Skip to content
https://ubs.com

Infrastructure

· 9 checks — DNS, redirects, IPv6, crawlability, URL variants, and domain intelligence rolled into one auditable list.
SCORE
85
GRADE
B
FIX
1
REVIEW
3
PASS
5
INFO
0
Probed from Amsterdam, Netherlands
302 Found
Checks
9
5 PASS 3 REVIEW 1 FIX
D
CDN & Delivery
Action
No CDN detected
FIX
No CDN detected
Warning::
No CDN detected
A CDN can significantly improve load times for users around the world by caching content at edge nodes closer to them.
No CDN detected

Consider using a CDN to improve global delivery speed and reduce origin load.

B
Redirect Chain
2 redirect(s), 150 ms total
REVIEW
2 redirect(s), 150 ms total
Warning::
2 redirects before reaching final URL
Each redirect adds latency. Try to minimize the chain to 1 hop.
Info::
WWW normalization redirect
Info::
Uses 302 (temporary) redirect
If permanent, use 301 instead.
Got: https://ubs.com

https://ubs.com

89 ms · HTTP/1.1

302

https://www.ubs.com/

31 ms · HTTP/1.1

302

https://www.ubs.com/nl/en.html

31 ms · HTTP/1.1 FINAL

#URLStatusTimeProtocolServer
1https://ubs.com30289 msHTTP/1.1Apache
2https://www.ubs.com/30231 msHTTP/1.1
3https://www.ubs.com/nl/en.html20031 msHTTP/1.1

See the visual redirect chain in the HTTP Probe tab →

Each redirect adds latency. Try to minimize the chain to 1 hop.

Why this matters

Redirect chain — each hop adds latency; combine into one redirect where possible.

Source: Google Search Central / web.dev

If permanent, use 301 instead.

Why this matters

302 (Found) is for genuinely temporary redirects — if this redirect is permanent, switch to 301 to preserve SEO equity.

Learn more ▾

Search engines treat 302 as temporary, keeping the original URL indexed and not transferring full link equity to the destination. Use 301 (Moved Permanently) for permanent redirects (HTTP→HTTPS, www-vs-non-www, URL restructures).

Source: Google Search Central

C
IPv6 Readiness
Action
No IPv6 support
REVIEW
No IPv6 support
Info::
No IPv6 (AAAA) records found
IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity.
No IPv6 Support
About 40% of internet users have IPv6. Consider adding AAAA records.

IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity.

Why this matters

No AAAA records — same impact as 'no IPv6 (AAAA) records'; IPv6-preferring clients pay extra latency falling back to IPv4.

Source: Google IPv6 stats

B
TLS Certificate Expiry & Recommendations
145 days until leaf cert expires — 3 issues to address
REVIEW

