URL: https://dateivorschau.cmicloud.ch/
Submission: On July 14 via automatic, source certstream-suspicious — Scanned from CH

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 12 HTTP transactions. The main IP is 185.157.1.26, located in Dübendorf, Switzerland and belongs to UMB-AG, CH. The main domain is dateivorschau.cmicloud.ch.
TLS certificate: Issued by R10 on July 14th 2024. Valid for: 3 months.
This is the only time dateivorschau.cmicloud.ch was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
11 185.157.1.26 209346 (UMB-AG)
12 2
Apex Domain
Subdomains
Transfer
11 cmicloud.ch
dateivorschau.cmicloud.ch
1 MB
0 Failed
function sub() { [native code] }. Failed
12 2
Domain Requested by
11 dateivorschau.cmicloud.ch dateivorschau.cmicloud.ch
0 localhost Failed dateivorschau.cmicloud.ch
12 2

This site contains no links.

Subject Issuer Validity Valid
dateivorschau.cmicloud.ch
R10
2024-07-14 -
2024-10-12
3 months crt.sh

This page contains 1 frames:

Primary Page: https://dateivorschau.cmicloud.ch/
Frame ID: 8623B8B7D44890C86647DE7C20708FD8
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

CMI Elektronische Mappe

Page Statistics

12
Requests

92 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

1508 kB
Transfer

1506 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
dateivorschau.cmicloud.ch/
1 KB
2 KB
Document
General
Full URL
https://dateivorschau.cmicloud.ch/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.157.1.26 Dübendorf, Switzerland, ASN209346 (UMB-AG, CH),
Reverse DNS
Software
/
Resource Hash
ddbe3a9210448e136c17eb9a10d76384ff926651c950fd99ca388bc1acdc0ab3
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
content-length
1427
content-security-policy
default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
content-type
text/html
date
Sun, 14 Jul 2024 07:48:04 GMT
etag
"03390f084bfd81:0"
last-modified
Sat, 03 Sep 2022 11:04:30 GMT
permissions-policy
camera=(), display-capture=(), microphone=(), web-share=()
referrer-policy
no-referrer
server
strict-transport-security
max-age=31536000; includeSubdomains
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
_cmi.js
dateivorschau.cmicloud.ch/assets/cmi/
2 KB
2 KB
Script
General
Full URL
https://dateivorschau.cmicloud.ch/assets/cmi/_cmi.js
Requested by
Host: dateivorschau.cmicloud.ch
URL: https://dateivorschau.cmicloud.ch/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.157.1.26 Dübendorf, Switzerland, ASN209346 (UMB-AG, CH),
Reverse DNS
Software
/
Resource Hash
d37da4bc20432ed4e31c3f2f7d65e4f6181545c3574cdd86aa3fe6620ca34e6f
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains
content-security-policy
default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
referrer-policy
no-referrer
x-content-type-options
nosniff
last-modified
Sat, 03 Sep 2022 11:04:30 GMT
server
date
Sun, 14 Jul 2024 07:48:04 GMT
etag
"03390f084bfd81:0"
x-frame-options
SAMEORIGIN
content-type
application/javascript
permissions-policy
camera=(), display-capture=(), microphone=(), web-share=()
accept-ranges
bytes
content-length
1976
x-xss-protection
1; mode=block
debug.log.css
dateivorschau.cmicloud.ch/assets/cmi/
856 B
934 B
Stylesheet
General
Full URL
https://dateivorschau.cmicloud.ch/assets/cmi/debug.log.css
Requested by
Host: dateivorschau.cmicloud.ch
URL: https://dateivorschau.cmicloud.ch/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.157.1.26 Dübendorf, Switzerland, ASN209346 (UMB-AG, CH),
Reverse DNS
Software
/
Resource Hash
c90bbece266d01f5d05d779bddff49ece65493449509c0ee4d8c45e8bf30773e
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains
content-security-policy
default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
referrer-policy
no-referrer
x-content-type-options
nosniff
last-modified
Sat, 03 Sep 2022 11:04:30 GMT
server
date
Sun, 14 Jul 2024 07:48:04 GMT
etag
"03390f084bfd81:0"
x-frame-options
SAMEORIGIN
content-type
text/css
permissions-policy
camera=(), display-capture=(), microphone=(), web-share=()
accept-ranges
bytes
content-length
856
x-xss-protection
1; mode=block
debug.log.js
dateivorschau.cmicloud.ch/assets/cmi/
2 KB
3 KB
Script
General
Full URL
https://dateivorschau.cmicloud.ch/assets/cmi/debug.log.js
Requested by
Host: dateivorschau.cmicloud.ch
URL: https://dateivorschau.cmicloud.ch/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.157.1.26 Dübendorf, Switzerland, ASN209346 (UMB-AG, CH),
Reverse DNS
Software
/
Resource Hash
df6acb64164c97921086f7bc238b77cc8c5d65980dfd0c857fdac4a337c80bdb
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains
content-security-policy
default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
referrer-policy
no-referrer
x-content-type-options
nosniff
last-modified
Sat, 03 Sep 2022 11:04:30 GMT
server
date
Sun, 14 Jul 2024 07:48:04 GMT
etag
"03390f084bfd81:0"
x-frame-options
SAMEORIGIN
content-type
application/javascript
permissions-policy
camera=(), display-capture=(), microphone=(), web-share=()
accept-ranges
bytes
content-length
2500
x-xss-protection
1; mode=block
styles.a7d9087a0888ec42f217.css
dateivorschau.cmicloud.ch/
60 KB
60 KB
Stylesheet
General
Full URL
https://dateivorschau.cmicloud.ch/styles.a7d9087a0888ec42f217.css
Requested by
Host: dateivorschau.cmicloud.ch
URL: https://dateivorschau.cmicloud.ch/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.157.1.26 Dübendorf, Switzerland, ASN209346 (UMB-AG, CH),
Reverse DNS
Software
/
Resource Hash
4b6a416fb5cf77d89c722b63799d884ab0a5e2e38e30f20260f01879c02f7ea5
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains
content-security-policy
default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
referrer-policy
no-referrer
x-content-type-options
nosniff
last-modified
Sat, 03 Sep 2022 11:04:30 GMT
server
date
Sun, 14 Jul 2024 07:48:04 GMT
etag
"03390f084bfd81:0"
x-frame-options
SAMEORIGIN
content-type
text/css
permissions-policy
camera=(), display-capture=(), microphone=(), web-share=()
accept-ranges
bytes
content-length
61782
x-xss-protection
1; mode=block
runtime.a66f828dca56eeb90e02.js
dateivorschau.cmicloud.ch/
1 KB
1 KB
Script
General
Full URL
https://dateivorschau.cmicloud.ch/runtime.a66f828dca56eeb90e02.js
Requested by
Host: dateivorschau.cmicloud.ch
URL: https://dateivorschau.cmicloud.ch/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.157.1.26 Dübendorf, Switzerland, ASN209346 (UMB-AG, CH),
Reverse DNS
Software
/
Resource Hash
3b7856c7c65f6b743f0e4742e7e047e34d000450384ebb2f966fe5796e58bd41
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains
content-security-policy
default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
referrer-policy
no-referrer
x-content-type-options
nosniff
last-modified
Sat, 03 Sep 2022 11:04:30 GMT
server
date
Sun, 14 Jul 2024 07:48:04 GMT
etag
"03390f084bfd81:0"
x-frame-options
SAMEORIGIN
content-type
application/javascript
permissions-policy
camera=(), display-capture=(), microphone=(), web-share=()
accept-ranges
bytes
content-length
1053
x-xss-protection
1; mode=block
polyfills.c73859e40efca2e7fd78.js
dateivorschau.cmicloud.ch/
92 KB
92 KB
Script
General
Full URL
https://dateivorschau.cmicloud.ch/polyfills.c73859e40efca2e7fd78.js
Requested by
Host: dateivorschau.cmicloud.ch
URL: https://dateivorschau.cmicloud.ch/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.157.1.26 Dübendorf, Switzerland, ASN209346 (UMB-AG, CH),
Reverse DNS
Software
/
Resource Hash
e5e49f8ef8c909e2a12a5e6a15aa4df9ff2358919e15c428471eb4388530d4cc
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains
content-security-policy
default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
referrer-policy
no-referrer
x-content-type-options
nosniff
last-modified
Sat, 03 Sep 2022 11:04:30 GMT
server
date
Sun, 14 Jul 2024 07:48:04 GMT
etag
"03390f084bfd81:0"
x-frame-options
SAMEORIGIN
content-type
application/javascript
permissions-policy
camera=(), display-capture=(), microphone=(), web-share=()
accept-ranges
bytes
content-length
94504
x-xss-protection
1; mode=block
main.a90eb80c8e392a4970da.js
dateivorschau.cmicloud.ch/
1 MB
1 MB
Script
General
Full URL
https://dateivorschau.cmicloud.ch/main.a90eb80c8e392a4970da.js
Requested by
Host: dateivorschau.cmicloud.ch
URL: https://dateivorschau.cmicloud.ch/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.157.1.26 Dübendorf, Switzerland, ASN209346 (UMB-AG, CH),
Reverse DNS
Software
/
Resource Hash
30ef524c8660ac92d826551329e1730965063c61d7c15d705269241581de3b11
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains
content-security-policy
default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
referrer-policy
no-referrer
x-content-type-options
nosniff
last-modified
Sat, 03 Sep 2022 11:04:30 GMT
server
date
Sun, 14 Jul 2024 07:48:04 GMT
etag
"03390f084bfd81:0"
x-frame-options
SAMEORIGIN
content-type
application/javascript
permissions-policy
camera=(), display-capture=(), microphone=(), web-share=()
accept-ranges
bytes
content-length
1361700
x-xss-protection
1; mode=block
wijmo.culture.de.min.js
dateivorschau.cmicloud.ch/assets/wijmo/
11 KB
11 KB
Script
General
Full URL
https://dateivorschau.cmicloud.ch/assets/wijmo/wijmo.culture.de.min.js
Requested by
Host: dateivorschau.cmicloud.ch
URL: https://dateivorschau.cmicloud.ch/main.a90eb80c8e392a4970da.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.157.1.26 Dübendorf, Switzerland, ASN209346 (UMB-AG, CH),
Reverse DNS
Software
/
Resource Hash
eebb91f7d49c02fc9c7751cb7e27beb342c2d49c73507720e134c070f1dcaf8f
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains
content-security-policy
default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
referrer-policy
no-referrer
x-content-type-options
nosniff
last-modified
Sat, 03 Sep 2022 11:04:30 GMT
server
date
Sun, 14 Jul 2024 07:48:07 GMT
etag
"03390f084bfd81:0"
x-frame-options
SAMEORIGIN
content-type
application/javascript
permissions-policy
camera=(), display-capture=(), microphone=(), web-share=()
accept-ranges
bytes
content-length
10787
x-xss-protection
1; mode=block
GetSettings
localhost/api/mobilegever/Public/
0
0

de.json
dateivorschau.cmicloud.ch/assets/translations/
1 KB
1 KB
XHR
General
Full URL
https://dateivorschau.cmicloud.ch/assets/translations/de.json?nonce=1720943287314
Requested by
Host: dateivorschau.cmicloud.ch
URL: https://dateivorschau.cmicloud.ch/polyfills.c73859e40efca2e7fd78.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.157.1.26 Dübendorf, Switzerland, ASN209346 (UMB-AG, CH),
Reverse DNS
Software
/
Resource Hash
5609f81d88e8fc3f9be0f6d01778d9573f488c5d4ba29e8fa42810ba1aa82e28
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/plain, */*
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains
content-security-policy
default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
referrer-policy
no-referrer
x-content-type-options
nosniff
last-modified
Sat, 03 Sep 2022 11:04:30 GMT
server
date
Sun, 14 Jul 2024 07:48:07 GMT
etag
"03390f084bfd81:0"
x-frame-options
SAMEORIGIN
content-type
application/json
permissions-policy
camera=(), display-capture=(), microphone=(), web-share=()
accept-ranges
bytes
content-length
1291
x-xss-protection
1; mode=block
favicon.ico
dateivorschau.cmicloud.ch/assets/img/ico/
4 KB
4 KB
Other
General
Full URL
https://dateivorschau.cmicloud.ch/assets/img/ico/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.157.1.26 Dübendorf, Switzerland, ASN209346 (UMB-AG, CH),
Reverse DNS
Software
/
Resource Hash
6b6d0d9628f5c0fbcfb0b03972d54d6812f38c81c51801f48a0c4efd065c718b
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains
content-security-policy
default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
referrer-policy
no-referrer
x-content-type-options
nosniff
last-modified
Sat, 03 Sep 2022 11:04:30 GMT
server
date
Sun, 14 Jul 2024 07:48:07 GMT
etag
"03390f084bfd81:0"
x-frame-options
SAMEORIGIN
content-type
image/x-icon
permissions-policy
camera=(), display-capture=(), microphone=(), web-share=()
accept-ranges
bytes
content-length
4286
x-xss-protection
1; mode=block

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
localhost
URL
http://localhost:10004/api/mobilegever/Public/GetSettings

Verdicts & Comments Add Verdict or Comment

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _cmi function| CmiDebugLogger object| webpackJsonp object| core object| __core-js_shared__ function| Zone function| __zone_symbol__Promise function| __zone_symbol__ZoneAwarePromise function| __zone_symbol__setTimeout function| __zone_symbol__clearTimeout function| __zone_symbol__setInterval function| __zone_symbol__clearInterval function| __zone_symbol__requestAnimationFrame function| __zone_symbol__cancelAnimationFrame function| __zone_symbol__webkitRequestAnimationFrame function| __zone_symbol__webkitCancelAnimationFrame function| __zone_symbol__alert function| __zone_symbol__prompt function| __zone_symbol__confirm function| __zone_symbol__MutationObserver function| __zone_symbol__WebKitMutationObserver function| __zone_symbol__IntersectionObserver function| __zone_symbol__FileReader boolean| ngDevMode object| wijmo object| ng object| __zone_symbol__popstatefalse object| __zone_symbol__hashchangefalse function| __zone_symbol__addEventListener function| __zone_symbol__removeEventListener function| eventListeners function| removeAllListeners

0 Cookies

2 Console Messages

Source Level URL
Text
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'web-share'.
security error URL: https://dateivorschau.cmicloud.ch/polyfills.c73859e40efca2e7fd78.js
Message:
Refused to connect to 'http://localhost:10004/api/mobilegever/Public/GetSettings' because it violates the following Content Security Policy directive: "connect-src 'self' https://proxy.cmicloud.ch".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; connect-src 'self' https://proxy.cmicloud.ch; img-src 'self' blob: data:;
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block