urlscan.io logo urlscan.io
SecurityTrails logo

expense.serko.com Open in urlscan Pro
20.53.227.94  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://expense.serko.com/web2
Effective URL: https://expense.serko.com/web2/site/home/default.asp
Submission Tags: falconsandbox
Submission: On September 10 via api from US — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 15 HTTP transactions. The main IP is 20.53.227.94, located in Sydney, Australia and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is expense.serko.com.
TLS certificate: Issued by GeoTrust TLS RSA CA G1 on May 21st 2024. Valid for: a year.
This is the only time expense.serko.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 17 20.53.227.94 8075 (MICROSOFT...)
15 1
Apex Domain
Subdomains		 Transfer
17 serko.com
expense.serko.com
201 KB
15 1
Domain Requested by
17 expense.serko.com 2 redirects expense.serko.com
15 1

This site contains links to these domains. Also see Links.

Domain
www.zeno.com
Subject Issuer Validity Valid
expense.serko.com
GeoTrust TLS RSA CA G1		 2024-05-21 -
2025-05-20		 a year crt.sh

This page contains 2 frames:

Primary Page: https://expense.serko.com/web2/site/home/default.asp
Frame ID: B5386C62CD089E97B782E03074BD7FE3
Requests: 8 HTTP requests in this frame

Frame: https://expense.serko.com/web2/site/home/logon_window.asp
Frame ID: 8B08B214E3079F682100FE5E684A58C8
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://expense.serko.com/web2 HTTP 301
    https://expense.serko.com/web2/ HTTP 302
    https://expense.serko.com/web2/site/home/default.asp Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.aspx?(?:$|\?)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

196 kB
Transfer

247 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://expense.serko.com/web2 HTTP 301
    https://expense.serko.com/web2/ HTTP 302
    https://expense.serko.com/web2/site/home/default.asp Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request default.asp
expense.serko.com/web2/site/home/
Redirect Chain
  • https://expense.serko.com/web2
  • https://expense.serko.com/web2/
  • https://expense.serko.com/web2/site/home/default.asp
2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://expense.serko.com/web2/site/home/default.asp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.53.227.94 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5f8742fba2dc7bedd9163cf0bb62aea2255f803adaf27fd19b321a77386d882e
Security Headers
Name Value
Content-Security-Policy connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Cache-Control
private
Connection
keep-alive
Content-Encoding
gzip
Content-Length
938
Content-Security-Policy
connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Content-Type
text/html
Date
Tue, 10 Sep 2024 19:22:09 GMT
Referrer-Policy
same-origin
Serko-Identity
INCHARGESYDWEB6
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-Robots-Tag
noindex, noarchive, nosnippet, noimageindex, noodp, nofollow
X-Xss-Protection
1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;

Redirect headers

Cache-Control
private
Connection
keep-alive
Content-Length
142
Content-Security-Policy
connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Content-Type
text/html
Date
Tue, 10 Sep 2024 19:22:09 GMT
Location
site/home/default.asp
Referrer-Policy
same-origin
Serko-Identity
INCHARGESYDWEB7
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
X-Robots-Tag
noindex, noarchive, nosnippet, noimageindex, noodp, nofollow
X-Xss-Protection
1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;
serkoincharge.css
expense.serko.com/web2/site/home/ 		3 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://expense.serko.com/web2/site/home/serkoincharge.css?t=19329.62
Requested by
Host: expense.serko.com
URL: https://expense.serko.com/web2/site/home/default.asp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.53.227.94 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
6f5e393aae8cc9a1ca342aa8e5f7c8d02282609d2438bb827f3f09a20b9811e4
Security Headers
Name Value
Content-Security-Policy connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;

