cdn.blueconic.net connect.facebook.net fullstory.com script.hotjar.com gnntch.blueconic.net rules.quantcount.com secure.quantserve.com static.hotjar.com www.youtube.com www.googletagmanager.com www.google-analytics.com google-analytics.com *.gstatic.com static.ads-twitter.com sjs.bizographics.com *.linkedin.com www.google.com w.soundcloud.com s.ytimg.com *.cloudflareaccess.com *.salesforceliveagent.com https://*.roche.com:8080 https://cdnjs.org https://service.force.com/* cdn.cookielaw.org static.cloudflareinsights.com googleads.g.doubleclick.net 7232514.collect.igodigital.com; style-src * 'self' 'unsafe-inline'; img-src * 'self' data:; font-src * 'self' data:; connect-src * 'self'; media-src * 'self' data:; object-src 'self'; child-src 'self' *.roche.com *.roche.net *.gene.com *.facebook.net qpcr.probefinder.com *.force.com *.hotjar.com www.facebook.com www.google.com www.googletagmanager.com www.youtube.com; frame-src 'self' *.roche.com *.roche.net *.gene.com www.youtube.com sites.google.com *.cloudfront.net *.facebook.net *.arcot.com live.sagepay.com player.vimeo.com tpc.googlesyndication.com players.brightcove.net qpcr.probefinder.com *.eloqua.com *.hotjar.com *.soundcloud.com *.facebook.com *.google.com *.googletagmanager.com *.youtube-nocookie.com *.youtube.com *.mendeley.com *.force.com https://cdn.walkme.com/*; worker-src 'self' *.roche.com *.roche.net *.gene.com; frame-ancestors 'self' *.roche.com *.roche.net *.gene.com datastudio.google.com sites.google.com content.bioclinicien.fr connect.facebook.net www.facebook.com s1691.t.eloqua.com *.cloudflareworkers.com; form-action 'self' *.roche.com *.roche.net *.gene.com content.bioclinicien.fr connect.facebook.net www.facebook.com s1691.t.eloqua.com; base-uri 'self' *.roche.com *.roche.net *.gene.com *.secure.roche.com; report-uri https://ayba8dhs.uriports.com/reports/report; report-to default
feature-policy-report-only
geolocation 'none'; camera 'none'; fullscreen *; payment 'self'
content-length
0
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
vary
Accept-Encoding
report-to
{"group":"default","max_age":3600,"endpoints":[{"url":"https://ayba8dhs.uriports.com/reports"}],"include_subdomains":true}
expect-staple
max-age=3600; includeSubDomains
cf-ray
8b4149cdffad9bb0-FRA

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
spkg.smarteventcloud.cn
URL
https://spkg.smarteventcloud.cn/vue/2.5.16/vue.min.js
Domain
spkg.smarteventcloud.cn
URL
https://spkg.smarteventcloud.cn/vuex/3.0.1/vuex.min.js
Domain
spkg.smarteventcloud.cn
URL
https://spkg.smarteventcloud.cn/vue-router/3.0.1/vue-router.min.js
Domain
spkg.smarteventcloud.cn
URL
https://spkg.smarteventcloud.cn/mint-ui/2.2.13/style.css
Domain
spkg.smarteventcloud.cn
URL
https://spkg.smarteventcloud.cn/mint-ui/2.2.13/index.js
Domain
spkg.smarteventcloud.cn
URL
https://spkg.smarteventcloud.cn/axios/0.18.0/axios.min.js
Domain
spkg.smarteventcloud.cn
URL
https://spkg.smarteventcloud.cn/qs/6.5.2/qs.min.js

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| __core-js_shared__ object| core

4 Cookies

Domain/Path Name / Value
.roche.com.cn/ Name: Uris
Value: %7B%22Uris%22%3A%7B%22engine-api%22%3A%22https%3A%2F%2Fengine-api-dev.smarteventcloud.cn%22%2C%22gateway%22%3A%22https%3A%2F%2Fgateway-dev-k8s.smarteventcloud.cn%22%2C%22iaccount%22%3A%22https%3A%2F%2Fsignindev.smarteventcloud.cn%22%2C%22passport%22%3A%22https%3A%2F%2Fa1-passport-test.roche.com.cn%22%2C%22signalr%22%3A%22https%3A%2F%2Fsignalr-dev.smartmice.cn%22%2C%22smartalipay%22%3A%22https%3A%2F%2Fsmartalipay-dev.smarteventcloud.cn%22%2C%22sso-roche%22%3A%22https%3A%2F%2Fb2bqa.roche.com%2Fidp%2FstartSSO.ping%3FPartnerSpId%3Dhttps%3A%2F%2Fsignindev.smarteventcloud.cn%2Fsaml%22