Certificate validity

145
days left
0d 30d 60d 90d+

Recommended actions

  • Add includeSubDomains to the HSTS directive
  • Add the preload directive and submit to hstspreload.org once max-age + includeSubDomains are in place
  • Enable OCSP stapling on your TLS server to remove a CA roundtrip and protect user privacy
A+
DNS Records
1 A records, 89 ms lookup
PASS
1 A records, 89 ms lookup
Info::
Resolves to 1 IPv4 address(es)
Got: 193.134.111.71
Info::
Single A record — no DNS redundancy
Multiple A records provide failover if one server goes down.
Info::
No IPv6 (AAAA) records
Info::
12 nameserver(s) configured
Got: a1-12.akam.net, a2-65.akam.net, a3-64.akam.net, a5-65.akam.net, udns1.ultradns.net, udns2.ultradns.net, a26-66.akam.net, a28-65.akam.net, uranus.ubs.com, jupiter.ubs.com, mercury.ubs.com, neptune.ubs.com
Info::
4 mail exchanger(s) configured
Info::
CAA records not checked
CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.
Info::
SPF record present in TXT
Info::
DNS resolution time: 89 ms
Got: 89 ms
A193.134.111.71
AAAA—
CNAME—
NSa1-12.akam.net, a2-65.akam.net, a3-64.akam.net, a5-65.akam.net, udns1.ultradns.net, udns2.ultradns.net, a26-66.akam.net, a28-65.akam.net, uranus.ubs.com, jupiter.ubs.com, mercury.ubs.com, neptune.ubs.com
MX
100 mx12.ubs.open.ch
100 mx14.ubs.open.ch
100 mx13.ubs.open.ch
100 mx11.ubs.open.ch
TXT
bgetadu5ym
MS=ms39873197
KJ6H1XVY7hajkfSHWNfY
4s5khz9036k867ll945q6kn6y5mkyv47
_7y4r94tnt2yvt229aszxwomvxy2xuwz
_dhirnkgx3akw6cgmk42u7my5dflhor8
_o30vuuxu8k0ikfi2batyro2j67bp63z
_oiiqvab07x3sxufy1qt7ss2yhmv1ztd
_z8c2knthhny20oyyevr9fw3l3x46ilr
ggnr7mcv6lwxbqwbdx7lzyz8r8ct6xsc
t7l899pcs8yyv6w31p484lxsx6n1jrsm
zh7vqpnnn0lk5vz4f552sbqzcnhf157g
d365mktkey=1nbagcoe2so0gaumloq5fc7ym
d365mktkey=51n7sg4jkwasf48ci0vye278m
d365mktkey=5dvvu50hqe6dj7brkmo6phu0z
apple-domain-verification=G0H6q4lqT0KlyN0k
apple-domain-verification=KfJm39EFEOCNsyaq
apple-domain-verification=bFt7GE7CPiRSbwO5
apple-domain-verification=lpbETz8oB0ofIS3W
MS=4B73E19AEA57ADD637F5852C6AFB8949935007C1
swisssign-check=B4UFJMIk7VMZLE8eoIF8gzGicxg
swisssign-check=EbaF8fBolkOjlJhenGQW7uSI5kU
swisssign-check=QhDFVSYDlTmOHpRBujO1AFpkJTg
docusign=7e14a69a-30ab-4f23-8c70-fe6e80cdeb1a
docusign=f439e402-869c-43db-ae5c-926cf911137c
d365mktkey=79nXgxHd4ex5R8ZxExLoBdPpQyx4KxV3ZCIX2LsVoiYx
d365mktkey=CmMOkvDwh5OHYEli1xAY7a4rJibvGDx4imbxJ3iHqwUx
d365mktkey=DEzVUrdyKZYkKawXrsNwamTJ3drEQ0ZA0u5XqxPDoKEx
d365mktkey=FFfrlyBhMz22dWAfJJ5qvK5DYRA9RMKtFM0qk2Un2pQx
d365mktkey=GMY7FXWULQdeHrDvba3wvhl90HkZGOjoATOJ8d4LIxsx
d365mktkey=Jiwkuis7G9poBrM36fsITT8eTqA2dJQcUNa2zYwmb90x
d365mktkey=KF0HvyxHf2DfKYqPZIOSaFWkXLXfiMK8wb4UxQ7en4Ax
d365mktkey=L28GThTU5WUc1xtV0ED5mKgV8yTlEX1vVo24RH0u9X8x
