info--ca.web.app Open in urlscan Pro
2620:0:890::100  Malicious Activity! Public Scan

URL: https://info--ca.web.app/
Submission Tags: analytics-framework
Submission: On April 19 via api from US — Scanned from CA

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 12 HTTP transactions. The main IP is 2620:0:890::100, located in United States and belongs to FASTLY, US. The main domain is info--ca.web.app.
TLS certificate: Issued by GTS CA 1D4 on March 6th 2023. Valid for: 3 months.
This is the only time info--ca.web.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Credit Agricole (Banking)

Domain & IP information

IP Address AS Autonomous System
1 2620:0:890::100 54113 (FASTLY)
6 2607:f8b0:400... 15169 (GOOGLE)
1 13.35.77.57 16509 (AMAZON-02)
4 13.35.77.62 16509 (AMAZON-02)
12 4
Apex Domain
Subdomains
Transfer
6 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 119
3 KB
4 getbee.io
app-rsrc.getbee.io — Cisco Umbrella Rank: 26552
12 KB
1 cloudfront.net
d15k2d11r6t6rl.cloudfront.net
14 KB
1 web.app
info--ca.web.app
3 KB
12 4
Domain Requested by
6 fonts.googleapis.com info--ca.web.app
4 app-rsrc.getbee.io info--ca.web.app
1 d15k2d11r6t6rl.cloudfront.net info--ca.web.app
1 info--ca.web.app
12 4

This site contains links to these domains. Also see Links.

Domain
cu75214.tw1.ru
fr-fr.facebook.com
twitter.com
www.instagram.com
www.youtube.com
Subject Issuer Validity Valid
web.app
GTS CA 1D4
2023-03-06 -
2023-06-04
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-03-28 -
2023-06-20
3 months crt.sh
*.cloudfront.net
Amazon RSA 2048 M01
2022-12-08 -
2023-12-07
a year crt.sh
*.getbee.io
Amazon RSA 2048 M01
2023-02-17 -
2024-03-16
a year crt.sh

This page contains 1 frames:

Primary Page: https://info--ca.web.app/
Frame ID: A840E929BE161E1AD7C75CDF13CE0436
Requests: 12 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

