URL: https://xvision.lenovo.com/
Submission: On December 14 via api from SG — Scanned from DE

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 10 HTTP transactions. The main IP is 2a02:26f0:3100:795::1e3d, located in Frankfurt am Main, Germany and belongs to AKAMAI-ASN1, NL. The main domain is xvision.lenovo.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on March 7th 2023. Valid for: a year.
This is the only time xvision.lenovo.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
8 2a02:26f0:310... 20940 (AKAMAI-ASN1)
1 2a02:26f0:310... 20940 (AKAMAI-ASN1)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
10 3
Apex Domain
Subdomains
Transfer
8 lenovo.com
xvision.lenovo.com
747 KB
2 go-mpulse.net
s.go-mpulse.net — Cisco Umbrella Rank: 1309
c.go-mpulse.net — Cisco Umbrella Rank: 595
59 KB
10 2
Domain Requested by
8 xvision.lenovo.com xvision.lenovo.com
1 c.go-mpulse.net s.go-mpulse.net
1 s.go-mpulse.net xvision.lenovo.com
10 3

This site contains no links.

Subject Issuer Validity Valid
*.lenovo.com
DigiCert TLS RSA SHA256 2020 CA1
2023-03-07 -
2024-03-07
a year crt.sh
akstat.io
DigiCert TLS RSA SHA256 2020 CA1
2023-04-05 -
2024-04-04
a year crt.sh

This page contains 2 frames:

Primary Page: https://xvision.lenovo.com/
Frame ID: B79BBE99AE2CC76D46E1012D23BF0B55
Requests: 8 HTTP requests in this frame

Frame: https://s.go-mpulse.net/boomerang/Q2N8S-R664C-2PYP4-6TAZ9-YF6GP
Frame ID: 4784D213485DA1DD6993EE53ACD6AC2D
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

