URL: https://ap.lunar.build/
Submission Tags: phishingrod
Submission: On July 29 via api from DE — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 14 HTTP transactions. The main IP is 67.205.180.98, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is ap.lunar.build.
TLS certificate: Issued by E6 on July 29th 2024. Valid for: 3 months.
This is the only time ap.lunar.build was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
13 67.205.180.98 14061 (DIGITALOC...)
1 2400:52e0:1e0... 60068 (CDN77 _)
14 2
Apex Domain
Subdomains
Transfer
13 lunar.build
ap.lunar.build
1 MB
1 bunny.net
fonts.bunny.net — Cisco Umbrella Rank: 15346
1 KB
14 2
Domain Requested by
13 ap.lunar.build ap.lunar.build
1 fonts.bunny.net ap.lunar.build
14 2

This site contains no links.

Subject Issuer Validity Valid
ap.lunar.build
E6
2024-07-29 -
2024-10-27
3 months crt.sh
fonts.bunny.net
R11
2024-07-06 -
2024-10-04
3 months crt.sh

This page contains 1 frames:

Primary Page: https://ap.lunar.build/
Frame ID: 80E0E6DB28BC208C565C5F085F607C60
Requests: 14 HTTP requests in this frame

Screenshot

Page Title

AP Staging

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]{1,512}\bwire:
  • livewire(?:\.min)?\.js

Page Statistics

14
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1141 kB
Transfer

1426 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
ap.lunar.build/
5 KB
2 KB
Document
General
Full URL
https://ap.lunar.build/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.205.180.98 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
b29880ac8f95f935884a2ec7dca7dc7ad84d68ff50c7a1d9caf02ae3c3fe038b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

cache-control
no-cache, private
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Mon, 29 Jul 2024 10:44:16 GMT
server
nginx
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
core.min.css
ap.lunar.build/rappasoft/laravel-livewire-tables/
9 KB
3 KB
Stylesheet
General
Full URL
https://ap.lunar.build/rappasoft/laravel-livewire-tables/core.min.css
Requested by
Host: ap.lunar.build
URL: https://ap.lunar.build/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.205.180.98 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
eeb5842b749897f66bb1b3ac44c0d69365154d24fa1e49927a7612605d4eff31
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ap.lunar.build/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:44:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sat, 20 Jul 2024 00:28:29 GMT
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
cache-control
max-age=1, public
x-xss-protection
1; mode=block
expires
Mon, 29 Jul 2024 10:44:17 GMT
thirdparty.css
ap.lunar.build/rappasoft/laravel-livewire-tables/
15 KB
3 KB
Stylesheet
General
Full URL
https://ap.lunar.build/rappasoft/laravel-livewire-tables/thirdparty.css
Requested by
Host: ap.lunar.build
URL: https://ap.lunar.build/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.205.180.98 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
85bf0dde13d5c57016673f399905463e034e8f30f2b409764680d21bbbee8dfc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ap.lunar.build/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:44:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sat, 20 Jul 2024 00:28:29 GMT
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
cache-control
max-age=1, public
x-xss-protection
1; mode=block
expires
Mon, 29 Jul 2024 10:44:17 GMT
css
fonts.bunny.net/
3 KB
1 KB
Stylesheet
General
Full URL
https://fonts.bunny.net/css?family=figtree:400,500,600&display=swap
Requested by
Host: ap.lunar.build
URL: https://ap.lunar.build/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
0ae52e4bd77c3fc50dad8de596fb5171a67686c94771023a92396810d946e45c

Request headers

Referer
https://ap.lunar.build/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:44:16 GMT
content-encoding
br
cdn-edgestorageid
1080
cdn-cachedat
07/15/2024 20:39:03
cdn-pullzone
781720
last-modified
Mon, 15 Jul 2024 20:39:03 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
3a60ca70-b89d-4cd5-a4b5-34a3468d7e0f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=2592000
cdn-requestid
41f582a50fd89f5e5337b935f08f7daa
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
app-CXF7qas5.css
ap.lunar.build/build/assets/
64 KB
12 KB
Stylesheet
General
Full URL
https://ap.lunar.build/build/assets/app-CXF7qas5.css
Requested by
Host: ap.lunar.build
URL: https://ap.lunar.build/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.205.180.98 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
37d8f9cd60bb7d7fcfcc258b55d0aa93d50131e83b5b6c5175ebdedd2a7c8c39
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ap.lunar.build/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:44:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 29 Jul 2024 09:53:05 GMT
server
nginx
etag
W/"66a76681-100d3"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
x-xss-protection
1; mode=block
app-CItc04k8.js
ap.lunar.build/build/assets/
110 KB
35 KB
Script
General
Full URL
https://ap.lunar.build/build/assets/app-CItc04k8.js
Requested by
Host: ap.lunar.build
URL: https://ap.lunar.build/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.205.180.98 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
03b25a3db790942df40ac2dda90e806f6f426d2d34ee16b90974fdd5417dce09
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ap.lunar.build/
Origin
https://ap.lunar.build
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:44:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 29 Jul 2024 09:53:05 GMT
server
nginx
etag
W/"66a76681-1b97a"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
x-xss-protection
1; mode=block
core.min.js
ap.lunar.build/rappasoft/laravel-livewire-tables/
7 KB
2 KB
Script
General
Full URL
https://ap.lunar.build/rappasoft/laravel-livewire-tables/core.min.js
Requested by
Host: ap.lunar.build
URL: https://ap.lunar.build/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.205.180.98 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
255c40e2a8e9162444d6c44504cc6405c14c1bb57bcb417f5f5387e13710b870
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ap.lunar.build/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:44:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sat, 20 Jul 2024 00:28:29 GMT
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
cache-control
max-age=1, public
x-xss-protection
1; mode=block
expires
Mon, 29 Jul 2024 10:44:17 GMT
thirdparty.min.js
ap.lunar.build/rappasoft/laravel-livewire-tables/
57 KB
15 KB
Script
General
Full URL
https://ap.lunar.build/rappasoft/laravel-livewire-tables/thirdparty.min.js
Requested by
Host: ap.lunar.build
URL: https://ap.lunar.build/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.205.180.98 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
27e145083ba3d2e82ae5c08f6642ae2859b94e58114fca9d4ec2397331271f3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ap.lunar.build/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:44:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sat, 20 Jul 2024 00:28:29 GMT
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
cache-control
max-age=1, public
x-xss-protection
1; mode=block
expires
Mon, 29 Jul 2024 10:44:17 GMT
login.jpg
ap.lunar.build/images/
716 KB
717 KB
Image
General
Full URL
https://ap.lunar.build/images/login.jpg
Requested by
Host: ap.lunar.build
URL: https://ap.lunar.build/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.205.180.98 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
a6c54672aa7189061a9b946d247287db59eccfbc3f93220998e3cb7d8f8f90b3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ap.lunar.build/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:44:16 GMT
x-content-type-options
nosniff
last-modified
Fri, 26 Jul 2024 09:31:02 GMT
server
nginx
etag
"66a36cd6-b2fbe"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
accept-ranges
bytes
content-length
733118
x-xss-protection
1; mode=block
livewire.min.js
ap.lunar.build/livewire/
140 KB
49 KB
Script
General
Full URL
https://ap.lunar.build/livewire/livewire.min.js?id=cc800bf4
Requested by
Host: ap.lunar.build
URL: https://ap.lunar.build/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.205.180.98 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
c9417b7b0a591f7184adae88495fce4e1f7cf25d51becffd40343ad9045bf1f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ap.lunar.build/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:44:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 15 Jul 2024 18:27:32 GMT
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000, public
x-xss-protection
1; mode=block
expires
Tue, 29 Jul 2025 10:44:16 GMT
APBold-CjNycrZ3.otf
ap.lunar.build/build/assets/
100 KB
100 KB
Font
General
Full URL
https://ap.lunar.build/build/assets/APBold-CjNycrZ3.otf
Requested by
Host: ap.lunar.build
URL: https://ap.lunar.build/build/assets/app-CXF7qas5.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.205.180.98 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
ba8623a5de34f0bc69e8a6e1cb866661a5c6e31c019064f3e6e10d441d554190
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ap.lunar.build/build/assets/app-CXF7qas5.css
Origin
https://ap.lunar.build
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:44:17 GMT
x-content-type-options
nosniff
last-modified
Mon, 29 Jul 2024 09:53:05 GMT
server
nginx
etag
"66a76681-19034"
x-frame-options
SAMEORIGIN
content-type
application/octet-stream
accept-ranges
bytes
content-length
102452
x-xss-protection
1; mode=block
APMedium-0GJCr3yV.otf
ap.lunar.build/build/assets/
100 KB
101 KB
Font
General
Full URL
https://ap.lunar.build/build/assets/APMedium-0GJCr3yV.otf
Requested by
Host: ap.lunar.build
URL: https://ap.lunar.build/build/assets/app-CXF7qas5.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.205.180.98 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
8b2a73d75b8573c404e54f5536ae18c7d0f3c9ea07e8685280aefe28aa8273ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ap.lunar.build/build/assets/app-CXF7qas5.css
Origin
https://ap.lunar.build
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:44:17 GMT
x-content-type-options
nosniff
last-modified
Mon, 29 Jul 2024 09:53:05 GMT
server
nginx
etag
"66a76681-191c4"
x-frame-options
SAMEORIGIN
content-type
application/octet-stream
accept-ranges
bytes
content-length
102852
x-xss-protection
1; mode=block
APRegular-CcZIlt6U.otf
ap.lunar.build/build/assets/
99 KB
100 KB
Font
General
Full URL
https://ap.lunar.build/build/assets/APRegular-CcZIlt6U.otf
Requested by
Host: ap.lunar.build
URL: https://ap.lunar.build/build/assets/app-CXF7qas5.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.205.180.98 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
215416c51b8178ff34be7f0dfb7abbce74de937d0654ebce916091926a26865c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ap.lunar.build/build/assets/app-CXF7qas5.css
Origin
https://ap.lunar.build
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:44:17 GMT
x-content-type-options
nosniff
last-modified
Mon, 29 Jul 2024 09:53:05 GMT
server
nginx
etag
"66a76681-18d74"
x-frame-options
SAMEORIGIN
content-type
application/octet-stream
accept-ranges
bytes
content-length
101748
x-xss-protection
1; mode=block
favicon.ico
ap.lunar.build/
0
182 B
Other
General
Full URL
https://ap.lunar.build/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.205.180.98 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ap.lunar.build/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:44:18 GMT
x-content-type-options
nosniff
last-modified
Fri, 26 Jul 2024 09:31:02 GMT
server
nginx
etag
"66a36cd6-0"
x-frame-options
SAMEORIGIN
content-type
image/x-icon
accept-ranges
bytes
content-length
0
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| flatpickr object| Livewire object| Alpine function| Pusher object| Echo function| axios

2 Cookies

Domain/Path Name / Value
.ap.lunar.build/ Name: XSRF-TOKEN
Value: eyJpdiI6Ii9jd3h3K1dMb21hQ3BKSU9STXZTbXc9PSIsInZhbHVlIjoiaSs2cTF4Ukp3VE5CaDlTM21STmY4Wk00ZFVZNXAyUXh2TEVYV0xUbXpRKzdmUk9qSUdyUmVKRkVpY0NFYXBuK3dlRGdJU0lhTDJya2szWUQxVU81NkpRUDlmK1JtVHd3bjlPUGNKbTNSeTQ5QXp1NGFWL2tyb1BCNExtSnZTd0YiLCJtYWMiOiJhNDFjYjRmMGEzYzczYmM4ODA0YzBkZjg2NTQyZTA5YTE5NmIzMmY3Mjg3YWExYmRiMWMxODRjZTdlOTllN2U5IiwidGFnIjoiIn0%3D
.ap.lunar.build/ Name: ap_staging_session
Value: eyJpdiI6Img2WTN4UUZITlNnbStJTTlIZ1A3eVE9PSIsInZhbHVlIjoiYXVFZGdNeGpkUlRHMWJ1clU1VWJyWHl5VjVzM05rMTkxV2djYXBXZVF1ZHVTbFJpd1J3bW1ReTQ0MFYrQjdSZVdqaDljaUhsMjJoTDJ2VDlGdldIRk5KZXEyNkdzUkZvS08ybVljU05OWUZPRU9rbWxKSTU1MzMzNUFGTy9vTFAiLCJtYWMiOiJjNGNlOTJkNWU0MDI5MGUyODQwNDk3OTJhMTliOTY3M2IyYzE0ZGZmOWRjNTk4NDllNWI5YTRkOTRhNmViZmUyIiwidGFnIjoiIn0%3D

1 Console Messages

Source Level URL
Text
network error URL: https://ap.lunar.build/build/assets/app-CItc04k8.js(Line 12)
Message:
WebSocket connection to 'wss://ws.ap.lunar.build/app/gw4rhu74fcwuno2zje4j?protocol=7&client=js&version=8.4.0-rc2&flash=false' failed: Error during WebSocket handshake: Unexpected response code: 502

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block