URL: https://pass.lostgmbh.de/
Submission: On September 13 via api from US — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 15 HTTP transactions. The main IP is 45.157.11.38, located in Vélizy-Villacoublay, France and belongs to DATAFOREST, DE. The main domain is pass.lostgmbh.de.
TLS certificate: Issued by R10 on September 13th 2024. Valid for: 3 months.
This is the only time pass.lostgmbh.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
15 45.157.11.38 58212 (DATAFOREST)
15 1
Apex Domain
Subdomains
Transfer
15 lostgmbh.de
pass.lostgmbh.de
1 MB
15 1
Domain Requested by
15 pass.lostgmbh.de pass.lostgmbh.de
15 1

This site contains links to these domains. Also see Links.

Domain
chrome.google.com
psono.com
Subject Issuer Validity Valid
pass.lostgmbh.de
R10
2024-09-13 -
2024-12-12
3 months crt.sh

This page contains 1 frames:

Primary Page: https://pass.lostgmbh.de/
Frame ID: F52BCA1BB67384AE9985DCAEDA2FBBC5
Requests: 15 HTTP requests in this frame

Screenshot

Page Title

Psono

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1127 kB
Transfer

3903 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
pass.lostgmbh.de/
1 KB
1 KB
Document
General
Full URL
https://pass.lostgmbh.de/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.157.11.38 Vélizy-Villacoublay, France, ASN58212 (DATAFOREST, DE),
Reverse DNS
Software
nginx /
Resource Hash
788a3f6bb4a66c6e01302ba29dcd51990394fce637e208f5a88a7b0eb4423916
Security Headers
Name Value
Content-Security-Policy default-src 'none'; manifest-src 'self'; connect-src 'self' https://static.psono.com https://api.pwnedpasswords.com https://storage.googleapis.com https://*.digitaloceanspaces.com https://*.blob.core.windows.net https://*.s3.amazonaws.com; font-src 'self'; img-src 'self' data:; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'self'; child-src 'self'
X-Content-Type-Options nosniff nosniff
X-Frame-Options DENY DENY
X-Xss-Protection 1; mode=block 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-encoding
gzip
content-security-policy
default-src 'none'; manifest-src 'self'; connect-src 'self' https://static.psono.com https://api.pwnedpasswords.com https://storage.googleapis.com https://*.digitaloceanspaces.com https://*.blob.core.windows.net https://*.s3.amazonaws.com; font-src 'self'; img-src 'self' data:; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'self'; child-src 'self'
content-type
text/html
date
Fri, 13 Sep 2024 13:22:46 GMT
etag
W/"66d7270e-57b"
last-modified
Tue, 03 Sep 2024 15:11:10 GMT
referrer-policy
same-origin same-origin
server
nginx
vary
Accept-Encoding Accept-Encoding
x-content-type-options
nosniff nosniff
x-frame-options
DENY DENY
x-xss-protection
1; mode=block 1; mode=block
font-awesome.min.css
pass.lostgmbh.de/css/lib/
30 KB
7 KB
Stylesheet
General
Full URL
https://pass.lostgmbh.de/css/lib/font-awesome.min.css
Requested by
Host: pass.lostgmbh.de
URL: https://pass.lostgmbh.de/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.157.11.38 Vélizy-Villacoublay, France, ASN58212 (DATAFOREST, DE),
Reverse DNS
Software
nginx /
Resource Hash
8876205b677417b4a65eaf1826b634633a9e9b076f637f03646baab117474b51

Request headers

Referer
https://pass.lostgmbh.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma
public, public
date
Fri, 13 Sep 2024 13:22:46 GMT
content-encoding
gzip
last-modified
Tue, 03 Sep 2024 15:11:10 GMT
server
nginx
etag
W/"66d7270e-792e"
vary
Accept-Encoding, Accept-Encoding
content-type
text/css
cache-control
max-age=2592000, public
expires
Sun, 13 Oct 2024 13:22:46 GMT
angular-tree-view.css
pass.lostgmbh.de/css/
6 KB
2 KB
Stylesheet
General
Full URL
https://pass.lostgmbh.de/css/angular-tree-view.css
Requested by
Host: pass.lostgmbh.de
URL: https://pass.lostgmbh.de/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.157.11.38 Vélizy-Villacoublay, France, ASN58212 (DATAFOREST, DE),
Reverse DNS
Software
nginx /
Resource Hash
8200bffd76af2eefbcd629feb79f000a31e8764b6b6f3d5e745a04a576b8aa5e