Request headers

Referer
https://expense.serko.com/web2/site/home/default.asp
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Tue, 10 Sep 2024 19:22:09 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Serko-Identity
INCHARGESYDWEB5
Connection
keep-alive
Content-Length
1242
X-Xss-Protection
1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;
Referrer-Policy
same-origin
Last-Modified
Tue, 10 Sep 2024 10:00:41 GMT
ETag
"6bf0a24b683db1:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
X-Robots-Tag
noindex, noarchive, nosnippet, noimageindex, noodp, nofollow
shutterstock_79247383.jpg
expense.serko.com/web2/site/home/ 		74 KB
77 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://expense.serko.com/web2/site/home/shutterstock_79247383.jpg
Requested by
Host: expense.serko.com
URL: https://expense.serko.com/web2/site/home/default.asp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.53.227.94 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2d32dc621b91d825ab444cb81989c4853d3f8105504e2523977734a8eedf9219
Security Headers
Name Value
Content-Security-Policy connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;

Request headers

Referer
https://expense.serko.com/web2/site/home/default.asp
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Tue, 10 Sep 2024 19:22:09 GMT
Content-Security-Policy
connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
X-Content-Type-Options
nosniff
Referrer-Policy
same-origin
Last-Modified
Tue, 10 Sep 2024 10:00:41 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
ETag
"6bf0a24b683db1:0"
Content-Type
image/jpeg
Serko-Identity
INCHARGESYDWEB7
Connection
keep-alive
Accept-Ranges
bytes
X-Robots-Tag
noindex, noarchive, nosnippet, noimageindex, noodp, nofollow
Content-Length
76047
X-Xss-Protection
1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;
Serko_Logo_Horizontal_Colour.png
expense.serko.com/web2/site/home/ 		22 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://expense.serko.com/web2/site/home/Serko_Logo_Horizontal_Colour.png
Requested by
Host: expense.serko.com
URL: https://expense.serko.com/web2/site/home/default.asp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.53.227.94 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
3e15a735f202937e78eae78df39502d817ccb45b0b3cb91f55d28f757efc543e
Security Headers
Name Value
Content-Security-Policy connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;

Request headers

Referer
https://expense.serko.com/web2/site/home/default.asp
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Tue, 10 Sep 2024 19:22:09 GMT
Content-Security-Policy
connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
X-Content-Type-Options
nosniff
Referrer-Policy
same-origin
Last-Modified
Tue, 10 Sep 2024 10:00:41 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
ETag
"4e8f884b683db1:0"
Content-Type
image/png
Serko-Identity
INCHARGESYDWEB6
Connection
keep-alive
Accept-Ranges
bytes
X-Robots-Tag
noindex, noarchive, nosnippet, noimageindex, noodp, nofollow
Content-Length
22200
X-Xss-Protection
1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;
zeno_logo_b.png
expense.serko.com/web2/site/home/images/ 		11 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://expense.serko.com/web2/site/home/images/zeno_logo_b.png
Requested by
Host: expense.serko.com
URL: https://expense.serko.com/web2/site/home/default.asp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.53.227.94 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
d7daf2e654eb6d0346ce9e9828c39a7a21d42bc7ce841f3c99723c62bb3fe232
Security Headers
Name Value
Content-Security-Policy connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;

Request headers

Referer
https://expense.serko.com/web2/site/home/default.asp
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Tue, 10 Sep 2024 19:22:09 GMT
Content-Security-Policy
connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
X-Content-Type-Options
nosniff
Referrer-Policy
same-origin
Last-Modified
Tue, 10 Sep 2024 10:00:41 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
ETag
"a578a04b683db1:0"
Content-Type
image/png
Serko-Identity
INCHARGESYDWEB7
Connection
keep-alive
Accept-Ranges
bytes
X-Robots-Tag
noindex, noarchive, nosnippet, noimageindex, noodp, nofollow
Content-Length
11718
X-Xss-Protection
1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;
base.css
expense.serko.com/web2/site/css/ 		2 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://expense.serko.com/web2/site/css/base.css?v=1.0.1
Requested by
Host: expense.serko.com
URL: https://expense.serko.com/web2/site/home/serkoincharge.css?t=19329.62
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.53.227.94 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
69299fdad9141ae80b43861e357a6cc086485b443ba280de21c40e4b4aff2a9b
Security Headers
Name Value
Content-Security-Policy connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;