d365mktkey=LetA1xy04n0fmExsfK9fDxozFpL9cGdt57k3cHIdzWAx
d365mktkey=Nuu8su9Pr6w3BYnl0P7Ugm16xNoDoxyTOWwUUoZvrCox
d365mktkey=OUhdK8xNPcoDbxPntlYN9g7srAy7q0CWOTrjEHHnUYcx
d365mktkey=Q1FyejrpjHQ4HAzTZSBeQH9wWKDi8xlDFWbvsTbFU8cx
d365mktkey=TV5XrHpTF98oytu0FuUNQVXaxeu6xPpa9ET4J1lZfUYx
d365mktkey=TkkNUSPWuMxBXkgAlOAnuuhdelQfTSu8xo8x6kZwFn8x
d365mktkey=U5JeBmZkguv0RkQ8X1IZyFKA7Kn2z6vKFGJtXBl3n6sx
d365mktkey=UHfHA4egmaRAz6cgY3xYriHaxq7qLS6CrQnwve3xIccx
d365mktkey=VOL6xGDn4qSNPZ2KiY4EVaIjIkGuWClCPW7gp0YHdlkx
d365mktkey=X43ITGFwNAK4Plz3uKldLSnzxwmCF3KCSwMzSG5CZnUx
d365mktkey=XW9bxyxx939QQxnXL4t0KatbcXvvTr7CLF9CKf5eXuMx
d365mktkey=Y03e8q2sgB9DZ5OudrrBZ4MyxZXxxP7a6c1l1x4V9TEx
d365mktkey=a1x0sXFxyx0qH5YsLVEGx4N6lDInF7pgnyT58Uxol3Ux
d365mktkey=bLEn4u896GLeswCkavXU5yt3rv11qRINO8fvIKbV7ywx
d365mktkey=d0JJYE7K8DimIvYp4GoZE6ofYt7yhgaiArbPFuloODox
d365mktkey=dh0Jjhs66Cxxzexy8sjjqdq0zNVR0pCuOyX5z8ZNX8Ex
d365mktkey=eUR8Sphg9PzBUAsfKlrA9Hgi57EpGZd3440txQeqBx0x
d365mktkey=ereKo1ne4QVmPyxMEzdBEXYszavbxwbxBh7nHKEu6n8x
d365mktkey=j61up3kMr8XtI1Bu26D748dxxB8qWgZxRjI9hEtFH0Ix
d365mktkey=kFsiQTjJMaZil6FZXnQGBEaxrQV3gw70B0Zn5dvVKvQx
d365mktkey=l1FxoETCrIpRkXj97qiYpayK6vOfgu4ID6HL2SIHEVwx
d365mktkey=m4yTSRiS5WHxu3aqSJkF81jnzFtgsdNoaM7iLQgxniUx
d365mktkey=r2n03Eix9VkuDKdhoxdggGshPsrsxHcNDSGqiYKAMYox
d365mktkey=refYPl3efr1u9ixyXufekmgixevhV3syH7XgS9xXQoox
d365mktkey=rw4jd99xixPAVSiIy0HA5nBRfd8Yxx585aIewxIEEOYx
d365mktkey=sEJxwFggKtlCIvdaX59KH6hU04LRAfYXfPpSrzkBDUwx
d365mktkey=smYqzJoxM1ruFG4WLGBbvpbYwwzkHcJHaxjxTLajPnIx
d365mktkey=woKXiWoTFHufqJexPJUZj6UXiM5CCo2QaxR4sxBxGL0x
d365mktkey=xIhOleA0LA64SpfpHbufoxK0YpTGCLnaA2nev0xok6kx
d365mktkey=xaaM03TgpcbqE175Dskd0l9SxQi3Tbnf1ZSZQfkgAbwx
d365mktkey=xbhYh5ibB01yPQenmOZXHRR9ipzQOlo5o9n0vxxqTp4x
webexdomainverification.=f290b4d9-66a6-46f6-9532-6340ee994863
webexdomainverification.147ZK=3e7e5ea0-4441-4624-9128-ae6820975a95
webexdomainverification.1QTP6=8463d7a7-8199-44b8-a831-312200bc472a
yahoo-verification-key=wH8imQymrkXHp9lMwyqB7PnLMaYv+0JY5LrRyPhUUIk=
google-site-verification=zN6-GwLduc1WT1yGiPjN0b2hwQtKOZNgCi0BsWDUWfM
JFMyORm9A//mNl8pTP5RWMtcrytoWNxREGsaZliHfVrPNI/Naj7KnImcv/ZkmBoRHIh2tRVx0sgJu6jZ...
wiz-domain-verification=0471fe866ba173beeeb001660156c20a2ec9d31d69df6c560412041c...
wiz-domain-verification=07709d2a7782474c654c9ea667d5fe776e0c6ad44ff059ba1cea5941...
adobe-idp-site-verification=f632d15f46dbcc29ce5dc20b9e58097de7577ff8760bf3656e56...
cisco-ci-domain-verification=7c2336d99fee585a0e55327309a769eb2936a4f80d3b16177fb...
cisco-ci-domain-verification=f6e192bcb2186b667b594e6ebb7ae7e568b8b2e2332e03173ed...
SPF v=spf1 include:spf-a.ubs.com include:spf-b.ubs.com include:spf-hosted.ubs.com in...
CAALookup not available with standard resolver
Resolved in 89 ms

