Submitted URL: https://secureserver.dev.xion.oxcs.net/
Effective URL: https://secureserver.dev.xion.oxcs.net/appsuite/
Submission: On January 04 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 185.74.64.112, located in Germany and belongs to X-ION, DE. The main domain is secureserver.dev.xion.oxcs.net.
TLS certificate: Issued by R3 on January 4th 2023. Valid for: 3 months.
This is the only time secureserver.dev.xion.oxcs.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 13 185.74.64.112 60664 (X-ION)
12 1
Apex Domain
Subdomains
Transfer
13 oxcs.net
secureserver.dev.xion.oxcs.net
488 KB
12 1
Domain Requested by
13 secureserver.dev.xion.oxcs.net 1 redirects secureserver.dev.xion.oxcs.net
12 1

This site contains no links.

Subject Issuer Validity Valid
secureserver.dev.xion.oxcs.net
R3
2023-01-04 -
2023-04-04
3 months crt.sh

This page contains 1 frames:

Primary Page: https://secureserver.dev.xion.oxcs.net/appsuite/
Frame ID: 07C45CC7018DB38648B6C0053B6ECA48
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

Sign in - OX App Suite

Page URL History Show full URLs

  1. https://secureserver.dev.xion.oxcs.net/ HTTP 302
    https://secureserver.dev.xion.oxcs.net/appsuite/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

487 kB
Transfer

1523 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://secureserver.dev.xion.oxcs.net/ HTTP 302
    https://secureserver.dev.xion.oxcs.net/appsuite/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
secureserver.dev.xion.oxcs.net/appsuite/
Redirect Chain
  • https://secureserver.dev.xion.oxcs.net/
  • https://secureserver.dev.xion.oxcs.net/appsuite/
11 KB
4 KB
Document
General
Full URL
https://secureserver.dev.xion.oxcs.net/appsuite/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.74.64.112 , Germany, ASN60664 (X-ION, DE),
Reverse DNS
Software
nginx /
Resource Hash
945bc9626dd97725274302e0f4d1e60f3075912728ba0158d3198fe20f7c65bc
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=0
Connection
keep-alive
Content-Encoding
gzip
Content-Length
3709
Content-Type
text/html
Date
Wed, 04 Jan 2023 11:17:25 GMT
ETag
"2ac0-5ae2c322695b4-gzip"
Expires
Wed, 04 Jan 2023 11:17:25 GMT
Last-Modified
Mon, 31 Aug 2020 13:15:26 GMT
Server
nginx
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN

Redirect headers

Connection
keep-alive
Content-Length
236
Content-Type
text/html; charset=iso-8859-1
Date
Wed, 04 Jan 2023 11:17:25 GMT
Location
https://secureserver.dev.xion.oxcs.net/appsuite/
Server
nginx
login.css
secureserver.dev.xion.oxcs.net/appsuite/v=7.10.3-18.20200831.131526/apps/themes/login/
42 KB
9 KB
Stylesheet
General
Full URL
https://secureserver.dev.xion.oxcs.net/appsuite/v=7.10.3-18.20200831.131526/apps/themes/login/login.css
Requested by
Host: secureserver.dev.xion.oxcs.net
URL: https://secureserver.dev.xion.oxcs.net/appsuite/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.74.64.112 , Germany, ASN60664 (X-ION, DE),
Reverse DNS
Software
nginx /
Resource Hash
3285d080b9abe8e3dacbc7c07153f33dbb6e800e359a4bb0ead19cc5cb131730
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secureserver.dev.xion.oxcs.net/appsuite/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date
Wed, 04 Jan 2023 11:17:25 GMT
Content-Encoding
gzip
Server
nginx
X-Frame-Options
SAMEORIGIN
Content-Type
text/css
Cache-Control
max-age=15552000, private
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
8941
Expires
Mon, 03 Jul 2023 11:17:25 GMT
boot.js
secureserver.dev.xion.oxcs.net/appsuite/v=7.10.3-18.20200831.131526/
657 KB
181 KB
Script
General
Full URL
https://secureserver.dev.xion.oxcs.net/appsuite/v=7.10.3-18.20200831.131526/boot.js
Requested by
Host: secureserver.dev.xion.oxcs.net
URL: https://secureserver.dev.xion.oxcs.net/appsuite/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.74.64.112 , Germany, ASN60664 (X-ION, DE),
Reverse DNS
Software
nginx /
Resource Hash
d6e3dcc0551b4e9adf6a203d1c3f3dc66a613e0068fc1dc56715d84948c71655
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secureserver.dev.xion.oxcs.net/appsuite/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date
Wed, 04 Jan 2023 11:17:25 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript
Cache-Control
max-age=15552000, private
Connection
keep-alive
Accept-Ranges
bytes
Expires
Mon, 03 Jul 2023 11:17:25 GMT
precore.js
secureserver.dev.xion.oxcs.net/appsuite/v=7.10.3-18.20200831.131526/
607 KB
175 KB
Script
General
Full URL
https://secureserver.dev.xion.oxcs.net/appsuite/v=7.10.3-18.20200831.131526/precore.js
Requested by
Host: secureserver.dev.xion.oxcs.net
URL: https://secureserver.dev.xion.oxcs.net/appsuite/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.74.64.112 , Germany, ASN60664 (X-ION, DE),
Reverse DNS
Software
nginx /
Resource Hash
2a4e9a7ec3f3a2e70c7b8400fcb177cc355a1ee240be36582236e82ee9c01ba2
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secureserver.dev.xion.oxcs.net/appsuite/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date
Wed, 04 Jan 2023 11:17:25 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript
Cache-Control
max-age=15552000, private
Connection
keep-alive
Accept-Ranges
bytes
Expires
Mon, 03 Jul 2023 11:17:25 GMT
fontawesome-webfont.woff2
secureserver.dev.xion.oxcs.net/appsuite/v=7.10.3-18.20200831.131526/apps/3rd.party/font-awesome/fonts/
75 KB
76 KB
Font
General
Full URL
https://secureserver.dev.xion.oxcs.net/appsuite/v=7.10.3-18.20200831.131526/apps/3rd.party/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: secureserver.dev.xion.oxcs.net
URL: https://secureserver.dev.xion.oxcs.net/appsuite/v=7.10.3-18.20200831.131526/apps/themes/login/login.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.74.64.112 , Germany, ASN60664 (X-ION, DE),
Reverse DNS
Software
nginx /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://secureserver.dev.xion.oxcs.net/appsuite/v=7.10.3-18.20200831.131526/apps/themes/login/login.css
Origin
https://secureserver.dev.xion.oxcs.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date
Wed, 04 Jan 2023 11:17:25 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
Content-Type
font/woff2
Cache-Control
max-age=15552000, private
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
77160
Expires
Mon, 03 Jul 2023 11:17:25 GMT
manifests
secureserver.dev.xion.oxcs.net/appsuite/api/apps/
13 KB
3 KB
XHR
General
Full URL
https://secureserver.dev.xion.oxcs.net/appsuite/api/apps/manifests?action=config
Requested by
Host: secureserver.dev.xion.oxcs.net
URL: https://secureserver.dev.xion.oxcs.net/appsuite/v=7.10.3-18.20200831.131526/boot.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.74.64.112 , Germany, ASN60664 (X-ION, DE),
Reverse DNS
Software
nginx /
Resource Hash
a41241e490d914589b621a49e201be0f8efc13189254e1101f9aa7b4227749a4

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://secureserver.dev.xion.oxcs.net/appsuite/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 04 Jan 2023 11:17:25 GMT
Via
1.0 10.1.1.164:8081
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
keep-alive
X-Robots-Tag
none
Content-Length
2545
Expires
Sat, 06 May 1995 12:00:00 GMT
tab.js
secureserver.dev.xion.oxcs.net/appsuite/api/apps/load/7.10.3-18.20200831.131526,io.ox/core/api/
2 KB
1 KB
XHR
General
Full URL
https://secureserver.dev.xion.oxcs.net/appsuite/api/apps/load/7.10.3-18.20200831.131526,io.ox/core/api/tab.js
Requested by
Host: secureserver.dev.xion.oxcs.net
URL: https://secureserver.dev.xion.oxcs.net/appsuite/v=7.10.3-18.20200831.131526/boot.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.74.64.112 , Germany, ASN60664 (X-ION, DE),
Reverse DNS
Software
nginx /
Resource Hash
dd0fd9ffac497769f7833db5fc785d0690308838480e6906ac277a2581285063

Request headers

Accept
text/plain, */*; q=0.01
Referer
https://secureserver.dev.xion.oxcs.net/appsuite/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 04 Jan 2023 11:17:26 GMT
Via
1.0 10.1.1.164:8081
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
keep-alive
X-Robots-Tag
none
Content-Length
977
Expires
Sun, 17 Dec 2023 16:37:26 GMT
communication.js
secureserver.dev.xion.oxcs.net/appsuite/api/apps/load/7.10.3-18.20200831.131526,io.ox/core/tab/handling.js,io.ox/core/tab/session.js,io.ox/core/tab/
8 KB
3 KB
XHR
General
Full URL
https://secureserver.dev.xion.oxcs.net/appsuite/api/apps/load/7.10.3-18.20200831.131526,io.ox/core/tab/handling.js,io.ox/core/tab/session.js,io.ox/core/tab/communication.js
Requested by
Host: secureserver.dev.xion.oxcs.net
URL: https://secureserver.dev.xion.oxcs.net/appsuite/v=7.10.3-18.20200831.131526/boot.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.74.64.112 , Germany, ASN60664 (X-ION, DE),
Reverse DNS
Software
nginx /
Resource Hash
162d9ee4d89be20ba55f9048ff069d58447d5ebb9b8b1c73aa0ffa2424929f57

Request headers

Accept
text/plain, */*; q=0.01
Referer
https://secureserver.dev.xion.oxcs.net/appsuite/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 04 Jan 2023 11:17:26 GMT
Via
1.0 10.1.1.164:8081
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
keep-alive
X-Robots-Tag
none
Content-Length
2580
Expires
Sun, 17 Dec 2023 16:37:26 GMT
login
secureserver.dev.xion.oxcs.net/appsuite/api/
192 B
811 B
XHR
General
Full URL
https://secureserver.dev.xion.oxcs.net/appsuite/api/login?action=autologin&client=open-xchange-appsuite&rampup=true&rampUpFor=open-xchange-appsuite&version=7.10.3-18
Requested by
Host: secureserver.dev.xion.oxcs.net
URL: https://secureserver.dev.xion.oxcs.net/appsuite/v=7.10.3-18.20200831.131526/boot.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.74.64.112 , Germany, ASN60664 (X-ION, DE),
Reverse DNS
Software
nginx /
Resource Hash
76b8084a7b93b126fdc9266e38e7600cf6971234954d8498261d3bb5cd24b0e6

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://secureserver.dev.xion.oxcs.net/appsuite/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 04 Jan 2023 11:17:26 GMT
Via
1.0 10.1.1.164:8081
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
keep-alive
X-Robots-Tag
none
Content-Length
165
Expires
Sat, 06 May 1995 12:00:00 GMT
signin.js
secureserver.dev.xion.oxcs.net/appsuite/api/apps/load/7.10.3-18.20200831.131526,io.ox/dynamic-theme/
521 B
846 B
XHR
General
Full URL
https://secureserver.dev.xion.oxcs.net/appsuite/api/apps/load/7.10.3-18.20200831.131526,io.ox/dynamic-theme/signin.js
Requested by
Host: secureserver.dev.xion.oxcs.net
URL: https://secureserver.dev.xion.oxcs.net/appsuite/v=7.10.3-18.20200831.131526/boot.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.74.64.112 , Germany, ASN60664 (X-ION, DE),
Reverse DNS
Software
nginx /
Resource Hash
4824477b740f58291bd5f3797d55b932f7a071240497fbea0eaf9c37b1bc0d8a