Request headers

Referer
https://pass.lostgmbh.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma
public, public
date
Fri, 13 Sep 2024 13:22:46 GMT
content-encoding
gzip
last-modified
Tue, 03 Sep 2024 15:11:10 GMT
server
nginx
etag
W/"66d7270e-1794"
vary
Accept-Encoding, Accept-Encoding
content-type
text/css
cache-control
max-age=2592000, public
expires
Sun, 13 Oct 2024 13:22:46 GMT
style.css
pass.lostgmbh.de/css/
8 KB
2 KB
Stylesheet
General
Full URL
https://pass.lostgmbh.de/css/style.css
Requested by
Host: pass.lostgmbh.de
URL: https://pass.lostgmbh.de/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.157.11.38 Vélizy-Villacoublay, France, ASN58212 (DATAFOREST, DE),
Reverse DNS
Software
nginx /
Resource Hash
8d6958f1135e3bc4d9d5514b7f0ebfd2b8c9ccc52ef00505cdeb6ea0cccbe117

Request headers

Referer
https://pass.lostgmbh.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma
public, public
date
Fri, 13 Sep 2024 13:22:46 GMT
content-encoding
gzip
last-modified
Tue, 03 Sep 2024 15:11:10 GMT
server
nginx
etag
W/"66d7270e-1ea3"
vary
Accept-Encoding, Accept-Encoding
content-type
text/css
cache-control
max-age=2592000, public
expires
Sun, 13 Oct 2024 13:22:46 GMT
datastore.css
pass.lostgmbh.de/css/
2 KB
1 KB
Stylesheet
General
Full URL
https://pass.lostgmbh.de/css/datastore.css
Requested by
Host: pass.lostgmbh.de
URL: https://pass.lostgmbh.de/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.157.11.38 Vélizy-Villacoublay, France, ASN58212 (DATAFOREST, DE),
Reverse DNS
Software
nginx /
Resource Hash
ff9102c49ac4874c7ed46c166fbe61e4d0529488826a4b6b934f32bd42c7e154

Request headers

Referer
https://pass.lostgmbh.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma
public, public
date
Fri, 13 Sep 2024 13:22:46 GMT
content-encoding
gzip
last-modified
Tue, 03 Sep 2024 15:11:10 GMT
server
nginx
etag
W/"66d7270e-9fd"
vary
Accept-Encoding, Accept-Encoding
content-type
text/css
cache-control
max-age=2592000, public
expires
Sun, 13 Oct 2024 13:22:46 GMT
bundle.min.js
pass.lostgmbh.de/js/
4 MB
1009 KB
Script
General
Full URL
https://pass.lostgmbh.de/js/bundle.min.js
Requested by
Host: pass.lostgmbh.de
URL: https://pass.lostgmbh.de/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.157.11.38 Vélizy-Villacoublay, France, ASN58212 (DATAFOREST, DE),
Reverse DNS
Software
nginx /
Resource Hash
671d6bae04dedb653a0ed7a0864aea49aaea9c41f222cad4cc7bff817ff0df76

Request headers

Referer
https://pass.lostgmbh.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma
public, public
date
Fri, 13 Sep 2024 13:22:46 GMT
content-encoding
gzip
last-modified
Tue, 03 Sep 2024 15:11:10 GMT
server
nginx
etag
W/"66d7270e-39f4e6"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cache-control
max-age=2592000, public
expires
Sun, 13 Oct 2024 13:22:46 GMT
service-worker-load.js
pass.lostgmbh.de/js/
181 B
416 B
Script
General
Full URL
https://pass.lostgmbh.de/js/service-worker-load.js
Requested by
Host: pass.lostgmbh.de
URL: https://pass.lostgmbh.de/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.157.11.38 Vélizy-Villacoublay, France, ASN58212 (DATAFOREST, DE),
Reverse DNS
Software
nginx /
Resource Hash
791b0a741c7aa2d0691e7068d66beeacfa2efa4c6296d017b3499d015c39dc97