Multiple A records provide failover if one server goes down.

Why this matters

Single A record means a single point of failure — if that IP goes down, your site is unreachable until DNS TTL expires.

Learn more ▾

Add multiple A records for round-robin failover, or use a managed DNS provider with health-checked failover (Route 53, Cloudflare, NS1). Short TTL (60-300s) lets clients recover faster on outages.

Source: SRE practice / DNS architecture

CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.

Why this matters

Informational: CAA (Certification Authority Authorization) records weren't checked in this scan.

A+
Crawlability
robots.txt present, sitemap with 101 URLs
PASS
robots.txt present, sitemap with 101 URLs
Info::
robots.txt is present
Got: 1293 bytes
Info::
sitemap.xml is present
Info::
sitemap.xml is valid XML
Info::
sitemap.xml contains 101 entries
Info::
Sitemap index with 101 child sitemaps
Info::
robots.txt references sitemap
robots.txt 200 OK
Size 1293 B Sitemaps referenced 1 User-agents * Blocking No — crawling allowed
User-agent: *



Disallow: /*jp/en/assetmanagement


Disallow: /*investment-bank/ib-conferences

Disallow: /*researchacademy


Disallow: /*?caasID=CAAS-ActivityStream

Disallow: /*anlogin

Disallow: /*campaign/

Disallow: /*campaignwebApp/

Disallow: /*error

Disallow: /*html.html

Disallow: /*httpd.html

Disallow: /*.lightbox

Disallow: /*mobilecheck

Disallow: /*noheader

Disallow: /*onlycontent

Disallow: /*noindex

Disallow: /*nomobile

Disallow: /*querystring

Disallow: /*search.html?querystring

Disallow: /*shared.html

Disallow: /*Shared.html

Disallow: /*undefined

Disallow: /*varnish



Disallow: /1/

Disallow: /2/

Disallow: /4/

Disallow: /5/

Disallow: /6/

Disallow: /ap/

Disallow: /pp/

Disallow: /ii/

Disallow: /di/

Disallow: /fx/

Disallow: /tt/

Disallow: /yy/

Disallow: /global/ur/

Disallow: /bin/

Disallow: /content/sites/*.html


Disallow: /*microsites/ib-conferences/


Disallow: /*itunes.xml


Disallow: /*rss20.xml

Disallow: /*rss.xml


Disallow: /ch/*.pdf

Disallow: /*internethosting

Disallow: /*content/dam/ubs

Disallow: /*content/dam/InvestmentBank

Disallow: /*content/dam/ubs_manual_mig


Disallow: /*quot;https*



Allow: /content/dam/


Allow: /*clientlib*.js

Allow: /*0.0.sc_asc.html



Sitemap: https://www.ubs.com/sitemap.xml
sitemap.xml 200 OK
Type Sitemap Index URLs 101 entries Valid XML Yes
Child Sitemaps:
A
URL Variants
www/non-www, trailing slash, HTTP→HTTPS
PASS
www/non-www, trailing slash, HTTP→HTTPS
Warning::
HTTP→HTTPS redirect uses 302 instead of 301
Got: 302 temporary redirect Expected: 301 permanent redirect

www / non-www

403https://www.ubs.com/
200https://ubs.com/

HTTP → HTTPS

302http://ubs.com/ → https://www.ubs.com/

Use 301 (permanent) instead of 302 (temporary)

A+
Domain Intelligence
ubs.com — via MarkMonitor Inc., 33 years, 7 months old, hosted on Switzerland, CH
PASS
ubs.com — via MarkMonitor Inc., 33 years, 7 months old, hosted on Switzerland, CH
Info::
Domain registered until Feb 16, 2027 (10 months remaining)
Info::
DNSSEC is enabled
Info::
Registrar: MarkMonitor Inc.
Warning::
Registrar lock is NOT enabled
The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.
Info::
Hosting: Switzerland, CH
Got: AS8883
Domain expiry

245 days

February 16, 2027

SSL certificate

145 days

Issued by DigiCert Inc

Domain age

33 years, 7 months

Registered February 15, 1993

DNSSEC

Enabled

Protects against DNS spoofing

Hosting

Switzerland, CH

ASN AS8883

193.134.111.71

Registrar

MarkMonitor Inc.

Unlocked 12 NS records
Expiry timeline
Today
+1 year
Domain expiry SSL expiry Danger zone (≤30 days)
Recommended actions
  • Enable registrar lock (clientTransferProhibited) to block unauthorized domain transfers
Registrar MarkMonitor Inc.
Created February 15, 1993 (33 years, 7 months ago)
Expires February 16, 2027 (10 months)
Last Updated January 15, 2026
Name Servers a1-12.akam.net, a2-65.akam.net, a26-66.akam.net, a28-65.akam.net, a3-64.akam.net, a5-65.akam.net, jupiter.ubs.com, mercury.ubs.com, neptune.ubs.com, udns1.ultradns.net, udns2.ultradns.net, uranus.ubs.com
DNSSEC Enabled
Hosting
IP Address 193.134.111.71
ASN AS8883 (Switzerland, CH)
Provider Switzerland, CH
Data source: rdap (0.2s)

The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.

Why this matters

Without registrar lock, an attacker who phishes your registrar credentials can transfer the domain in minutes — total brand hijack.

Learn more ▾

Registrar lock (clientTransferProhibited, clientUpdateProhibited, clientDeleteProhibited) requires extra verification before any transfer/update/delete. Every major registrar offers it free. Combined with 2FA on your registrar account, it's the strongest defense against domain hijacking.

Source: ICANN / domain-security best practice

A+
HTTP Probe Timing
Total 89 ms — DNS, TCP, TLS, TTFB, content transfer breakdown
PASS
DNS Lookup DNS Lookup — time to resolve the domain name to an IP address.
21 ms
TCP Connect TCP Connect — time to establish a TCP connection to the server.
18 ms
TLS Handshake TLS Handshake — time to complete the HTTPS encryption handshake.
26 ms
Time to First Byte Time to First Byte — how long the server takes to respond with the first byte of data.
90 ms
Total Time Total request time from DNS lookup through full response.
90 ms

Connection waterfall

DNS Lookup 21 ms TCP Connect 18 ms TLS Handshake 26 ms Server Processing 25 ms Content Transfer 0 ms
All checks on this page are automated. Results are estimates - run targeted manual reviews when the score affects a release decision.

Send Feedback