Request headers

Referer
https://expense.serko.com/web2/site/home/serkoincharge.css?t=19329.62
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Tue, 10 Sep 2024 19:22:09 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Serko-Identity
INCHARGESYDWEB5
Connection
keep-alive
Content-Length
709
X-Xss-Protection
1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;
Referrer-Policy
same-origin
Last-Modified
Tue, 10 Sep 2024 10:00:41 GMT
ETag
"95ca834b683db1:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
X-Robots-Tag
noindex, noarchive, nosnippet, noimageindex, noodp, nofollow
colors.css
expense.serko.com/web2/site/css/ 		2 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://expense.serko.com/web2/site/css/colors.css?v=1.0.1
Requested by
Host: expense.serko.com
URL: https://expense.serko.com/web2/site/css/base.css?v=1.0.1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.53.227.94 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5ef4605590a78008da1c3548cc2c601895c20ab71ea9d1f479530bbbd6bd7058
Security Headers
Name Value
Content-Security-Policy connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;

Request headers

Referer
https://expense.serko.com/web2/site/css/base.css?v=1.0.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Tue, 10 Sep 2024 19:22:09 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Serko-Identity
INCHARGESYDWEB6
Connection
keep-alive
Content-Length
802
X-Xss-Protection
1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;
Referrer-Policy
same-origin
Last-Modified
Tue, 10 Sep 2024 10:00:41 GMT
ETag
"95ca834b683db1:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
X-Robots-Tag
noindex, noarchive, nosnippet, noimageindex, noodp, nofollow
logon_window.asp
expense.serko.com/web2/site/home/ Frame 8B08 		15 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://expense.serko.com/web2/site/home/logon_window.asp
Requested by
Host: expense.serko.com
URL: https://expense.serko.com/web2/site/home/default.asp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.53.227.94 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
bb270ccc4ec6d13791e5c1333e43fceabd65983a0ef418539bdcde60ea7231aa
Security Headers
Name Value
Content-Security-Policy connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;

Request headers

Referer
https://expense.serko.com/web2/site/home/default.asp
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Cache-Control
private
Connection
keep-alive
Content-Encoding
gzip
Content-Length
4686
Content-Security-Policy
connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Content-Type
text/html; Charset=UTF-8
Date
Tue, 10 Sep 2024 19:22:09 GMT
Referrer-Policy
same-origin
Serko-Identity
INCHARGESYDWEB5
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-Robots-Tag
noindex, noarchive, nosnippet, noimageindex, noodp, nofollow
X-Xss-Protection
1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;
jquery-3.6.0.min__jquery-migrate-3.3.2.min.js
expense.serko.com/web2/site/home/lib/jquery/ Frame 8B08 		98 KB
46 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://expense.serko.com/web2/site/home/lib/jquery/jquery-3.6.0.min__jquery-migrate-3.3.2.min.js
Requested by
Host: expense.serko.com
URL: https://expense.serko.com/web2/site/home/logon_window.asp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.53.227.94 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
b8e3eba931d019e86075979a3c545a60b09a77ea3219df7aadd35f69aae8a2d0
Security Headers
Name Value
Content-Security-Policy connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;

Request headers

Referer
https://expense.serko.com/web2/site/home/logon_window.asp
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Tue, 10 Sep 2024 19:22:09 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Serko-Identity
INCHARGESYDWEB6
Connection
keep-alive
Content-Length
44323
X-Xss-Protection
1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;
Referrer-Policy
same-origin
Last-Modified
Tue, 10 Sep 2024 10:00:41 GMT
ETag
"6bf0a24b683db1:0"
Vary
Accept-Encoding
Content-Type
application/javascript
Accept-Ranges
bytes
X-Robots-Tag
noindex, noarchive, nosnippet, noimageindex, noodp, nofollow
colors.css
expense.serko.com/web2/site/css/ Frame 8B08 		2 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://expense.serko.com/web2/site/css/colors.css?t=19329.67
Requested by
Host: expense.serko.com
URL: https://expense.serko.com/web2/site/home/logon_window.asp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.53.227.94 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5ef4605590a78008da1c3548cc2c601895c20ab71ea9d1f479530bbbd6bd7058
Security Headers
Name Value
Content-Security-Policy connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;

Request headers

Referer
https://expense.serko.com/web2/site/home/logon_window.asp
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Tue, 10 Sep 2024 19:22:09 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Serko-Identity
INCHARGESYDWEB5
Connection
keep-alive
Content-Length
802
X-Xss-Protection
1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;
Referrer-Policy
same-origin
Last-Modified
Tue, 10 Sep 2024 10:00:41 GMT
ETag
"95ca834b683db1:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
X-Robots-Tag
noindex, noarchive, nosnippet, noimageindex, noodp, nofollow
base.css
expense.serko.com/web2/site/css/ Frame 8B08 		2 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://expense.serko.com/web2/site/css/base.css?t=19329.67
Requested by
Host: expense.serko.com
URL: https://expense.serko.com/web2/site/home/logon_window.asp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.53.227.94 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
69299fdad9141ae80b43861e357a6cc086485b443ba280de21c40e4b4aff2a9b
Security Headers
Name Value
Content-Security-Policy connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;

Request headers

Referer
https://expense.serko.com/web2/site/home/logon_window.asp
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Tue, 10 Sep 2024 19:22:09 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Serko-Identity
INCHARGESYDWEB7
Connection
keep-alive
Content-Length
709
X-Xss-Protection
1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;
Referrer-Policy
same-origin
Last-Modified
Tue, 10 Sep 2024 10:00:41 GMT
ETag
"95ca834b683db1:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
X-Robots-Tag
noindex, noarchive, nosnippet, noimageindex, noodp, nofollow
serkoincharge.css
expense.serko.com/web2/site/home/ Frame 8B08 		3 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://expense.serko.com/web2/site/home/serkoincharge.css?t=19329.67
Requested by
Host: expense.serko.com
URL: https://expense.serko.com/web2/site/home/logon_window.asp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.53.227.94 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
6f5e393aae8cc9a1ca342aa8e5f7c8d02282609d2438bb827f3f09a20b9811e4
Security Headers
Name Value
Content-Security-Policy connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;

Request headers

Referer
https://expense.serko.com/web2/site/home/logon_window.asp
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Tue, 10 Sep 2024 19:22:09 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Serko-Identity
INCHARGESYDWEB7
Connection
keep-alive
Content-Length
1242
X-Xss-Protection
1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;
Referrer-Policy
same-origin
Last-Modified
Tue, 10 Sep 2024 10:00:41 GMT
ETag
"6bf0a24b683db1:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
X-Robots-Tag
noindex, noarchive, nosnippet, noimageindex, noodp, nofollow
colors.css
expense.serko.com/web2/site/css/ Frame 8B08 		2 KB
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://expense.serko.com/web2/site/css/colors.css?v=1.0.1
Requested by
Host: expense.serko.com
URL: https://expense.serko.com/web2/site/css/base.css?v=1.0.1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.53.227.94 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5ef4605590a78008da1c3548cc2c601895c20ab71ea9d1f479530bbbd6bd7058
Security Headers
Name Value
Content-Security-Policy connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;

Request headers

Referer
https://expense.serko.com/web2/site/css/base.css?t=19329.67
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Tue, 10 Sep 2024 19:22:09 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Serko-Identity
INCHARGESYDWEB6
Connection
keep-alive
Content-Length
802
X-Xss-Protection
1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;
Referrer-Policy
same-origin
Last-Modified
Tue, 10 Sep 2024 10:00:41 GMT
ETag
"95ca834b683db1:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
X-Robots-Tag
noindex, noarchive, nosnippet, noimageindex, noodp, nofollow
base.css
expense.serko.com/web2/site/css/ Frame 8B08 		2 KB
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://expense.serko.com/web2/site/css/base.css?v=1.0.1
Requested by
Host: expense.serko.com
URL: https://expense.serko.com/web2/site/home/serkoincharge.css?t=19329.62
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.53.227.94 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
69299fdad9141ae80b43861e357a6cc086485b443ba280de21c40e4b4aff2a9b
Security Headers
Name Value
Content-Security-Policy connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;