%2C%22sso-roche-logout%22%3A%22https%3A%2F%2Fb2bqa.roche.com%2Fsiteminderagent%2Fforms%2Flogoff.fcc%3FTARGET%3Dhttps%3A%2F%2Fb2bqa.roche.com%2Fidp%2FstartSSO.ping%3FPartnerSpId%3Dhttps%3A%2F%2Fsignindev.smarteventcloud.cn%2Fsaml%22%2C%22webapp-iaccount%22%3A%22https%3A%2F%2Fiaccount-webapp-dev.smarteventcloud.cn%22%2C%22webapp-icar%22%3A%22https%3A%2F%2Ficar-webapp-dev.smarteventcloud.cn%22%2C%22webapp-idelegate%22%3A%22http%3A%2F%2Fidelegate-webapp-dev.smarteventcloud.cn%22%2C%22webapp-ievent%22%3A%22https%3A%2F%2Fievent-webapp-dev.smarteventcloud.cn%22%2C%22webapp-ihelper%22%3A%22https%3A%2F%2Fihelper-webapp-dev.smarteventcloud.cn%22%2C%22webapp-ijob%22%3A%22https%3A%2F%2Fijob-webapp-dev.smarteventcloud.cn%22%2C%22webapp-imaterial%22%3A%22http%3A%2F%2Fmaterial.resource.dev.smartxcloud.cn%22%2C%22webapp-imeal%22%3A%22https%3A%2F%2Fimeal-webapp-dev.smarteventcloud.cn%22%2C%22webapp-imyprofile%22%3A%22https%3A%2F%2Fimyprofile-webapp-dev.smarteventcloud.cn%22%2C%22webapp-ipay%22%3A%22http%3A%2F%2Fipay-dev.smarteventcloud.cn%22%2C%22webapp-ishop%22%3A%22http%3A%2F%2Fishop.dev.c.smarteventcloud.cn%22%2C%22webapp-ivenue%22%3A%22https%3A%2F%2Fivenue-webapp-dev.smarteventcloud.cn%22%2C%22webapp-iwaimai%22%3A%22https%3A%2F%2Fiwaimai-webapp-dev.smarteventcloud.cn%22%2C%22webapp-mshop%22%3A%22https%3A%2F%2Fmshop-webapp-dev.smarteventcloud.cn%22%2C%22webapp-qshop%22%3A%22http%3A%2F%2Fqshop-webapp-dev.smarteventcloud.cn%22%2C%22webpart-ievent%22%3A%22https%3A%2F%2Fievent-webpart-dev.smarteventcloud.cn%22%2C%22webpart-isurvey%22%3A%22https%3A%2F%2Fisurvey-dev.smarteventcloud.cn%22%7D%7D
.roche.com.cn/ Name: __cf_bm
Value: iG_S5kDfGW13U_j0mOgfmVm4IMyhCZ2U6RhEYZm0L04-1723809880-1.0.1.1-rRkDfSHaJq.5huWLtOTbi4R1XkahXE2NFD4.fFcSFf3AG0EkcAOKVNaghzfd38oSEM1cBRQrBWlyacdQc3wz2g
.roche.com.cn/ Name: __cfruid
Value: 8e3b5c8fb616faf9a641d27ec5341ed11eaa4836-1723809880
.roche.com.cn/ Name: _cfuvid
Value: CeyKmLSHKwjByBryuwYdBAEZxuQBsyu3pS0t2Z3Ax7c-1723809880549-0.0.1.1-604800000

14 Console Messages

Source Level URL
Text
network error URL: https://spkg.smarteventcloud.cn/mint-ui/2.2.13/style.css
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://spkg.smarteventcloud.cn/vue/2.5.16/vue.min.js
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
security error URL: https://a1-signin-test.roche.com.cn/
Message:
[Report Only] Refused to load the script 'https://spkg.smarteventcloud.cn/vue/2.5.16/vue.min.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' *.roche.com *.roche.net *.gene.com cdn.walkme.com apis.google.com tpc.googlesyndication.com api.html5media.info workdevapp.com cdn-js.net gdata.youtube.com twitter.com geolocation.onetrust.com api.flickr.com graph.facebook.com sharecdn.social9.com maps.googleapis.com use.typekit.com munchkin.marketo.net img.en25.com w.likebtn.com cdn.mathjax.org sadmin.brightcove.com cdnjs.cloudflare.com releases.flowplayer.org script.crazyegg.com wi.likebtn.com pepperglobal.com analytics.twitter.com cdn.blueconic.net connect.facebook.net fullstory.com script.hotjar.com gnntch.blueconic.net rules.quantcount.com secure.quantserve.com static.hotjar.com www.youtube.com www.googletagmanager.com www.google-analytics.com google-analytics.com *.gstatic.com static.ads-twitter.com sjs.bizographics.com *.linkedin.com www.google.com w.soundcloud.com s.ytimg.com *.cloudflareaccess.com *.salesforceliveagent.com https://*.roche.com:8080 https://cdnjs.org https://service.force.com/* cdn.cookielaw.org static.cloudflareinsights.com googleads.g.doubleclick.net 7232514.collect.igodigital.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security error URL: https://a1-signin-test.roche.com.cn/
Message:
[Report Only] Refused to load the script 'https://spkg.smarteventcloud.cn/vuex/3.0.1/vuex.min.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' *.roche.com *.roche.net *.gene.com cdn.walkme.com apis.google.com tpc.googlesyndication.com api.html5media.info workdevapp.com cdn-js.net gdata.youtube.com twitter.com geolocation.onetrust.com api.flickr.com graph.facebook.com sharecdn.social9.com maps.googleapis.com use.typekit.com munchkin.marketo.net img.en25.com w.likebtn.com cdn.mathjax.org sadmin.brightcove.com cdnjs.cloudflare.com releases.flowplayer.org script.crazyegg.com wi.likebtn.com pepperglobal.com analytics.twitter.com cdn.blueconic.net connect.facebook.net fullstory.com script.hotjar.com gnntch.blueconic.net rules.quantcount.com secure.quantserve.com static.hotjar.com www.youtube.com www.googletagmanager.com www.google-analytics.com google-analytics.com *.gstatic.com static.ads-twitter.com sjs.bizographics.com *.linkedin.com www.google.com w.soundcloud.com s.ytimg.com *.cloudflareaccess.com *.salesforceliveagent.com https://*.roche.com:8080 https://cdnjs.org https://service.force.com/* cdn.cookielaw.org static.cloudflareinsights.com googleads.g.doubleclick.net 7232514.collect.igodigital.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
network error URL: https://spkg.smarteventcloud.cn/vuex/3.0.1/vuex.min.js
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://spkg.smarteventcloud.cn/vue-router/3.0.1/vue-router.min.js
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://spkg.smarteventcloud.cn/mint-ui/2.2.13/index.js
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://spkg.smarteventcloud.cn/axios/0.18.0/axios.min.js
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://spkg.smarteventcloud.cn/qs/6.5.2/qs.min.js
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
security error URL: https://a1-signin-test.roche.com.cn/
Message:
[Report Only] Refused to load the script 'https://spkg.smarteventcloud.cn/vue-router/3.0.1/vue-router.min.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' *.roche.com *.roche.net *.gene.com cdn.walkme.com apis.google.com tpc.googlesyndication.com api.html5media.info workdevapp.com cdn-js.net gdata.youtube.com twitter.com geolocation.onetrust.com api.flickr.com graph.facebook.com sharecdn.social9.com maps.googleapis.com use.typekit.com munchkin.marketo.net img.en25.com w.likebtn.com cdn.mathjax.org sadmin.brightcove.com cdnjs.cloudflare.com releases.flowplayer.org script.crazyegg.com wi.likebtn.com pepperglobal.com analytics.twitter.com cdn.blueconic.net connect.facebook.net fullstory.com script.hotjar.com gnntch.blueconic.net rules.quantcount.com secure.quantserve.com static.hotjar.com www.youtube.com www.googletagmanager.com www.google-analytics.com google-analytics.com *.gstatic.com static.ads-twitter.com sjs.bizographics.com *.linkedin.com www.google.com w.soundcloud.com s.ytimg.com *.cloudflareaccess.com *.salesforceliveagent.com https://*.roche.com:8080 https://cdnjs.org https://service.force.com/* cdn.cookielaw.org static.cloudflareinsights.com googleads.g.doubleclick.net 7232514.collect.igodigital.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security error URL: https://a1-signin-test.roche.com.cn/
Message:
[Report Only] Refused to load the script 'https://spkg.smarteventcloud.cn/mint-ui/2.2.13/index.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' *.roche.com *.roche.net *.gene.com cdn.walkme.com apis.google.com tpc.googlesyndication.com api.html5media.info workdevapp.com cdn-js.net gdata.youtube.com twitter.com geolocation.onetrust.com api.flickr.com graph.facebook.com sharecdn.social9.com maps.googleapis.com use.typekit.com munchkin.marketo.net img.en25.com w.likebtn.com cdn.mathjax.org sadmin.brightcove.com cdnjs.cloudflare.com releases.flowplayer.org script.crazyegg.com wi.likebtn.com pepperglobal.com analytics.twitter.com cdn.blueconic.net connect.facebook.net fullstory.com script.hotjar.com gnntch.blueconic.net rules.quantcount.com secure.quantserve.com static.hotjar.com www.youtube.com www.googletagmanager.com www.google-analytics.com google-analytics.com *.gstatic.com static.ads-twitter.com sjs.bizographics.com *.linkedin.com www.google.com w.soundcloud.com s.ytimg.com *.cloudflareaccess.com *.salesforceliveagent.com https://*.roche.com:8080 https://cdnjs.org https://service.force.com/* cdn.cookielaw.org static.cloudflareinsights.com googleads.g.doubleclick.net 7232514.collect.igodigital.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security error URL: https://a1-signin-test.roche.com.cn/
Message:
[Report Only] Refused to load the script 'https://spkg.smarteventcloud.cn/axios/0.18.0/axios.min.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' *.roche.com *.roche.net *.gene.com cdn.walkme.com apis.google.com tpc.googlesyndication.com api.html5media.info workdevapp.com cdn-js.net gdata.youtube.com twitter.com geolocation.onetrust.com api.flickr.com graph.facebook.com sharecdn.social9.com maps.googleapis.com use.typekit.com munchkin.marketo.net img.en25.com w.likebtn.com cdn.mathjax.org sadmin.brightcove.com cdnjs.cloudflare.com releases.flowplayer.org script.crazyegg.com wi.likebtn.com pepperglobal.com analytics.twitter.com cdn.blueconic.net connect.facebook.net fullstory.com script.hotjar.com gnntch.blueconic.net rules.quantcount.com secure.quantserve.com static.hotjar.com www.youtube.com www.googletagmanager.com www.google-analytics.com google-analytics.com *.gstatic.com static.ads-twitter.com sjs.bizographics.com *.linkedin.com www.google.com w.soundcloud.com s.ytimg.com *.cloudflareaccess.com *.salesforceliveagent.com https://*.roche.com:8080 https://cdnjs.org https://service.force.com/* cdn.cookielaw.org static.cloudflareinsights.com googleads.g.doubleclick.net 7232514.collect.igodigital.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security error URL: https://a1-signin-test.roche.com.cn/
Message:
[Report Only] Refused to load the script 'https://spkg.smarteventcloud.cn/qs/6.5.2/qs.min.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' *.roche.com *.roche.net *.gene.com cdn.walkme.com apis.google.com tpc.googlesyndication.com api.html5media.info workdevapp.com cdn-js.net gdata.youtube.com twitter.com geolocation.onetrust.com api.flickr.com graph.facebook.com sharecdn.social9.com maps.googleapis.com use.typekit.com munchkin.marketo.net img.en25.com w.likebtn.com cdn.mathjax.org sadmin.brightcove.com cdnjs.cloudflare.com releases.flowplayer.org script.crazyegg.com wi.likebtn.com pepperglobal.com analytics.twitter.com cdn.blueconic.net connect.facebook.net fullstory.com script.hotjar.com gnntch.blueconic.net rules.quantcount.com secure.quantserve.com static.hotjar.com www.youtube.com www.googletagmanager.com www.google-analytics.com google-analytics.com *.gstatic.com static.ads-twitter.com sjs.bizographics.com *.linkedin.com www.google.com w.soundcloud.com s.ytimg.com *.cloudflareaccess.com *.salesforceliveagent.com https://*.roche.com:8080 https://cdnjs.org https://service.force.com/* cdn.cookielaw.org static.cloudflareinsights.com googleads.g.doubleclick.net 7232514.collect.igodigital.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
network error URL: https://a1-signin-test.roche.com.cn/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy object-src 'self'; report-uri https://ayba8dhs.uriports.com/reports/report; report-to default
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block