Submitted URL: http://ur4ndom.dev/
Effective URL: https://ur4ndom.dev/
Submission: On November 15 via api from US — Scanned from NL

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 46.23.81.157, located in Netherlands and belongs to HIGH5-NL High5! B.V., NL. The main domain is ur4ndom.dev.
TLS certificate: Issued by E5 on October 13th 2024. Valid for: 3 months.
This is the only time ur4ndom.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
11 46.23.81.157 60131 (HIGH5-NL ...)
11 1
Apex Domain
Subdomains
Transfer
11 ur4ndom.dev
ur4ndom.dev
257 KB
11 1
Domain Requested by
11 ur4ndom.dev ur4ndom.dev
11 1

This site contains links to these domains. Also see Links.

Domain
org.anize.rs
flagbot.ch
blog.cryptohack.org
github.com
git.sr.ht
bsky.app
www.linkedin.com
signal.me
Subject Issuer Validity Valid
ur4ndom.dev
E5
2024-10-13 -
2025-01-11
3 months crt.sh

This page contains 1 frames:

Primary Page: https://ur4ndom.dev/
Frame ID: D3C35CDC3C2DCCE22CE2A261F06DCD60
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

/dev/ur4ndom - Robin Jadoul

Page URL History Show full URLs

  1. http://ur4ndom.dev/ HTTP 307
    https://ur4ndom.dev/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • katex(?:\.min)?\.js

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

257 kB
Transfer

477 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://ur4ndom.dev/ HTTP 307
    https://ur4ndom.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
ur4ndom.dev/
Redirect Chain
  • http://ur4ndom.dev/
  • https://ur4ndom.dev/
18 KB
6 KB
Document
General
Full URL
https://ur4ndom.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
46.23.81.157 , Netherlands, ASN60131 (HIGH5-NL High5! B.V., NL),
Reverse DNS
46-23-81-157.high5.nu
Software
/
Resource Hash
25797e9a08e46baca1818f969594bca69902d81bbee1fc4adc48887335acb0b0
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
access-control-request-methods
GET, HEAD, OPTIONS
content-encoding
zstd
content-security-policy
default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;
content-type
text/html; charset=utf-8
date
Fri, 15 Nov 2024 12:21:50 GMT
last-modified
Sun, 11 Aug 2024 22:34:41 GMT
vary
Accept-Encoding

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://ur4ndom.dev/
Non-Authoritative-Reason
HSTS
style.css
ur4ndom.dev/static/css/
8 KB
3 KB
Stylesheet
General
Full URL
https://ur4ndom.dev/static/css/style.css
Requested by
Host: ur4ndom.dev
URL: https://ur4ndom.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
46.23.81.157 , Netherlands, ASN60131 (HIGH5-NL High5! B.V., NL),
Reverse DNS
46-23-81-157.high5.nu
Software
/
Resource Hash
e11fb3a59fc9aff47c1b466021c54f73f248b716758db5d5b828da61da3c4ed1
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://ur4ndom.dev/

Response headers

content-security-policy
default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;
access-control-request-methods
GET, HEAD, OPTIONS
content-encoding
zstd
access-control-allow-origin
*
content-length
2602
date
Fri, 15 Nov 2024 12:21:50 GMT
content-type
text/css; charset=utf-8
last-modified
Sun, 11 Aug 2024 22:34:41 GMT
vary
Accept-Encoding
katex.min.css
ur4ndom.dev/static/vendor/
22 KB
3 KB
Stylesheet
General
Full URL
https://ur4ndom.dev/static/vendor/katex.min.css
Requested by
Host: ur4ndom.dev
URL: https://ur4ndom.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
46.23.81.157 , Netherlands, ASN60131 (HIGH5-NL High5! B.V., NL),
Reverse DNS
46-23-81-157.high5.nu
Software
/
Resource Hash
b67ea16766060efd30d7f0da14be0c894a17b8055c96bb4566cd77721dd307d3
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://ur4ndom.dev/

Response headers

content-security-policy
default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;
access-control-request-methods
GET, HEAD, OPTIONS
content-encoding
zstd
access-control-allow-origin
*
content-length
3490
date
Fri, 15 Nov 2024 12:21:50 GMT
content-type
text/css; charset=utf-8
last-modified
Sun, 11 Aug 2024 22:34:43 GMT
vary
Accept-Encoding
copy-tex.min.css
ur4ndom.dev/static/vendor/
104 B
134 B
Stylesheet
General
Full URL
https://ur4ndom.dev/static/vendor/copy-tex.min.css
Requested by
Host: ur4ndom.dev
URL: https://ur4ndom.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
46.23.81.157 , Netherlands, ASN60131 (HIGH5-NL High5! B.V., NL),
Reverse DNS
46-23-81-157.high5.nu
Software
/
Resource Hash
bf9ff4137fec38f6255419e142d0883c9c52090885d746f80eee12b273d9b3e0
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://ur4ndom.dev/

Response headers

content-security-policy
default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;
access-control-request-methods
GET, HEAD, OPTIONS
access-control-allow-origin
*
content-length
104
date
Fri, 15 Nov 2024 12:21:50 GMT
content-type
text/css; charset=utf-8
last-modified
Sun, 11 Aug 2024 22:34:43 GMT
vary
Accept-Encoding
katex.min.js
ur4ndom.dev/static/vendor/
252 KB
72 KB
Script
General
Full URL
https://ur4ndom.dev/static/vendor/katex.min.js
Requested by
Host: ur4ndom.dev
URL: https://ur4ndom.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
46.23.81.157 , Netherlands, ASN60131 (HIGH5-NL High5! B.V., NL),
Reverse DNS
46-23-81-157.high5.nu
Software
/
Resource Hash
d6a849c0082c48f5524a39505537b01d2e3d79aa006cecfae7576f79400d5412
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://ur4ndom.dev/

Response headers

content-security-policy
default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;
access-control-request-methods
GET, HEAD, OPTIONS
content-encoding
zstd
access-control-allow-origin
*
date
Fri, 15 Nov 2024 12:21:50 GMT
content-type
text/javascript; charset=utf-8
last-modified
Sun, 11 Aug 2024 22:34:43 GMT
vary
Accept-Encoding
copy-tex.min.js
ur4ndom.dev/static/vendor/
2 KB
1 KB
Script
General
Full URL
https://ur4ndom.dev/static/vendor/copy-tex.min.js
Requested by
Host: ur4ndom.dev
URL: https://ur4ndom.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
46.23.81.157 , Netherlands, ASN60131 (HIGH5-NL High5! B.V., NL),
Reverse DNS
46-23-81-157.high5.nu
Software
/
Resource Hash
2ab2237329021bc443986c8327f6e61357fb68a54e5d233d224023718c02207d
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://ur4ndom.dev/

Response headers

content-security-policy
default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;
access-control-request-methods
GET, HEAD, OPTIONS
content-encoding
zstd
access-control-allow-origin
*
content-length
1071
date
Fri, 15 Nov 2024 12:21:50 GMT
content-type
text/javascript; charset=utf-8
last-modified
Sun, 11 Aug 2024 22:34:43 GMT
vary
Accept-Encoding
auto-render.min.js
ur4ndom.dev/static/vendor/
3 KB
2 KB
Script
General
Full URL
https://ur4ndom.dev/static/vendor/auto-render.min.js
Requested by
Host: ur4ndom.dev
URL: https://ur4ndom.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
46.23.81.157 , Netherlands, ASN60131 (HIGH5-NL High5! B.V., NL),
Reverse DNS
46-23-81-157.high5.nu
Software
/
Resource Hash
a04b9054bc0ee488bab2e6c286d2dbad8e60c7b343454f94249f63bef6aef852
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://ur4ndom.dev/

Response headers

content-security-policy
default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;
access-control-request-methods
GET, HEAD, OPTIONS
content-encoding
zstd
access-control-allow-origin
*
content-length
1599
date
Fri, 15 Nov 2024 12:21:50 GMT
content-type
text/javascript; charset=utf-8
last-modified
Sun, 11 Aug 2024 22:34:43 GMT
vary
Accept-Encoding
pygments-nord.css
ur4ndom.dev/static/vendor/
4 KB
1 KB
Stylesheet
General
Full URL
https://ur4ndom.dev/static/vendor/pygments-nord.css
Requested by
Host: ur4ndom.dev
URL: https://ur4ndom.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
46.23.81.157 , Netherlands, ASN60131 (HIGH5-NL High5! B.V., NL),
Reverse DNS
46-23-81-157.high5.nu
Software
/
Resource Hash
7ad93f5c288f8c789e13ef71d2127785e94cdf63d1598dac404d8aa87d0ef0f8
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://ur4ndom.dev/

Response headers

content-security-policy
default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;
access-control-request-methods
GET, HEAD, OPTIONS
content-encoding
zstd
access-control-allow-origin
*
content-length
1104
date
Fri, 15 Nov 2024 12:21:50 GMT
content-type
text/css; charset=utf-8
last-modified
Sun, 11 Aug 2024 22:34:43 GMT
vary
Accept-Encoding
LeagueSpartanVariable.woff2
ur4ndom.dev/static/fonts/
44 KB
44 KB
Font
General
Full URL
https://ur4ndom.dev/static/fonts/LeagueSpartanVariable.woff2
Requested by
Host: ur4ndom.dev
URL: https://ur4ndom.dev/static/css/style.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
46.23.81.157 , Netherlands, ASN60131 (HIGH5-NL High5! B.V., NL),
Reverse DNS
46-23-81-157.high5.nu
Software
/
Resource Hash
a0056e32d49e1315adfe44a13fc1cd555deed488879bc91597bb026b0d97060a
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://ur4ndom.dev
Referer
https://ur4ndom.dev/static/css/style.css

Response headers

content-security-policy
default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;
access-control-request-methods
GET, HEAD, OPTIONS
content-encoding
zstd
access-control-allow-origin
*
date
Fri, 15 Nov 2024 12:21:50 GMT
content-type
font/woff2
last-modified
Sun, 11 Aug 2024 22:34:41 GMT
vary
Accept-Encoding
fa-solid-900.woff2
ur4ndom.dev/static/fonts/
124 KB
124 KB
Font
General
Full URL
https://ur4ndom.dev/static/fonts/fa-solid-900.woff2
Requested by
Host: ur4ndom.dev
URL: https://ur4ndom.dev/static/css/style.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
46.23.81.157 , Netherlands, ASN60131 (HIGH5-NL High5! B.V., NL),
Reverse DNS
46-23-81-157.high5.nu
Software
/
Resource Hash
1b099f88c06ed0869872561c157f0ec9cbe133a0939d9ece4ee1e1f54bd4683d
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://ur4ndom.dev
Referer
https://ur4ndom.dev/static/css/style.css

Response headers

content-security-policy
default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;
access-control-request-methods
GET, HEAD, OPTIONS
content-encoding
zstd
access-control-allow-origin
*
date
Fri, 15 Nov 2024 12:21:50 GMT
content-type
font/woff2
last-modified
Sun, 11 Aug 2024 22:34:41 GMT
vary
Accept-Encoding
favicon.ico
ur4ndom.dev/
20 B
92 B
Other
General
Full URL
https://ur4ndom.dev/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
46.23.81.157 , Netherlands, ASN60131 (HIGH5-NL High5! B.V., NL),
Reverse DNS
46-23-81-157.high5.nu
Software
/
Resource Hash
b7e4233eec312c1ec53ea3fb3396b370d9e412df3e93e4683dcddd7e91c4bf06
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://ur4ndom.dev/

Response headers

content-security-policy
default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;
access-control-request-methods
GET, HEAD, OPTIONS
x-content-type-options
nosniff
access-control-allow-origin
*
content-length
20
date
Fri, 15 Nov 2024 12:21:50 GMT
content-type
text/plain; charset=utf-8
vary
Accept-Encoding

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| katex_options object| katex function| renderMathInElement

0 Cookies

2 Console Messages

Source Level URL
Text
security warning URL: https://ur4ndom.dev/
Message:
An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
network error URL: https://ur4ndom.dev/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'; frame-src https:; img-src data: https:; media-src https:; object-src 'none'; sandbox allow-downloads allow-forms allow-pointer-lock allow-presentation allow-same-origin allow-scripts allow-popups;