Request headers

Referer
https://expense.serko.com/web2/site/home/serkoincharge.css?t=19329.67
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Tue, 10 Sep 2024 19:22:09 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Serko-Identity
INCHARGESYDWEB5
Connection
keep-alive
Content-Length
709
X-Xss-Protection
1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;
Referrer-Policy
same-origin
Last-Modified
Tue, 10 Sep 2024 10:00:41 GMT
ETag
"95ca834b683db1:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
X-Robots-Tag
noindex, noarchive, nosnippet, noimageindex, noodp, nofollow
favicon.ico
expense.serko.com/web2/site/home/ 		4 KB
7 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://expense.serko.com/web2/site/home/favicon.ico?v=3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.53.227.94 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
9fb5ae1e74faf980c24ad8366e293ba1aa1bebcbdf373334a28e5bb120073d42
Security Headers
Name Value
Content-Security-Policy connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;

Request headers

Referer
https://expense.serko.com/web2/site/home/default.asp
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Tue, 10 Sep 2024 19:22:09 GMT
Content-Security-Policy
connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
X-Content-Type-Options
nosniff
Referrer-Policy
same-origin
Last-Modified
Tue, 10 Sep 2024 10:00:41 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
ETag
"68698d4b683db1:0"
Content-Type
image/x-icon
Serko-Identity
INCHARGESYDWEB6
Connection
keep-alive
Accept-Ranges
bytes
X-Robots-Tag
noindex, noarchive, nosnippet, noimageindex, noodp, nofollow
Content-Length
4286
X-Xss-Protection
1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0

0 Cookies

4 Console Messages

Source Level URL
Text
security error URL: https://expense.serko.com/web2/site/home/default.asp
Message:
Unrecognized Content-Security-Policy directive 'referrer'.
security error URL: about:blank
Message:
Unrecognized Content-Security-Policy directive 'referrer'.
security error URL: https://expense.serko.com/web2/site/home/logon_window.asp
Message:
Unrecognized Content-Security-Policy directive 'referrer'.
security warning URL: https://expense.serko.com/web2/site/home/logon_window.asp
Message:
An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy connect-src 'self' api-registry.serko.travel cdn-webapp.serko.travel cdn-serkoonline.serko.travel dc.services.visualstudio.com *.walkme.com *.azurewebsites.net www.google-analytics.com serkoimages.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net https://*.hotjar.com wss://*.hotjar.com https://api.predicthq.com; media-src 'none' ; object-src 'self' https://www.youtube.com https://player.vimeo.com; child-src 'self' blob: *.serko.travel serkoinchargeico1.blob.core.windows.net; frame-src 'self' https://www.youtube.com https://player.vimeo.com *.serko.travel https://*.hotjar.com ctmsmart.travelctm.com serkoinchargeico1.blob.core.windows.net serko-ask-zeno-web-staging.azurewebsites.net; worker-src 'self' blob:; frame-ancestors 'self' *.serko.travel *.serko.com *.iact.co.nz *.travelctm.com *.campustravel.com.au *.fcm.travel booking.savi.travel *.serkoonline.com *.stageandscreen.travel *.corporatetraveller.com.au *.hrgworldwide.com *.atpi.com *.sabretn.net *.booktravelonline.com.au *.nexuspoint.travel *.traveledgeonline.co.nz; upgrade-insecure-requests; block-all-mixed-content; style-src 'self' data: 'unsafe-inline' blob: https://serkowebdev.blob.core.windows.net serkogvcdnendpointstaging.azureedge.net *.serko.travel remote.captcha.com www.google-analytics.com *.walkme.com fonts.googleapis.com fonts.gstatic.com az834239.vo.msecnd.net; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://serkowebdev.blob.core.windows.net secure.livechatinc.com cdn.livechatinc.com ipinfo.io *.serko.travel remote.captcha.com www.google-analytics.com www.googletagmanager.com *.walkme.com d3sbxpiag177w8.cloudfront.net *.vo.msecnd.net maps.googleapis.com cdnjs.cloudflare.com https://*.hotjar.com; referrer origin; report-uri https://serko.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://serko.report-uri.com/r/d/xss/enforce;