Lenovo Meta

Detected technologies

Overall confidence: 100%
Detected patterns
  • backbone.*\.js

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

806 kB
Transfer

2517 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
xvision.lenovo.com/
4 KB
3 KB
Document
General
Full URL
https://xvision.lenovo.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3100:795::1e3d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
e8c2f552d380a42ed63ebc0043cf54b5555c8c4ea55a942b4b239a4773c4c985
Security Headers
Name Value
Content-Security-Policy default-src * blob: https: data: 'unsafe-inline' 'unsafe-eval';img-src * blob: data:; media-src * blob: data:; connect-src https: wss: blob: data:
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Xss-Protection 1;mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-credentials
true
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-encoding
gzip
content-length
2155
content-security-policy
default-src * blob: https: data: 'unsafe-inline' 'unsafe-eval';img-src * blob: data:; media-src * blob: data:; connect-src https: wss: blob: data:
content-type
text/html
date
Thu, 14 Dec 2023 17:02:16 GMT
etag
"631092a3-279"
expires
Thu, 14 Dec 2023 17:02:16 GMT
last-modified
Thu, 01 Sep 2022 11:08:19 GMT
pragma
no-cache
referrer-policy
no-referrer
server
nginx/1.24.0
server-timing
edge; dur=84 origin; dur=1186 cdn-cache; desc=MISS ak_p; desc="1702573335162_35063573_303428193_127086_2754_5_41_255";dur=1
strict-transport-security
max-age=31536000; includeSubdomains;
vary
Accept-Encoding
x-akamai-transformed
9 633 0 pmb=mRUM,2
x-content-type-options
nosniff
x-xss-protection
1;mode=block
vendor.b9aa7483.js
xvision.lenovo.com/
110 KB
42 KB
Script
General
Full URL
https://xvision.lenovo.com/vendor.b9aa7483.js
Requested by
Host: xvision.lenovo.com
URL: https://xvision.lenovo.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3100:795::1e3d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
0e0defaccce4ca8fcfd9fd34f4f4fdd08172873d190f16a026c11a1ad5300d34
Security Headers
Name Value
Content-Security-Policy default-src * blob: https: data: 'unsafe-inline' 'unsafe-eval';img-src * blob: data:; media-src * blob: data:; connect-src https: wss: blob: data:
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy
default-src * blob: https: data: 'unsafe-inline' 'unsafe-eval';img-src * blob: data:; media-src * blob: data:; connect-src https: wss: blob: data:
strict-transport-security
max-age=31536000; includeSubdomains;
x-content-type-options
nosniff
date
Thu, 14 Dec 2023 17:02:18 GMT
content-encoding
gzip
server-timing
cdn-cache; desc=HIT, edge; dur=1703, ak_p; desc="1702573336504_35063573_303434659_170287_1663_6_0_219";dur=1
x-xss-protection
1;mode=block
referrer-policy
no-referrer
last-modified
Thu, 01 Sep 2022 11:08:19 GMT
server
nginx/1.24.0
etag
W/"631092a3-1b99b"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
access-control-allow-credentials
true
expires
Fri, 15 Dec 2023 17:02:18 GMT
bundle.b9aa7483.js
xvision.lenovo.com/
529 KB
179 KB
Script
General
Full URL
https://xvision.lenovo.com/bundle.b9aa7483.js
Requested by
Host: xvision.lenovo.com
URL: https://xvision.lenovo.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3100:795::1e3d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
cf8f2a7c6f3d9c46661c379f44f36e610d6c872f3dfa4d81981067ca9bb419c8
Security Headers
Name Value
Content-Security-Policy default-src * blob: https: data: 'unsafe-inline' 'unsafe-eval';img-src * blob: data:; media-src * blob: data:; connect-src https: wss: blob: data:
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy
default-src * blob: https: data: 'unsafe-inline' 'unsafe-eval';img-src * blob: data:; media-src * blob: data:; connect-src https: wss: blob: data:
strict-transport-security
max-age=31536000; includeSubdomains;
x-content-type-options
nosniff
date
Thu, 14 Dec 2023 17:02:17 GMT
content-encoding
gzip
server-timing
cdn-cache; desc=HIT, edge; dur=1418, ak_p; desc="1702573336504_35063573_303434660_141745_1860_6_0_219";dur=1
x-xss-protection
1;mode=block
referrer-policy
no-referrer
last-modified
Thu, 01 Sep 2022 11:08:23 GMT
server
nginx/1.24.0
etag
W/"631092a7-84358"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
access-control-allow-credentials
true
expires
Fri, 15 Dec 2023 17:02:17 GMT
Q2N8S-R664C-2PYP4-6TAZ9-YF6GP
s.go-mpulse.net/boomerang/ Frame 4784
205 KB
58 KB
Script
General
Full URL
https://s.go-mpulse.net/boomerang/Q2N8S-R664C-2PYP4-6TAZ9-YF6GP
Requested by
Host: xvision.lenovo.com
URL: https://xvision.lenovo.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:3100:795::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 14 Dec 2023 17:02:16 GMT
content-encoding
gzip
customappheader
mpulse-ab-boomr__git__2226cf4__git__2226cf4__p19.alsi10-lite
last-modified
Thu, 01 Jan 1970 00:00:01 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=604800
timing-allow-origin
*
content-length
59160
config.json
c.go-mpulse.net/api/ Frame 4784
684 B
957 B
XHR
General
Full URL
https://c.go-mpulse.net/api/config.json?key=Q2N8S-R664C-2PYP4-6TAZ9-YF6GP&d=xvision.lenovo.com&t=5675244&v=1.720.0&if=&sl=0&si=4dc68cf5-0a37-4637-a5eb-365acf4f6a92-s5o1zr&plugins=AK,ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao=&ak.ai=663963
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/Q2N8S-R664C-2PYP4-6TAZ9-YF6GP
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:3500:991::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
5207dce64c284b3d7a20491f4c1ddbf4e89ed36a0a96caf61b18ec89aae14b3a