Request headers

Referer
https://pass.lostgmbh.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma
public, public
date
Fri, 13 Sep 2024 13:22:46 GMT
last-modified
Tue, 03 Sep 2024 15:11:10 GMT
server
nginx
etag
"66d7270e-b5"
content-type
application/javascript
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
181
expires
Sun, 13 Oct 2024 13:22:46 GMT
locale-en.json
pass.lostgmbh.de/translations/
59 KB
20 KB
Fetch
General
Full URL
https://pass.lostgmbh.de/translations/locale-en.json
Requested by
Host: pass.lostgmbh.de
URL: https://pass.lostgmbh.de/js/bundle.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.157.11.38 Vélizy-Villacoublay, France, ASN58212 (DATAFOREST, DE),
Reverse DNS
Software
nginx /
Resource Hash
5ce7ffee510d26435b91a9e66aa43c7e489602b862a1d2fd3fce10bd52c8e812
Security Headers
Name Value
Content-Security-Policy default-src 'none'; manifest-src 'self'; connect-src 'self' https://static.psono.com https://api.pwnedpasswords.com https://storage.googleapis.com https://*.digitaloceanspaces.com https://*.blob.core.windows.net https://*.s3.amazonaws.com; font-src 'self'; img-src 'self' data:; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'self'; child-src 'self'
X-Content-Type-Options nosniff, nosniff
X-Frame-Options DENY, DENY
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

Referer
https://pass.lostgmbh.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 13 Sep 2024 13:22:47 GMT
content-security-policy
default-src 'none'; manifest-src 'self'; connect-src 'self' https://static.psono.com https://api.pwnedpasswords.com https://storage.googleapis.com https://*.digitaloceanspaces.com https://*.blob.core.windows.net https://*.s3.amazonaws.com; font-src 'self'; img-src 'self' data:; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'self'; child-src 'self'
referrer-policy
same-origin, same-origin
x-content-type-options
nosniff, nosniff
last-modified
Tue, 03 Sep 2024 15:11:10 GMT
server
nginx
content-encoding
gzip
etag
W/"66d7270e-edb5"
vary
Accept-Encoding, Accept-Encoding
x-frame-options
DENY, DENY
content-type
application/json
x-xss-protection
1; mode=block, 1; mode=block
favicon.ico
pass.lostgmbh.de/img/
1 KB
941 B
Other
General
Full URL
https://pass.lostgmbh.de/img/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.157.11.38 Vélizy-Villacoublay, France, ASN58212 (DATAFOREST, DE),
Reverse DNS
Software
nginx /
Resource Hash
2c9b0fbd1aa2560488f69f8753f24f67fa1088f82f830b8e2d0a22ba37567f07

Request headers

Referer
https://pass.lostgmbh.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma
public, public
date
Fri, 13 Sep 2024 13:22:47 GMT
content-encoding
gzip
last-modified
Tue, 03 Sep 2024 15:11:10 GMT
server
nginx
etag
W/"66d7270e-47e"
vary
Accept-Encoding, Accept-Encoding
content-type
image/x-icon
cache-control
max-age=2592000, public
expires
Sun, 13 Oct 2024 13:22:47 GMT
favicon-32x32.png
pass.lostgmbh.de/img/
2 KB
2 KB
Other
General
Full URL
https://pass.lostgmbh.de/img/favicon-32x32.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.157.11.38 Vélizy-Villacoublay, France, ASN58212 (DATAFOREST, DE),
Reverse DNS
Software
nginx /
Resource Hash
f41299624343690ea19a0926fc8ef355e0d3b1437e3cf4b1ae3542468c033bbf

Request headers

Referer
https://pass.lostgmbh.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma
public, public
date
Fri, 13 Sep 2024 13:22:47 GMT
last-modified
Tue, 03 Sep 2024 15:11:10 GMT
server
nginx
etag
"66d7270e-70d"
content-type
image/png
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
1805
expires
Sun, 13 Oct 2024 13:22:47 GMT
fontawesome-webfont.woff2
pass.lostgmbh.de/fonts/
75 KB
76 KB
Font
General
Full URL
https://pass.lostgmbh.de/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: pass.lostgmbh.de
URL: https://pass.lostgmbh.de/css/lib/font-awesome.min.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.157.11.38 Vélizy-Villacoublay, France, ASN58212 (DATAFOREST, DE),
Reverse DNS
Software
nginx /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer
https://pass.lostgmbh.de/css/lib/font-awesome.min.css
Origin
https://pass.lostgmbh.de
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma
public, public
date
Fri, 13 Sep 2024 13:22:47 GMT
last-modified
Tue, 03 Sep 2024 15:11:10 GMT
server
nginx
etag
"66d7270e-12d68"
content-type
font/woff2
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
77160
expires
Sun, 13 Oct 2024 13:22:47 GMT
config.json
pass.lostgmbh.de/
346 B
0
Fetch
General
Full URL
https://pass.lostgmbh.de/config.json
Requested by
Host: pass.lostgmbh.de
URL: https://pass.lostgmbh.de/js/bundle.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.157.11.38 Vélizy-Villacoublay, France, ASN58212 (DATAFOREST, DE),
Reverse DNS
Software
nginx /
Resource Hash
477cc55049c70db5fdaa51c3729877c32e758ddbf5ce0cd90509c958053e4847
Security Headers
Name Value
Content-Security-Policy default-src 'none'; manifest-src 'self'; connect-src 'self' https://static.psono.com https://api.pwnedpasswords.com https://storage.googleapis.com https://*.digitaloceanspaces.com https://*.blob.core.windows.net https://*.s3.amazonaws.com; font-src 'self'; img-src 'self' data:; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'self'; child-src 'self'
X-Content-Type-Options nosniff, nosniff
X-Frame-Options DENY, DENY
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

Referer
https://pass.lostgmbh.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 13 Sep 2024 13:22:47 GMT
content-security-policy
default-src 'none'; manifest-src 'self'; connect-src 'self' https://static.psono.com https://api.pwnedpasswords.com https://storage.googleapis.com https://*.digitaloceanspaces.com https://*.blob.core.windows.net https://*.s3.amazonaws.com; font-src 'self'; img-src 'self' data:; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'self'; child-src 'self'
referrer-policy
same-origin, same-origin
x-content-type-options
nosniff, nosniff
last-modified
Thu, 12 Sep 2024 18:55:05 GMT
server
nginx
content-encoding
gzip
etag
W/"66e33909-15a"
vary
Accept-Encoding, Accept-Encoding
x-frame-options
DENY, DENY
content-type
application/json
x-xss-protection
1; mode=block, 1; mode=block
logo.png
pass.lostgmbh.de/img/
5 KB
5 KB
Image
General
Full URL
https://pass.lostgmbh.de/img/logo.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.157.11.38 Vélizy-Villacoublay, France, ASN58212 (DATAFOREST, DE),
Reverse DNS
Software
nginx /
Resource Hash
f41e6fc0a145544148897c43d1e1463d78c0327b6d4d7e760f98b52f0f72625e

Request headers

Referer
https://pass.lostgmbh.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma
public, public
date
Fri, 13 Sep 2024 13:22:47 GMT
last-modified
Tue, 03 Sep 2024 15:11:10 GMT
server
nginx
etag
"66d7270e-1216"
content-type
image/png
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
4630
expires
Sun, 13 Oct 2024 13:22:47 GMT
favicon.ico
pass.lostgmbh.de/img/
1 KB
0
Other
General
Full URL
https://pass.lostgmbh.de/img/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.157.11.38 Vélizy-Villacoublay, France, ASN58212 (DATAFOREST, DE),
Reverse DNS
Software
nginx /
Resource Hash
2c9b0fbd1aa2560488f69f8753f24f67fa1088f82f830b8e2d0a22ba37567f07

Request headers

Referer
https://pass.lostgmbh.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma
public, public
date
Fri, 13 Sep 2024 13:22:47 GMT
content-encoding
gzip
last-modified
Tue, 03 Sep 2024 15:11:10 GMT
server
nginx
etag
W/"66d7270e-47e"
vary
Accept-Encoding, Accept-Encoding
content-type
image/x-icon
cache-control
max-age=2592000, public
expires
Sun, 13 Oct 2024 13:22:47 GMT
favicon-32x32.png
pass.lostgmbh.de/img/
2 KB
0
Other
General
Full URL
https://pass.lostgmbh.de/img/favicon-32x32.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.157.11.38 Vélizy-Villacoublay, France, ASN58212 (DATAFOREST, DE),
Reverse DNS
Software
nginx /
Resource Hash
f41299624343690ea19a0926fc8ef355e0d3b1437e3cf4b1ae3542468c033bbf

Request headers

Referer
https://pass.lostgmbh.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma
public, public
date
Fri, 13 Sep 2024 13:22:47 GMT
last-modified
Tue, 03 Sep 2024 15:11:10 GMT
server
nginx
etag
"66d7270e-70d"
content-type
image/png
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
1805
expires
Sun, 13 Oct 2024 13:22:47 GMT

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| regeneratorRuntime object| __SENTRY__ number| 2f1acc6c3a606b082e5eef5e54414ffb function| saveAs

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'none'; manifest-src 'self'; connect-src 'self' https://static.psono.com https://api.pwnedpasswords.com https://storage.googleapis.com https://*.digitaloceanspaces.com https://*.blob.core.windows.net https://*.s3.amazonaws.com; font-src 'self'; img-src 'self' data:; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'self'; child-src 'self'
X-Content-Type-Options nosniff nosniff
X-Frame-Options DENY DENY
X-Xss-Protection 1; mode=block 1; mode=block