Security Analysis Results

bytes

keep-alive

Mon, 23 Mar 2026 10:31:57 GMT

max-age=31536000

Origin, Accept-Encoding, x-enable-segment

IE=Edge

https://www.trademe.co.nz

h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400

private,no-store,max-age=0,no-cache,must-revalidate

br

default-src 'self' tpc.googlesyndication.com;frame-ancestors 'self';frame-src 'self' staticcdn.co.nz *.youtube.com www.facebook.com connect.facebook.net gsa://onpageload trademe.wufoo.com matterport.com *.matterport.com viewer.metamaker.istaging.com vtc.virtualtourscreator.com.au app.cloudpano.com youriguide.com virtualtour.laserfocus.co.nz s3virtualtour.esoft.com www.boxbrownie.com kuula.co tours.virtualpro.nz open.littlehinges.com ipropertyexpress.com virtual-tour.ipropertyexpress.com app.envisionvr.net realsee.ai realsee.jp https://api.trademe.co.nz/ https://auth.trademe.co.nz https://api.trademe.co.nz/graphql/ *.app.trade.me vimeo.com *.vimeo.com cdn.diakrit.com livetour.istaging.com vtc.virtualtourscreator.com.au app.cloudpano.com static.instavid360.com/ storage.googleapis.com www.google.com www.google.co.nz *.googlesyndication.com console.googletagservices.com *.doubleclick.net *.adtrafficquality.google www.googletagmanager.com www.adsensecustomsearchads.com syndicatedsearch.goog *.trademepayments.co.nz:* *.pingauth.trademe.co.nz:* *.ping.trademe.co.nz:* mfa.trademe.co.nz mfa-test.trademe.co.nz;font-src 'self' data: www.trademe.co.nz fonts.googleapis.com fonts.gstatic.com banner.appsflyersdk.com;img-src 'self' data: blob: trademe.test.tmcdn.co.nz www.google-analytics.com www.googletagmanager.com *.googleapis.com *.gstatic.com *.ggpht.com i.ytimg.com i.vimeocdn.com www.facebook.com staticcdn.co.nz *.segment.com https://api.trademe.co.nz/ *.tmcdn.co.nz https://api.trademe.co.nz/graphql/ trademe-prod-cdn.global.ssl.fastly.net *.trademe.co.nz images.tmsandbox.co.nz *.google.com *.google.co.nz *.google.com.au *.google.co.uk *.google.lk *.google.co.in *.google.com.sg *.google.com.sa *.google.cn *.google.com.ph *.google.com.hk *.google.co.kr *.google.de *.google.ca *.google.co.jp *.google.com.fj *.google.co.id *.google.ae *.google.com.my *.google.co.th *.google.fr *.google.nl *.google.com.tw *.google.com.br *.google.es *.google.ie *.google.cl *.google.se *.google.ar *.google.com.vn *.googlesyndication.com *.doubleclick.net *.googleusercontent.com *.adtrafficquality.google www.adsensecustomsearchads.com syndicatedsearch.goog ad-delivery.net 1x1.a-mo.net banner.appsflyersdk.com impressions.onelink.me api.myautoshop.co.nz images.myautoshop.co.nz sslphotos.jato.com via.placeholder.com static.instavid360.com/ trixels.ratemyagent.com.au;media-src static.instavid360.com/;style-src 'self' 'unsafe-inline' fonts.googleapis.com www.googletagmanager.com;script-src 'self' 'sha256-5aBbL7mWCgDmyPdmtzciIP00UJah5j4DGLRRN6VfpZA=' 'sha256-8e3Ji2dRk8QOUi6ucdUmKHGghQT1M9VA7KHG1+ozrv0=' 'report-sample' staticcdn.co.nz connect.facebook.net www.google-analytics.com www.googletagmanager.com *.googletagservices.com www.gstatic.com dnn506yrbagrg.cloudfront.net *.googleapis.com www.youtube.com s.ytimg.com script.crazyegg.com *.segment.com *.appboycdn.com *.google.com *.google.co.nz *.google.com.au *.google.co.uk *.google.lk *.google.co.in *.google.com.sg *.google.com.sa *.google.cn *.google.com.ph *.google.com.hk *.google.co.kr *.google.de *.google.ca *.google.co.jp *.google.com.fj *.google.co.id *.google.ae *.google.com.my *.google.co.th *.google.fr *.google.nl *.google.com.tw *.google.com.br *.google.es *.google.ie *.google.cl *.google.se *.google.ar *.google.com.vn *.googleadservices.com *.doubleclick.net *.googlesyndication.com cdn.ampproject.org *.adtrafficquality.google trademe.cdn.fuseplatform.net cdn.jsdelivr.net/gh/prebid/ *.confiant-integrations.net btloader.com *.btloader.com privacymanager.io *.privacymanager.io www.adsensecustomsearchads.com syndicatedsearch.goog websdk.appsflyersdk.com fvalid.appsflyersdk.com *.afterpay.com *.app.trade.me *.newrelic.com *.nr-data.net *.sentry-cdn.com 'wasm-unsafe-eval';form-action 'self' trademe.wufoo.com www.facebook.com connect.facebook.net d3f5l8ze0o4j2m.cloudfront.net https://api.trademe.co.nz/ https://api.trademe.co.nz/graphql/ *.app.trade.me;connect-src 'self' https://api.trademe.co.nz/ https://auth.trademe.co.nz https://api.trademe.co.nz/graphql/ *.tmcdn.co.nz *.segment.io *.segmentapis.com *.segment.com *.braze.com *.sentry.io sentry.io www.facebook.com www.google-analytics.com *.gstatic.com *.googleapis.com www.googletagmanager.com *.google.com *.google.co.nz *.google.com.au *.google.co.uk *.google.lk *.google.co.in *.google.com.sg *.google.com.sa *.google.cn *.google.com.ph *.google.com.hk *.google.co.kr *.google.de *.google.ca *.google.co.jp *.google.com.fj *.google.co.id *.google.ae *.google.com.my *.google.co.th *.google.fr *.google.nl *.google.com.tw *.google.com.br *.google.es *.google.ie *.google.cl *.google.se *.google.ar *.google.com.vn google.com *.doubleclick.net *.googlesyndication.com *.adtrafficquality.google trademe.cdn.fuseplatform.net cdn.jsdelivr.net/gh/prebid/ *.3lift.com *.a-mo.net *.adagio.io *.adnxs.com *.adsafeprotected.com *.adsrvr.org *.amazon-adsystem.com *.appmonet.com *.bidswitch.net *.btloader.com *.casalemedia.com *.celtra.com *.connectad.io *.criteo.com *.gamera.io *.indexexchange.com *.indexww.com *.iionads.com *.kargo.com *.kueez.com *.lijit.com *.media.net *.ogury.com *.openx.net *.primis.com *.pubmatic.com *.pubmnet.com *.rubiconproject.com *.seedtag.com *.servedbyivo.com *.smartadserver.com *.sovrn.com *.teads.tv *.thetradedesk.com *.triplelift.com *.vidazoo.com ad-delivery.net ads.servenobid.com ag.dns-finder.com btloader.com dl.edge-aicdn.net dnacdn.net exchange.cootlogix.com storage.ml-cachehost.net *.privacymanager.io onetag-sys.com *.onetag-sys.com *.onetag-cdn.com rlcdn.com *.rlcdn.com www.adsensecustomsearchads.com syndicatedsearch.goog wa.appsflyersdk.com banner.appsflyersdk.com wa.onelink.me *.afterpay.com api.amplitude.com *.app.trade.me *.trademe.co.nz wss://*.app.trade.me *.nr-data.net api.topsort.com/v2/events;child-src 'self';worker-src 'self' blob:;object-src 'none';report-uri https://www.trademe.co.nz/a/csp-report-uri

text/html; charset=utf-8

max-age=0, report-uri="https://sentry.io/api/1279183/security/?sentry_key=990566bb4d5d4445ae67eba309f51cfd&sentry_release=frend--17c2f5e4"

publickey-credentials-get=(self "https://auth.trademe.co.nz" "https://mfa.trademe.co.nz"), publickey-credentials-create=(self "https://auth.trademe.co.nz" "https://mfa.trademe.co.nz"), clipboard-write=(self "https://auth.trademe.co.nz" "https://mfa.trademe.co.nz")

no-cache

strict-origin-when-cross-origin

chunked

nosniff

off

noopen

0

SAMEORIGIN

none

0