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 14 Dec 2023 17:02:16 GMT
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
684
Content-Type
application/json
0.b9aa7483.js
xvision.lenovo.com/
612 KB
182 KB
Script
General
Full URL
https://xvision.lenovo.com/0.b9aa7483.js
Requested by
Host: xvision.lenovo.com
URL: https://xvision.lenovo.com/bundle.b9aa7483.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3100:795::1e3d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
3ee8cb55eb248f0ffa444a6fed71bcd6cca02573d83a9865c8621c532d4f385f
Security Headers
Name Value
Content-Security-Policy default-src * blob: https: data: 'unsafe-inline' 'unsafe-eval';img-src * blob: data:; media-src * blob: data:; connect-src https: wss: blob: data:
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy
default-src * blob: https: data: 'unsafe-inline' 'unsafe-eval';img-src * blob: data:; media-src * blob: data:; connect-src https: wss: blob: data:
strict-transport-security
max-age=31536000; includeSubdomains;
x-content-type-options
nosniff
date
Thu, 14 Dec 2023 17:02:19 GMT
content-encoding
gzip
server-timing
edge; dur=286, origin; dur=281, cdn-cache; desc=MISS, ak_p; desc="1702573339340_35063573_303448211_56713_1336_6_0_146";dur=1
x-xss-protection
1;mode=block
referrer-policy
no-referrer
last-modified
Thu, 01 Sep 2022 11:08:43 GMT
server
nginx/1.24.0
etag
W/"631092bb-99079"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
access-control-allow-credentials
true
expires
Fri, 15 Dec 2023 17:02:19 GMT
1.b9aa7483.js
xvision.lenovo.com/
42 KB
15 KB
Script
General
Full URL
https://xvision.lenovo.com/1.b9aa7483.js
Requested by
Host: xvision.lenovo.com
URL: https://xvision.lenovo.com/bundle.b9aa7483.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3100:795::1e3d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
3fc972ab6cdace255b12a16b2b520b72effa9f6e013d78312071131e94f5ffe5
Security Headers
Name Value
Content-Security-Policy default-src * blob: https: data: 'unsafe-inline' 'unsafe-eval';img-src * blob: data:; media-src * blob: data:; connect-src https: wss: blob: data:
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy
default-src * blob: https: data: 'unsafe-inline' 'unsafe-eval';img-src * blob: data:; media-src * blob: data:; connect-src https: wss: blob: data:
strict-transport-security
max-age=31536000; includeSubdomains;
x-content-type-options
nosniff
date
Thu, 14 Dec 2023 17:02:20 GMT
content-encoding
gzip
server-timing
edge; dur=19, origin; dur=1246, cdn-cache; desc=MISS, ak_p; desc="1702573339341_35063573_303448212_126565_1343_11_0_146";dur=1
content-length
14826
x-xss-protection
1;mode=block
referrer-policy
no-referrer
last-modified
Thu, 01 Sep 2022 11:08:42 GMT
server
nginx/1.24.0
etag
W/"631092ba-a662"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
access-control-allow-credentials
true
expires
Fri, 15 Dec 2023 17:02:20 GMT
2.b9aa7483.js
xvision.lenovo.com/
15 KB
6 KB
Script
General
Full URL
https://xvision.lenovo.com/2.b9aa7483.js
Requested by
Host: xvision.lenovo.com
URL: https://xvision.lenovo.com/bundle.b9aa7483.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3100:795::1e3d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
2e0660730a232d758770085f402e58888212e096175f4b9429facff5c250549f
Security Headers
Name Value
Content-Security-Policy default-src * blob: https: data: 'unsafe-inline' 'unsafe-eval';img-src * blob: data:; media-src * blob: data:; connect-src https: wss: blob: data:
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy
default-src * blob: https: data: 'unsafe-inline' 'unsafe-eval';img-src * blob: data:; media-src * blob: data:; connect-src https: wss: blob: data:
strict-transport-security
max-age=31536000; includeSubdomains;
x-content-type-options
nosniff
date
Thu, 14 Dec 2023 17:02:20 GMT
content-encoding
gzip
server-timing
edge; dur=2, origin; dur=859, cdn-cache; desc=MISS, ak_p; desc="1702573339340_35063573_303448213_86101_1106_6_0_146";dur=1
content-length
5193
x-xss-protection
1;mode=block
referrer-policy
no-referrer
last-modified
Thu, 01 Sep 2022 11:08:37 GMT
server
nginx/1.24.0
etag
W/"631092b5-3a51"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
access-control-allow-credentials
true
expires
Fri, 15 Dec 2023 17:02:20 GMT
5.b9aa7483.js
xvision.lenovo.com/
14 KB
6 KB
Script
General
Full URL
https://xvision.lenovo.com/5.b9aa7483.js
Requested by
Host: xvision.lenovo.com
URL: https://xvision.lenovo.com/bundle.b9aa7483.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3100:795::1e3d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
b530aba820ea76681216421674f5b48cf4a115ac509128c31cb4bb3742ec11b4
Security Headers
Name Value
Content-Security-Policy default-src * blob: https: data: 'unsafe-inline' 'unsafe-eval';img-src * blob: data:; media-src * blob: data:; connect-src https: wss: blob: data:
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy
default-src * blob: https: data: 'unsafe-inline' 'unsafe-eval';img-src * blob: data:; media-src * blob: data:; connect-src https: wss: blob: data:
strict-transport-security
max-age=31536000; includeSubdomains;
x-content-type-options
nosniff
date
Thu, 14 Dec 2023 17:02:19 GMT
content-encoding
gzip
server-timing
edge; dur=1, origin; dur=293, cdn-cache; desc=MISS, ak_p; desc="1702573339340_35063573_303448214_29397_1438_6_0_146";dur=1
content-length
5905
x-xss-protection
1;mode=block
referrer-policy
no-referrer
last-modified
Thu, 01 Sep 2022 11:08:30 GMT
server
nginx/1.24.0
etag
W/"631092ae-39de"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
access-control-allow-credentials
true
expires
Fri, 15 Dec 2023 17:02:19 GMT
206.b9aa7483.js
xvision.lenovo.com/
985 KB
315 KB
Script
General
Full URL
https://xvision.lenovo.com/206.b9aa7483.js
Requested by
Host: xvision.lenovo.com
URL: https://xvision.lenovo.com/bundle.b9aa7483.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3100:795::1e3d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * blob: https: data: 'unsafe-inline' 'unsafe-eval';img-src * blob: data:; media-src * blob: data:; connect-src https: wss: blob: data:
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy
default-src * blob: https: data: 'unsafe-inline' 'unsafe-eval';img-src * blob: data:; media-src * blob: data:; connect-src https: wss: blob: data:
strict-transport-security
max-age=31536000; includeSubdomains;
x-content-type-options
nosniff
date
Thu, 14 Dec 2023 17:02:22 GMT
content-encoding
gzip
server-timing
edge; dur=295, origin; dur=2393, cdn-cache; desc=MISS, ak_p; desc="1702573339340_35063573_303448215_268850_1289_8_0_146";dur=1
x-xss-protection
1;mode=block
referrer-policy
no-referrer
last-modified
Thu, 01 Sep 2022 11:08:37 GMT
server
nginx/1.24.0
etag
W/"631092b5-f63b2"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86399
access-control-allow-credentials
true
expires
Fri, 15 Dec 2023 17:02:21 GMT

Verdicts & Comments Add Verdict or Comment

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture string| _trackDataType object| _trackData number| _la_lenovo_website object| BOOMR_mq string| BOOMR_API_key object| BOOMR number| BOOMR_lstart number| BOOMR_configt object| core object| __core-js_shared__ object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill function| Browser object| browserInfo object| webpackJsonp object| IntlPolyfill

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src * blob: https: data: 'unsafe-inline' 'unsafe-eval';img-src * blob: data:; media-src * blob: data:; connect-src https: wss: blob: data:
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Xss-Protection 1;mode=block