12
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

32 kB
Transfer

48 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
info--ca.web.app/
16 KB
3 KB
Document
General
Full URL
https://info--ca.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6eea8b08e21e33a057c5be3f2b5a6288f2b6ce37fbcc362a956d3aa442315919
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control
max-age=3600
content-encoding
br
content-length
2420
content-type
text/html; charset=utf-8
date
Wed, 19 Apr 2023 12:49:30 GMT
etag
"1dad10c26ba3f535c998cf4168b1a3c328bb569ee2072dc6589aef0d3da7b2e4-br"
last-modified
Tue, 31 Jan 2023 14:55:56 GMT
strict-transport-security
max-age=31556926; includeSubDomains; preload
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
x-cache-hits
0
x-served-by
cache-yul12830-YUL
x-timer
S1681908571.750355,VS0,VE92
css
fonts.googleapis.com/
714 B
779 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Abril+Fatface
Requested by
Host: info--ca.web.app
URL: https://info--ca.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:806::200a New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
5b05ccca96b538b695a47c7e0da44490ad3cd6122a31239dccb8f797ef2c21e4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://info--ca.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 19 Apr 2023 12:49:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 19 Apr 2023 11:02:02 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 19 Apr 2023 12:49:30 GMT
css
fonts.googleapis.com/
2 KB
628 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Alegreya
Requested by
Host: info--ca.web.app
URL: https://info--ca.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:806::200a New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
4f506431b3f789ffdbada9c6bc616f9e1239b1c8389121e37103a3ee048a427c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://info--ca.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 19 Apr 2023 12:49:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 19 Apr 2023 12:41:39 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 19 Apr 2023 12:49:30 GMT
css
fonts.googleapis.com/
356 B
362 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Arvo
Requested by
Host: info--ca.web.app
URL: https://info--ca.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:806::200a New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
b3974d529dfe79cc7959c1d293d84fe4d633f1415d60c9c9ff15cbb996fc464b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://info--ca.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 19 Apr 2023 12:49:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 19 Apr 2023 11:44:17 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 19 Apr 2023 12:49:30 GMT
css
fonts.googleapis.com/
2 KB
592 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Bitter
Requested by
Host: info--ca.web.app
URL: https://info--ca.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:806::200a New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
fe81f558a4210ec16be0d47586d6e297fb627e92e55ba1b730e2aee54b5a4f74
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://info--ca.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 19 Apr 2023 12:49:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 19 Apr 2023 11:56:13 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 19 Apr 2023 12:49:30 GMT
css
fonts.googleapis.com/
1 KB
527 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Cabin
Requested by
Host: info--ca.web.app
URL: https://info--ca.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:806::200a New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
fa23813692ebb023e692783bb2385c5c0299f03082969ddbb287723c131d6001
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://info--ca.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 19 Apr 2023 12:49:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 19 Apr 2023 11:59:19 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 19 Apr 2023 12:49:30 GMT
css
fonts.googleapis.com/
2 KB
550 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Ubuntu
Requested by
Host: info--ca.web.app
URL: https://info--ca.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:806::200a New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e2a79eb0c9c649ca281c1ec8a831b84a611bb31033c358629d2bcc3b6e922713
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://info--ca.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 19 Apr 2023 12:49:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 19 Apr 2023 11:46:49 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 19 Apr 2023 12:49:30 GMT
credit-agricole-vector-logo-2022.png
d15k2d11r6t6rl.cloudfront.net/public/users/Integrators/BeeProAgency/892694_876947/
13 KB
14 KB
Image
General
Full URL
https://d15k2d11r6t6rl.cloudfront.net/public/users/Integrators/BeeProAgency/892694_876947/credit-agricole-vector-logo-2022.png
Requested by
Host: info--ca.web.app
URL: https://info--ca.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.35.77.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-35-77-57.bos50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
1ba76faa5d4ebb3164eec30f91400d455c0fa552fdfdcab5a7ec4f90b19827f0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://info--ca.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Wed, 19 Apr 2023 12:49:32 GMT
via
1.1 3ae9464b3a12f9a00e97e3c81ee98466.cloudfront.net (CloudFront)
last-modified
Fri, 11 Nov 2022 09:04:04 GMT
server
AmazonS3
x-amz-cf-pop
BOS50-C1
etag
"c74699fee3ce3b279f588cf984a96499"
x-cache
Miss from cloudfront
content-type
image/png
accept-ranges
bytes
content-length
13612
x-amz-cf-id
JTFVHLewMhAiWidZKVF0wqLuwEnFg5uGMm0f364y4l2Z7Nvwf9tj3Q==
facebook@2x.png
app-rsrc.getbee.io/public/resources/social-networks-icon-sets/t-outline-circle-default-gray/
2 KB
2 KB
Image
General
Full URL
https://app-rsrc.getbee.io/public/resources/social-networks-icon-sets/t-outline-circle-default-gray/facebook@2x.png
Requested by
Host: info--ca.web.app
URL: https://info--ca.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.35.77.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-35-77-62.bos50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d2bb3bb3add67a8bd43259e1ef13b72f6adf3c1abc8b66fd92e77a106f12c420

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://info--ca.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Wed, 19 Apr 2023 01:44:53 GMT
via
1.1 909fc123d4e8b7ecf80a806121a98be6.cloudfront.net (CloudFront)
last-modified
Wed, 03 Feb 2021 07:41:29 GMT
server
AmazonS3
x-amz-cf-pop
BOS50-C1
age
39878
etag
"e4c2d3fdf4bf6589b58a4d6aaaaa2280"
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
image/png
accept-ranges
bytes
content-length
2152
x-amz-cf-id
5QtIsllxzKjVSa88riosBAHC1sTqFelONHJHGjeM_nJIJhjOMJ_s7w==
twitter@2x.png
app-rsrc.getbee.io/public/resources/social-networks-icon-sets/t-outline-circle-default-gray/
3 KB
3 KB
Image
General
Full URL
https://app-rsrc.getbee.io/public/resources/social-networks-icon-sets/t-outline-circle-default-gray/twitter@2x.png
Requested by
Host: info--ca.web.app
URL: https://info--ca.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.35.77.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-35-77-62.bos50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
aa0c3fca044d8fdcb10fe44f8fd4289559b67f5284c7bde74d6391d8e8f6a737

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://info--ca.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Wed, 19 Apr 2023 01:22:03 GMT
via
1.1 909fc123d4e8b7ecf80a806121a98be6.cloudfront.net (CloudFront)
last-modified
Mon, 28 Jan 2019 10:17:52 GMT
server
AmazonS3
x-amz-cf-pop
BOS50-C1
age
41279
etag
"76439f26880a25fa019f0229b3cc09d1"
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
image/png
accept-ranges
bytes
content-length
2673
x-amz-cf-id
p_4M6mTBcsXmNbvw8acwUlUui6NeTtHe39y-s2fiJrGtonQW13hRyg==
x-amz-meta-s3b-last-modified
20180109T142509Z
instagram@2x.png
app-rsrc.getbee.io/public/resources/social-networks-icon-sets/t-outline-circle-default-gray/
3 KB
4 KB
Image
General
Full URL
https://app-rsrc.getbee.io/public/resources/social-networks-icon-sets/t-outline-circle-default-gray/instagram@2x.png
Requested by
Host: info--ca.web.app
URL: https://info--ca.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.35.77.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-35-77-62.bos50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
801e6c236eee8e30d71a3d846e6a1bb673f6147061d93d2c77fa6db768289f2f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://info--ca.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Wed, 19 Apr 2023 01:41:14 GMT
via
1.1 909fc123d4e8b7ecf80a806121a98be6.cloudfront.net (CloudFront)
last-modified
Mon, 28 Jan 2019 10:17:49 GMT
server
AmazonS3
x-amz-cf-pop
BOS50-C1
age
40099
etag
"2e843664d34581e5cc2257e8c00fc5b9"
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
image/png
accept-ranges
bytes
content-length
3454
x-amz-cf-id
I9COeA08QW3ejjuMbyb5hlDQ7lNM-nEXyf4b7pnkuhoPn-6jhfRJ1Q==
x-amz-meta-s3b-last-modified
20180109T142509Z
youtube@2x.png
app-rsrc.getbee.io/public/resources/social-networks-icon-sets/t-outline-circle-default-gray/
2 KB
3 KB
Image
General
Full URL
https://app-rsrc.getbee.io/public/resources/social-networks-icon-sets/t-outline-circle-default-gray/youtube@2x.png
Requested by
Host: info--ca.web.app
URL: https://info--ca.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.35.77.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-35-77-62.bos50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
1bf18208572a399bfd13c097e683762d0201b3809ce4d9288e6e3070d8aecfc0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://info--ca.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Wed, 19 Apr 2023 03:51:08 GMT
via
1.1 909fc123d4e8b7ecf80a806121a98be6.cloudfront.net (CloudFront)
last-modified
Mon, 28 Jan 2019 10:17:53 GMT
server
AmazonS3
x-amz-cf-pop
BOS50-C1
age
32325
etag
"ed0c29e796629e605d94db59f40f7c9c"
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
image/png
accept-ranges
bytes
content-length
2508
x-amz-cf-id
6zzc35T3B9B1wcJZMoAPwrK5rEevhPbFHltQRqoUfqIsocUnvj0irQ==
x-amz-meta-s3b-last-modified
20180109T142509Z

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Credit Agricole (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload