urlscan.io logo urlscan.io
SecurityTrails logo

customer-pos.bajajfinserv.in Open in urlscan Pro
2a02:26f0:3500:18::1724:a285  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://m.bajfin.in/DkgoiPOg
Effective URL: https://customer-pos.bajajfinserv.in/survey/AHTG30/E4DFPAEK/PLCS%20Prime%20T2
Submission: On April 30 via manual from IN — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 7 HTTP transactions. The main IP is 2a02:26f0:3500:18::1724:a285, located in Frankfurt am Main, Germany and belongs to AKAMAI-ASN1, NL. The main domain is customer-pos.bajajfinserv.in.
TLS certificate: Issued by GeoTrust RSA CA 2018 on February 27th 2023. Valid for: a year.
This is the only time customer-pos.bajajfinserv.in was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 129.145.64.225 21621 (RESPONSYS-2)
1 1 95.101.111.131 20940 (AKAMAI-ASN1)
1 7 2a02:26f0:480... 20940 (AKAMAI-ASN1)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
7 2
Apex Domain
Subdomains		 Transfer
7 bfin.in
bfin.in
23 KB
2 bajajfinserv.in
information.bajajfinserv.in
customer-pos.bajajfinserv.in
841 B
1 bajfin.in
m.bajfin.in
748 B
7 3
Domain Requested by
7 bfin.in 1 redirects bfin.in
1 customer-pos.bajajfinserv.in bfin.in
1 information.bajajfinserv.in 1 redirects
1 m.bajfin.in 1 redirects
7 4

This site contains no links.

Subject Issuer Validity Valid
bajajfinserv.in
DigiCert TLS RSA SHA256 2020 CA1		 2023-03-23 -
2024-03-22		 a year crt.sh
*.bajajfinserv.in
GeoTrust RSA CA 2018		 2023-02-27 -
2024-03-25		 a year crt.sh

This page contains 1 frames:

Primary Page: https://customer-pos.bajajfinserv.in/survey/AHTG30/E4DFPAEK/PLCS%20Prime%20T2
Frame ID: A5936A57959A2A0AE35018A846BB64ED
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Access Denied

Page URL History Show full URLs

  1. http://m.bajfin.in/DkgoiPOg HTTP 301
    https://information.bajajfinserv.in/pub/cc?_ri_=X0Gzc2X%3DAQpglLjHJlTQGze0SnzcoJzfzeDXhzbGpGB4NGYvypMzcn6lzeheFu... HTTP 302
    https://bfin.in/?E4DFPAEK Page URL
  2. https://bfin.in/redirectbitly.aspx?bitlyuniquenumber=E4DFPAEK HTTP 302
    https://customer-pos.bajajfinserv.in/survey/AHTG30/E4DFPAEK/PLCS%20Prime%20T2 Page URL

Page Statistics

7
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

2
IPs

2
Countries

22 kB
Transfer

78 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://m.bajfin.in/DkgoiPOg HTTP 301
    https://information.bajajfinserv.in/pub/cc?_ri_=X0Gzc2X%3DAQpglLjHJlTQGze0SnzcoJzfzeDXhzbGpGB4NGYvypMzcn6lzeheFuNFBeqzbUhk1zeiLfzc1aYMl6URjeVXtpKX%3DWYADCCCT&_ei_=EQZxRNOJ-vWdFjt_xLs93M3yStZtcRe1k8b42p6nw-D31DXs8VF0uSQfSyyUZonVLZ8F46FWwtCgY9V-wu4-kM4ma3fi8m2275FZOz7_xnIEMp5pGWPsFSlBRIHywfEPWdnwlUsMy_kKtkqhG3iJcPSRLUThBZbhn06eiAw-UR4Pq1_YuL7d2URr41b_zO4OjGnChBPc77-3GSg0rNSZFUsbSs8HUHI3hn8b4Opo1PcsbP4lmy4No6w8p8jyQjfvTqsYhvkoLHQx-sa_cqwy64MJG0su3ejU.&_di_=2ohu48831gromqutl20hc31qebfh3m4v1qkmdosil5dc2qqv7300Jg%3D%3D HTTP 302
    https://bfin.in/?E4DFPAEK Page URL
  2. https://bfin.in/redirectbitly.aspx?bitlyuniquenumber=E4DFPAEK HTTP 302
    https://customer-pos.bajajfinserv.in/survey/AHTG30/E4DFPAEK/PLCS%20Prime%20T2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://m.bajfin.in/DkgoiPOg HTTP 301
  • https://information.bajajfinserv.in/pub/cc?_ri_=X0Gzc2X%3DAQpglLjHJlTQGze0SnzcoJzfzeDXhzbGpGB4NGYvypMzcn6lzeheFuNFBeqzbUhk1zeiLfzc1aYMl6URjeVXtpKX%3DWYADCCCT&_ei_=EQZxRNOJ-vWdFjt_xLs93M3yStZtcRe1k8b42p6nw-D31DXs8VF0uSQfSyyUZonVLZ8F46FWwtCgY9V-wu4-kM4ma3fi8m2275FZOz7_xnIEMp5pGWPsFSlBRIHywfEPWdnwlUsMy_kKtkqhG3iJcPSRLUThBZbhn06eiAw-UR4Pq1_YuL7d2URr41b_zO4OjGnChBPc77-3GSg0rNSZFUsbSs8HUHI3hn8b4Opo1PcsbP4lmy4No6w8p8jyQjfvTqsYhvkoLHQx-sa_cqwy64MJG0su3ejU.&_di_=2ohu48831gromqutl20hc31qebfh3m4v1qkmdosil5dc2qqv7300Jg%3D%3D HTTP 302
  • https://bfin.in/?E4DFPAEK

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
bfin.in/
Redirect Chain
  • http://m.bajfin.in/DkgoiPOg
  • https://information.bajajfinserv.in/pub/cc?_ri_=X0Gzc2X%3DAQpglLjHJlTQGze0SnzcoJzfzeDXhzbGpGB4NGYvypMzcn6lzeheFuNFBeqzbUhk1zeiLfzc1aYMl6URjeVXtpKX%3DWYADCCCT&_ei_=EQZxRNOJ-vWdFjt_xLs93M3yStZtcRe1k8...
  • https://bfin.in/?E4DFPAEK
16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bfin.in/?E4DFPAEK
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:5b4::3844 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
920ff11f81b158b982d95c18a717bbbff43a8a78003396a6a8a289e8d7e5bcfd
Security Headers
Name Value
Public-Key-Pins pin-sha256="base64+primary=="; pin-sha256="base64+backup=="; max-age=5184000; includeSubDomains
Strict-Transport-Security max-age=15552001; include Subdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://bflmaster.force.com/Operations/ https://bajaj2.my.salesforce.com/
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=0, no-cache, no-store
content-encoding
gzip
content-length
5313
content-type
text/html; charset=utf-8
date
Sun, 30 Apr 2023 04:17:47 GMT
expires
Sun, 30 Apr 2023 04:17:47 GMT
pragma
no-cache
public-key-pins
pin-sha256="base64+primary=="; pin-sha256="base64+backup=="; max-age=5184000; includeSubDomains
referrer-policy
strict-origin
server-timing
cdn-cache; desc=MISS edge; dur=467 origin; dur=19 ak_p; desc="467452_35115190_567996284_48667_4752_31_0";dur=1
strict-transport-security
max-age=15552001; include Subdomains; preload
vary
Accept-Encoding
x-akamai-transformed
9 11513 0 pmb=mRUM,2
x-content-type-options
nosniff
x-frame-options
ALLOW-FROM https://bflmaster.force.com/Operations/ https://bajaj2.my.salesforce.com/
x-xss-protection
1; mode=block

Redirect headers

Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
0
Date
Sun, 30 Apr 2023 04:17:46 GMT
Expires
Sun, 30 Apr 2023 04:17:46 GMT
Location
https://bfin.in/?E4DFPAEK
P3P
policyref="http://policy2.responsys.net/w3c/response.xml", CP="NON DSP COR IVAi IVDi OTRi IND ONL"
Pragma
no-cache
Server
Apache
bflstyle.css
bfin.in/scripts/ 		11 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bfin.in/scripts/bflstyle.css
Requested by
Host: bfin.in
URL: https://bfin.in/?E4DFPAEK
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:5b4::3844 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
7e6e2b21424a34d35c80d3935c3d4654f43ca4d3eb15e85c736a03dccf7ee43c
Security Headers
Name Value
Public-Key-Pins pin-sha256="base64+primary=="; pin-sha256="base64+backup=="; max-age=5184000; includeSubDomains
Strict-Transport-Security max-age=15552001; include Subdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://bflmaster.force.com/Operations/ https://bajaj2.my.salesforce.com/
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bfin.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552001; include Subdomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Sun, 30 Apr 2023 04:17:47 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=129, ak_p; desc="467452_35115190_567996362_12973_4140_31_0";dur=1
content-length
2362
x-xss-protection
1; mode=block
public-key-pins
pin-sha256="base64+primary=="; pin-sha256="base64+backup=="; max-age=5184000; includeSubDomains
pragma
no-cache
referrer-policy
strict-origin
last-modified
Wed, 13 May 2015 05:22:25 GMT
etag
"c77fdbcb3c8dd01:0"
x-frame-options
ALLOW-FROM https://bflmaster.force.com/Operations/ https://bajaj2.my.salesforce.com/
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Sun, 30 Apr 2023 04:17:47 GMT
jquery-1.4.1.min
bfin.in/Bitly/Scripts/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://bfin.in/Bitly/Scripts/jquery-1.4.1.min
Requested by
Host: bfin.in
URL: https://bfin.in/?E4DFPAEK
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:5b4::3844 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Public-Key-Pins pin-sha256="base64+primary=="; pin-sha256="base64+backup=="; max-age=5184000; includeSubDomains
Strict-Transport-Security max-age=15552001; include Subdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://bflmaster.force.com/Operations/ https://bajaj2.my.salesforce.com/
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bfin.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=15552001; include Subdomains; preload
date
Sun, 30 Apr 2023 04:17:48 GMT
referrer-policy
strict-origin
x-content-type-options
nosniff
x-frame-options
ALLOW-FROM https://bflmaster.force.com/Operations/ https://bajaj2.my.salesforce.com/
content-type
text/html
cache-control
max-age=0, no-cache, no-store
server-timing
cdn-cache; desc=MISS, edge; dur=439, origin; dur=40, ak_p; desc="467452_35115190_567996363_48137_2970_31_0";dur=1
content-length
1245
x-xss-protection
1; mode=block
public-key-pins
pin-sha256="base64+primary=="; pin-sha256="base64+backup=="; max-age=5184000; includeSubDomains
expires
Sun, 30 Apr 2023 04:17:48 GMT
WebResource.axd
bfin.in/ 		23 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bfin.in/WebResource.axd?d=pynGkmcFUV13He1Qd6_TZBCQtEZ-MLJ0BZ7dITpUEZ3vj7TabrV129EZYblDjyOJO4FJuT5Rjn20ryzFDEttIA2&t=637811927229275428
Requested by
Host: bfin.in
URL: https://bfin.in/?E4DFPAEK
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:5b4::3844 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Public-Key-Pins pin-sha256="base64+primary=="; pin-sha256="base64+backup=="; max-age=5184000; includeSubDomains
Strict-Transport-Security max-age=15552001; include Subdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://bflmaster.force.com/Operations/ https://bajaj2.my.salesforce.com/
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bfin.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552001; include Subdomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Sun, 30 Apr 2023 04:17:48 GMT
server-timing
cdn-cache; desc=MISS, edge; dur=449, origin; dur=32, ak_p; desc="467452_35115190_567996364_48213_4227_31_0";dur=1
content-length
4627
x-xss-protection
1; mode=block
public-key-pins
pin-sha256="base64+primary=="; pin-sha256="base64+backup=="; max-age=5184000; includeSubDomains
pragma
no-cache
referrer-policy
strict-origin
last-modified
Wed, 23 Feb 2022 00:28:42 GMT
x-frame-options
ALLOW-FROM https://bflmaster.force.com/Operations/ https://bajaj2.my.salesforce.com/
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=0, no-cache, no-store
expires
Sun, 30 Apr 2023 04:17:48 GMT
WebResource.axd
bfin.in/ 		26 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bfin.in/WebResource.axd?d=x2nkrMJGXkMELz33nwnakEPEeseUIOHFS8s1n-xmpg-BgBPKbjlLU6x4s4KKpxjnXJqV_VIv46G91JiH14iRFtF5zOgs9JRooCAfPIXuHEc1&t=637811927229275428
Requested by
Host: bfin.in
URL: https://bfin.in/?E4DFPAEK
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:5b4::3844 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
ef9453f74b2617d43dcef4242cf5845101fcfb57289c81bceb20042b0023a192
Security Headers
Name Value
Public-Key-Pins pin-sha256="base64+primary=="; pin-sha256="base64+backup=="; max-age=5184000; includeSubDomains
Strict-Transport-Security max-age=15552001; include Subdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://bflmaster.force.com/Operations/ https://bajaj2.my.salesforce.com/
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bfin.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552001; include Subdomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Sun, 30 Apr 2023 04:17:48 GMT
server-timing
cdn-cache; desc=MISS, edge; dur=433, origin; dur=44, ak_p; desc="467452_35115190_567996365_47768_4234_31_0";dur=1
content-length
5468
x-xss-protection
1; mode=block
public-key-pins
pin-sha256="base64+primary=="; pin-sha256="base64+backup=="; max-age=5184000; includeSubDomains
pragma
no-cache
referrer-policy
strict-origin
last-modified
Wed, 23 Feb 2022 00:28:42 GMT
x-frame-options
ALLOW-FROM https://bflmaster.force.com/Operations/ https://bajaj2.my.salesforce.com/
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=0, no-cache, no-store
expires
Sun, 30 Apr 2023 04:17:48 GMT
bfl-logo.png
bfin.in/Images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bfin.in/Images/bfl-logo.png
Requested by
Host: bfin.in
URL: https://bfin.in/?E4DFPAEK
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:5b4::3844 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Public-Key-Pins pin-sha256="base64+primary=="; pin-sha256="base64+backup=="; max-age=5184000; includeSubDomains
Strict-Transport-Security max-age=15552001; include Subdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://bflmaster.force.com/Operations/ https://bajaj2.my.salesforce.com/
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bfin.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552001; include Subdomains; preload
date
Sun, 30 Apr 2023 04:17:48 GMT
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="467452_35115190_567996438_22_4203_31_0";dur=1
content-length
1784
x-xss-protection
1; mode=block
public-key-pins
pin-sha256="base64+primary=="; pin-sha256="base64+backup=="; max-age=5184000; includeSubDomains
pragma
no-cache
referrer-policy
strict-origin
last-modified
Fri, 11 Aug 2017 08:57:55 GMT
etag
"9fe859ec7f12d31:0"
x-frame-options
ALLOW-FROM https://bflmaster.force.com/Operations/ https://bajaj2.my.salesforce.com/
content-type
image/png
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Sun, 30 Apr 2023 04:17:48 GMT
Primary Request PLCS%20Prime%20T2
customer-pos.bajajfinserv.in/survey/AHTG30/E4DFPAEK/
Redirect Chain
  • https://bfin.in/redirectbitly.aspx?bitlyuniquenumber=E4DFPAEK
  • https://customer-pos.bajajfinserv.in/survey/AHTG30/E4DFPAEK/PLCS%20Prime%20T2
342 B
465 B 		Document
General
Check archive.org
Download Go to
Full URL
https://customer-pos.bajajfinserv.in/survey/AHTG30/E4DFPAEK/PLCS%20Prime%20T2
Requested by
Host: bfin.in
URL: https://bfin.in/?E4DFPAEK
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:18::1724:a285 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiGHost /
Resource Hash
66b46adf48ac2215ffa19bc8cbf707d63ad964a33aa6dde77f369fa7aad91b47

Request headers

Referer
https://bfin.in/?E4DFPAEK
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-length
342
content-type
text/html
date
Sun, 30 Apr 2023 04:17:48 GMT
expires
Sun, 30 Apr 2023 04:17:48 GMT
mime-version
1.0
server
AkamaiGHost

Redirect headers

cache-control
max-age=0, no-cache, no-store
content-length
3302
content-type
text/html; charset=utf-8
date
Sun, 30 Apr 2023 04:17:48 GMT
expires
Sun, 30 Apr 2023 04:17:48 GMT
location
https://customer-pos.bajajfinserv.in/survey/AHTG30/E4DFPAEK/PLCS%20Prime%20T2
pragma
no-cache
public-key-pins
pin-sha256="base64+primary=="; pin-sha256="base64+backup=="; max-age=5184000; includeSubDomains
referrer-policy
strict-origin
server-timing
cdn-cache; desc=MISS edge; dur=115 origin; dur=78 ak_p; desc="467452_35115190_567996440_19300_4387_40_0";dur=1
strict-transport-security
max-age=15552001; include Subdomains; preload
x-content-type-options
nosniff
x-frame-options
ALLOW-FROM https://bflmaster.force.com/Operations/ https://bajaj2.my.salesforce.com/
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies

3 Console Messages

Source Level URL
Text
network error URL: https://bfin.in/Bitly/Scripts/jquery-1.4.1.min
Message:
Failed to load resource: the server responded with a status of 404 ()
security error URL: https://bfin.in/?E4DFPAEK
Message:
Refused to execute script from 'https://bfin.in/Bitly/Scripts/jquery-1.4.1.min' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
network error URL: https://customer-pos.bajajfinserv.in/survey/AHTG30/E4DFPAEK/PLCS%20Prime%20T2
Message:
Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Public-Key-Pins pin-sha256="base64+primary=="; pin-sha256="base64+backup=="; max-age=5184000; includeSubDomains
Strict-Transport-Security max-age=15552001; include Subdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://bflmaster.force.com/Operations/ https://bajaj2.my.salesforce.com/
X-Xss-Protection 1; mode=block