Request headers

Accept
text/plain, */*; q=0.01
Referer
https://secureserver.dev.xion.oxcs.net/appsuite/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 04 Jan 2023 11:17:26 GMT
Via
1.0 10.1.1.164:8081
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
keep-alive
X-Robots-Tag
none
Expires
Sun, 17 Dec 2023 16:37:26 GMT
login.less.dyn
secureserver.dev.xion.oxcs.net/appsuite/api/apps/load/7.10.3-18.20200831.131526,io.ox/dynamic-theme/less.js,/text;io.ox/dynamic-theme/apps/themes/login/
103 KB
33 KB
XHR
General
Full URL
https://secureserver.dev.xion.oxcs.net/appsuite/api/apps/load/7.10.3-18.20200831.131526,io.ox/dynamic-theme/less.js,/text;io.ox/dynamic-theme/apps/themes/login/login.less.dyn
Requested by
Host: secureserver.dev.xion.oxcs.net
URL: https://secureserver.dev.xion.oxcs.net/appsuite/v=7.10.3-18.20200831.131526/boot.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.74.64.112 , Germany, ASN60664 (X-ION, DE),
Reverse DNS
Software
nginx /
Resource Hash
d08e835e90fa414571fb071850c40a4137f2e2d2553acbb8aecab07897c8f847

Request headers

Accept
text/plain, */*; q=0.01
Referer
https://secureserver.dev.xion.oxcs.net/appsuite/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 04 Jan 2023 11:17:26 GMT
Via
1.0 10.1.1.164:8081
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
keep-alive
X-Robots-Tag
none
Content-Length
32941
Expires
Sun, 17 Dec 2023 16:37:26 GMT
defaults.js
secureserver.dev.xion.oxcs.net/appsuite/api/apps/load/7.10.3-18.20200831.131526,io.ox/dynamic-theme/files.js,io.ox/dynamic-theme/settings/
3 KB
1 KB
XHR
General
Full URL
https://secureserver.dev.xion.oxcs.net/appsuite/api/apps/load/7.10.3-18.20200831.131526,io.ox/dynamic-theme/files.js,io.ox/dynamic-theme/settings/defaults.js
Requested by
Host: secureserver.dev.xion.oxcs.net
URL: https://secureserver.dev.xion.oxcs.net/appsuite/v=7.10.3-18.20200831.131526/boot.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.74.64.112 , Germany, ASN60664 (X-ION, DE),
Reverse DNS
Software
nginx /
Resource Hash
3677804db77c2e92e27ae2164d14d622bee01f9905135ba3b35dfe1c2855ca2c

Request headers

Accept
text/plain, */*; q=0.01
Referer
https://secureserver.dev.xion.oxcs.net/appsuite/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 04 Jan 2023 11:17:26 GMT
Via
1.0 10.1.1.164:8081
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
keep-alive
X-Robots-Tag
none
Expires
Sun, 17 Dec 2023 16:37:26 GMT

Verdicts & Comments Add Verdict or Comment

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontentvisibilityautostatechange string| path object| ox function| staticGt string| root string| oldRoot function| requirejs function| require function| define undefined| vpRule undefined| dependencies function| $ function| jQuery function| _ object| Backbone function| moment function| assert object| html5 object| Modernizr function| isBrowserSupported function| isPlatformSupported function| blankshield

3 Cookies

Domain/Path Name / Value
secureserver.dev.xion.oxcs.net/ Name: url.key
Value: 3588646162419431358864616241943135886461624194313588646162419431
secureserver.dev.xion.oxcs.net/ Name: locale
Value: en_US
secureserver.dev.xion.oxcs.net/ Name: JSESSIONID
Value: 2077008943631482426.single

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN