urlscan.io logo urlscan.io
SecurityTrails logo

clients.smod70.com Open in urlscan Pro
2a06:ac01:cafe:3084::112  Public Scan

Go To Rescan Add Verdict Report
URL: https://clients.smod70.com/
Submission: On January 20 via automatic, source certstream-suspicious — Scanned from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 2a06:ac01:cafe:3084::112, located in France and belongs to ALTINEA-AS, FR. The main domain is clients.smod70.com.
TLS certificate: Issued by R3 on January 20th 2023. Valid for: 3 months.
This is the only time clients.smod70.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
8 2a06:ac01:caf... 41405 (ALTINEA-AS)
8 1
Apex Domain
Subdomains		 Transfer
8 smod70.com
clients.smod70.com
2 MB
8 1
Domain Requested by
8 clients.smod70.com clients.smod70.com
8 1

This site contains no links.

Subject Issuer Validity Valid
admin.torop.net
R3		 2023-01-20 -
2023-04-20		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://clients.smod70.com/
Frame ID: 22229C2B9D92824654B1ADD69FDEDCF5
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Torop.net

Page Statistics

8
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1977 kB
Transfer

1967 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
clients.smod70.com/ 		731 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://clients.smod70.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a06:ac01:cafe:3084::112 , France, ASN41405 (ALTINEA-AS, FR),
Reverse DNS
Software
/
Resource Hash
78a70cae7608b93093e7f44bfaec82616fef1699fb4591f3cc6a7ee315428d42
Security Headers
Name Value
Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;connect-src 'self' foreach.torop.net wss://foreach.torop.net data:;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data: blob: foreach.torop.net https://sp.tinymce.com;object-src 'none';script-src 'self' 'unsafe-inline';script-src-attr 'none';script-src-elem 'self' https://cdn.tiny.cloud;style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

accept-ranges
bytes
cache-control
public, max-age=0
content-length
731
content-security-policy
default-src 'self';base-uri 'self';block-all-mixed-content;connect-src 'self' foreach.torop.net wss://foreach.torop.net data:;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data: blob: foreach.torop.net https://sp.tinymce.com;object-src 'none';script-src 'self' 'unsafe-inline';script-src-attr 'none';script-src-elem 'self' https://cdn.tiny.cloud;style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Fri, 20 Jan 2023 10:07:11 GMT
etag
W/"2db-185ce7c3e18"
expect-ct
max-age=0
last-modified
Fri, 20 Jan 2023 09:22:07 GMT
referrer-policy
no-referrer
strict-transport-security
max-age=15552000; includeSubDomains
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-download-options
noopen
x-frame-options
SAMEORIGIN
x-permitted-cross-domain-policies
none
x-xss-protection
0
chunk-vendors.bcb61ca2.js
clients.smod70.com/js/ 		804 KB
807 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://clients.smod70.com/js/chunk-vendors.bcb61ca2.js
Requested by
Host: clients.smod70.com
URL: https://clients.smod70.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a06:ac01:cafe:3084::112 , France, ASN41405 (ALTINEA-AS, FR),
Reverse DNS
Software
/
Resource Hash
940f3300932389664fcafb6e350a44c65620153568fb602be06085bab56abfa7
Security Headers
Name Value
Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;connect-src 'self' foreach.torop.net wss://foreach.torop.net data:;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data: blob: foreach.torop.net https://sp.tinymce.com;object-src 'none';script-src 'self' 'unsafe-inline';script-src-attr 'none';script-src-elem 'self' https://cdn.tiny.cloud;style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Fri, 20 Jan 2023 10:07:11 GMT
content-security-policy
default-src 'self';base-uri 'self';block-all-mixed-content;connect-src 'self' foreach.torop.net wss://foreach.torop.net data:;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data: blob: foreach.torop.net https://sp.tinymce.com;object-src 'none';script-src 'self' 'unsafe-inline';script-src-attr 'none';script-src-elem 'self' https://cdn.tiny.cloud;style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies
none
x-dns-prefetch-control
off
content-length
823806
x-xss-protection
0
referrer-policy
no-referrer
last-modified
Fri, 20 Jan 2023 09:22:07 GMT
etag
W/"c91fe-185ce7c3e18"
expect-ct
max-age=0
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=UTF-8
x-download-options
noopen
cache-control
public, max-age=0
accept-ranges
bytes
app.48347c55.js
clients.smod70.com/js/ 		185 KB
186 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://clients.smod70.com/js/app.48347c55.js
Requested by
Host: clients.smod70.com
URL: https://clients.smod70.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a06:ac01:cafe:3084::112 , France, ASN41405 (ALTINEA-AS, FR),
Reverse DNS
Software
/
Resource Hash
362250721fc5209fa0ba93cd5c7bf1e6c50e503898e8011592eae83c813fbf5e
Security Headers
Name Value
Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;connect-src 'self' foreach.torop.net wss://foreach.torop.net data:;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data: blob: foreach.torop.net https://sp.tinymce.com;object-src 'none';script-src 'self' 'unsafe-inline';script-src-attr 'none';script-src-elem 'self' https://cdn.tiny.cloud;style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Fri, 20 Jan 2023 10:07:11 GMT
content-security-policy
default-src 'self';base-uri 'self';block-all-mixed-content;connect-src 'self' foreach.torop.net wss://foreach.torop.net data:;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data: blob: foreach.torop.net https://sp.tinymce.com;object-src 'none';script-src 'self' 'unsafe-inline';script-src-attr 'none';script-src-elem 'self' https://cdn.tiny.cloud;style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies
none
x-dns-prefetch-control
off
content-length
189697
x-xss-protection
0
referrer-policy
no-referrer
last-modified
Fri, 20 Jan 2023 09:22:07 GMT
etag
W/"2e501-185ce7c3e18"
expect-ct
max-age=0
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=UTF-8
x-download-options
noopen
cache-control
public, max-age=0
accept-ranges
bytes
chunk-vendors.cec73139.css
clients.smod70.com/css/ 		336 KB
337 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://clients.smod70.com/css/chunk-vendors.cec73139.css
Requested by
Host: clients.smod70.com
URL: https://clients.smod70.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a06:ac01:cafe:3084::112 , France, ASN41405 (ALTINEA-AS, FR),
Reverse DNS
Software
/
Resource Hash
83ee9759d792ffdc9ac3e9c6d24836fede48a4a5ab1c200253fb84333029f3d4
Security Headers
Name Value
Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;connect-src 'self' foreach.torop.net wss://foreach.torop.net data:;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data: blob: foreach.torop.net https://sp.tinymce.com;object-src 'none';script-src 'self' 'unsafe-inline';script-src-attr 'none';script-src-elem 'self' https://cdn.tiny.cloud;style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Fri, 20 Jan 2023 10:07:11 GMT
content-security-policy
default-src 'self';base-uri 'self';block-all-mixed-content;connect-src 'self' foreach.torop.net wss://foreach.torop.net data:;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data: blob: foreach.torop.net https://sp.tinymce.com;object-src 'none';script-src 'self' 'unsafe-inline';script-src-attr 'none';script-src-elem 'self' https://cdn.tiny.cloud;style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies
none
x-dns-prefetch-control
off
content-length
343712
x-xss-protection
0
referrer-policy
no-referrer
last-modified
Fri, 20 Jan 2023 09:22:07 GMT
etag
W/"53ea0-185ce7c3e18"
expect-ct
max-age=0
x-frame-options
SAMEORIGIN
content-type
text/css; charset=UTF-8
x-download-options
noopen
cache-control
public, max-age=0
accept-ranges
bytes
app.4ffa03c4.css
clients.smod70.com/css/ 		244 KB
245 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://clients.smod70.com/css/app.4ffa03c4.css
Requested by
Host: clients.smod70.com
URL: https://clients.smod70.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a06:ac01:cafe:3084::112 , France, ASN41405 (ALTINEA-AS, FR),
Reverse DNS
Software
/
Resource Hash
c8ee69b89252e7aa64e1a029a575c2469c7a1a392e65c4ef4ee1c8f2f616ac98
Security Headers
Name Value
Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;connect-src 'self' foreach.torop.net wss://foreach.torop.net data:;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data: blob: foreach.torop.net https://sp.tinymce.com;object-src 'none';script-src 'self' 'unsafe-inline';script-src-attr 'none';script-src-elem 'self' https://cdn.tiny.cloud;style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Fri, 20 Jan 2023 10:07:11 GMT
content-security-policy
default-src 'self';base-uri 'self';block-all-mixed-content;connect-src 'self' foreach.torop.net wss://foreach.torop.net data:;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data: blob: foreach.torop.net https://sp.tinymce.com;object-src 'none';script-src 'self' 'unsafe-inline';script-src-attr 'none';script-src-elem 'self' https://cdn.tiny.cloud;style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies
none
x-dns-prefetch-control
off
content-length
249586
x-xss-protection
0
referrer-policy
no-referrer
last-modified
Fri, 20 Jan 2023 09:22:07 GMT
etag
W/"3cef2-185ce7c3e18"
expect-ct
max-age=0
x-frame-options
SAMEORIGIN
content-type
text/css; charset=UTF-8
x-download-options
noopen
cache-control
public, max-age=0
accept-ranges
bytes
7629.6ca960b5.js
clients.smod70.com/js/ 		427 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://clients.smod70.com/js/7629.6ca960b5.js
Requested by
Host: clients.smod70.com
URL: https://clients.smod70.com/js/app.48347c55.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a06:ac01:cafe:3084::112 , France, ASN41405 (ALTINEA-AS, FR),
Reverse DNS
Software
/
Resource Hash
22eb3a90dc440b3eb2149e05a4771c2eb96eccad7fc7b94b572ef6b8a698e2ff
Security Headers
Name Value
Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;connect-src 'self' foreach.torop.net wss://foreach.torop.net data:;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data: blob: foreach.torop.net https://sp.tinymce.com;object-src 'none';script-src 'self' 'unsafe-inline';script-src-attr 'none';script-src-elem 'self' https://cdn.tiny.cloud;style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Fri, 20 Jan 2023 10:07:12 GMT
content-security-policy
default-src 'self';base-uri 'self';block-all-mixed-content;connect-src 'self' foreach.torop.net wss://foreach.torop.net data:;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data: blob: foreach.torop.net https://sp.tinymce.com;object-src 'none';script-src 'self' 'unsafe-inline';script-src-attr 'none';script-src-elem 'self' https://cdn.tiny.cloud;style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies
none
x-dns-prefetch-control
off
content-length
427
x-xss-protection
0
referrer-policy
no-referrer
last-modified
Fri, 20 Jan 2023 09:22:07 GMT
etag
W/"1ab-185ce7c3e18"
expect-ct
max-age=0
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=UTF-8
x-download-options
noopen
cache-control
public, max-age=0
accept-ranges
bytes
materialdesignicons-webfont.27a0fd11.woff2
clients.smod70.com/fonts/ 		383 KB
384 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://clients.smod70.com/fonts/materialdesignicons-webfont.27a0fd11.woff2
Requested by
Host: clients.smod70.com
URL: https://clients.smod70.com/css/chunk-vendors.cec73139.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a06:ac01:cafe:3084::112 , France, ASN41405 (ALTINEA-AS, FR),
Reverse DNS
Software
/
Resource Hash
739dc70ddd8affbac6e6a7a7cec3ff342fd28fcd77e3711a312c01845517a495
Security Headers
Name Value
Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;connect-src 'self' foreach.torop.net wss://foreach.torop.net data:;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data: blob: foreach.torop.net https://sp.tinymce.com;object-src 'none';script-src 'self' 'unsafe-inline';script-src-attr 'none';script-src-elem 'self' https://cdn.tiny.cloud;style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
Origin
https://clients.smod70.com
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Fri, 20 Jan 2023 10:07:12 GMT
content-security-policy
default-src 'self';base-uri 'self';block-all-mixed-content;connect-src 'self' foreach.torop.net wss://foreach.torop.net data:;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data: blob: foreach.torop.net https://sp.tinymce.com;object-src 'none';script-src 'self' 'unsafe-inline';script-src-attr 'none';script-src-elem 'self' https://cdn.tiny.cloud;style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies
none
x-dns-prefetch-control
off
content-length
391688
x-xss-protection
0
referrer-policy
no-referrer
last-modified
Fri, 20 Jan 2023 09:22:07 GMT
etag
W/"5fa08-185ce7c3e18"
expect-ct
max-age=0
x-frame-options
SAMEORIGIN
content-type
font/woff2
x-download-options
noopen
cache-control
public, max-age=0
accept-ranges
bytes
nunito-latin-400-normal.56c64e37.woff2
clients.smod70.com/fonts/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://clients.smod70.com/fonts/nunito-latin-400-normal.56c64e37.woff2
Requested by
Host: clients.smod70.com
URL: https://clients.smod70.com/css/chunk-vendors.cec73139.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a06:ac01:cafe:3084::112 , France, ASN41405 (ALTINEA-AS, FR),
Reverse DNS
Software
/
Resource Hash
5e2f97ea0fb92d5e3ae31eeef403b9c34363c8fb2a387e13cf381fa97f3e8cf7
Security Headers
Name Value
Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;connect-src 'self' foreach.torop.net wss://foreach.torop.net data:;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data: blob: foreach.torop.net https://sp.tinymce.com;object-src 'none';script-src 'self' 'unsafe-inline';script-src-attr 'none';script-src-elem 'self' https://cdn.tiny.cloud;style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
Origin
https://clients.smod70.com
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Fri, 20 Jan 2023 10:07:12 GMT
content-security-policy
default-src 'self';base-uri 'self';block-all-mixed-content;connect-src 'self' foreach.torop.net wss://foreach.torop.net data:;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data: blob: foreach.torop.net https://sp.tinymce.com;object-src 'none';script-src 'self' 'unsafe-inline';script-src-attr 'none';script-src-elem 'self' https://cdn.tiny.cloud;style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies
none
x-dns-prefetch-control
off
content-length
14060
x-xss-protection
0
referrer-policy
no-referrer
last-modified
Fri, 20 Jan 2023 09:22:07 GMT
etag
W/"36ec-185ce7c3e18"
expect-ct
max-age=0
x-frame-options
SAMEORIGIN
content-type
font/woff2
x-download-options
noopen
cache-control
public, max-age=0
accept-ranges
bytes

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange object| webpackChunkadmin_torop function| _ number| uidEvent boolean| __VUE__

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;connect-src 'self' foreach.torop.net wss://foreach.torop.net data:;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data: blob: foreach.torop.net https://sp.tinymce.com;object-src 'none';script-src 'self' 'unsafe-inline';script-src-attr 'none';script-src-elem 'self' https://cdn.tiny.cloud;style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0