urlscan.io logo urlscan.io
SecurityTrails logo

vpnbox-1.ingbank.com.tr Open in urlscan Pro
85.158.99.164  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://vpnbox-1.ingbank.com.tr/
Effective URL: https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi
Submission: On November 13 via manual from PL — Scanned from PL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 85.158.99.164, located in Istanbul, Turkey and belongs to INGBANKTR-AS, TR. The main domain is vpnbox-1.ingbank.com.tr.
TLS certificate: Issued by HydrantID Server CA O1 on November 12th 2024. Valid for: a year.
This is the only time vpnbox-1.ingbank.com.tr was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 10 85.158.99.164 34403 (INGBANKTR-AS)
9 1
Apex Domain
Subdomains		 Transfer
10 ingbank.com.tr
vpnbox-1.ingbank.com.tr
24 KB
9 1
Domain Requested by
10 vpnbox-1.ingbank.com.tr 1 redirects vpnbox-1.ingbank.com.tr
9 1

This site contains no links.

Subject Issuer Validity Valid
vpnbox.ing.com.tr
HydrantID Server CA O1		 2024-11-12 -
2025-12-12		 a year crt.sh

This page contains 1 frames:

Primary Page: https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi
Frame ID: 23A93B50A006DE8846341B74758FE815
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Ivanti Connect Secure

Page URL History Show full URLs

  1. http://vpnbox-1.ingbank.com.tr/ HTTP 307
    https://vpnbox-1.ingbank.com.tr/ HTTP 302
    https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /dana-na/auth/

Page Statistics

9
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

23 kB
Transfer

50 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://vpnbox-1.ingbank.com.tr/ HTTP 307
    https://vpnbox-1.ingbank.com.tr/ HTTP 302
    https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request welcome.cgi
vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/
Redirect Chain
  • http://vpnbox-1.ingbank.com.tr/
  • https://vpnbox-1.ingbank.com.tr/
  • https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi
6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.158.99.164 Istanbul, Turkey, ASN34403 (INGBANKTR-AS, TR),
Reverse DNS
vpnbox-1.ingbank.com.tr
Software
/
Resource Hash
c9d04114c0f5c6b4e8c773d5348451470ba9ccca8ed004c1260a5eee34f78d83
Security Headers
Name Value
Content-Security-Policy img-src * data:
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1 1;mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Cache-Control
no-store
Connection
Keep-Alive
Content-Encoding
gzip
Content-Security-Policy
img-src * data:
Content-Type
text/html; charset=utf-8
Date
Wed, 13 Nov 2024 09:16:06 GMT
Expires
-1
HSTS
max-age=31536000; includeSubDomains
Keep-Alive
timeout=15
Pragma
no-cache
Strict-Transport-Security
max-age=31536000
Transfer-Encoding
chunked
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1 1;mode=block
accept-ch
Sec-CH-UA-Platform-Version
x-frame-options
SAMEORIGIN

Redirect headers

Connection
close
Content-Length
0
Content-Security-Policy
img-src * data:
Content-Type
text/html; charset=utf-8
HSTS
max-age=31536000; includeSubDomains
Location
/dana-na/auth/url_default/welcome.cgi
Strict-Transport-Security
max-age=31536000
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1 1;mode=block
accept-ch
Sec-CH-UA-Platform-Version
ds_a5b5b3183ff93eaa6698e0491ce8c3f10e2b51441b12185ae91032aea45259c0.js
vpnbox-1.ingbank.com.tr/dana-na/css/ 		26 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vpnbox-1.ingbank.com.tr/dana-na/css/ds_a5b5b3183ff93eaa6698e0491ce8c3f10e2b51441b12185ae91032aea45259c0.js
Requested by
Host: vpnbox-1.ingbank.com.tr
URL: https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.158.99.164 Istanbul, Turkey, ASN34403 (INGBANKTR-AS, TR),
Reverse DNS
vpnbox-1.ingbank.com.tr
Software
/
Resource Hash
4947f2f2c1eca6c03f4a91befb1d7c76780fa1ee4c331c51036add7e152b9505
Security Headers
Name Value
Content-Security-Policy img-src * data:
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1, 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi

Response headers

Transfer-Encoding
chunked
Strict-Transport-Security
max-age=31536000
HSTS
max-age=31536000; includeSubDomains
Content-Security-Policy
img-src * data:
Content-Encoding
gzip
accept-ch
Sec-CH-UA-Platform-Version
Connection
Keep-Alive
X-Content-Type-Options
nosniff
Keep-Alive
timeout=15
X-XSS-Protection
1, 1;mode=block
Content-Type
application/x-javascript
Last-Modified
Thu, 29 Feb 2024 12:07:29 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
lastauthserverused_a5b5b3183ff93eaa6698e0491ce8c3f10e2b51441b12185ae91032aea45259c0.js
vpnbox-1.ingbank.com.tr/dana-na/auth/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vpnbox-1.ingbank.com.tr/dana-na/auth/lastauthserverused_a5b5b3183ff93eaa6698e0491ce8c3f10e2b51441b12185ae91032aea45259c0.js
Requested by
Host: vpnbox-1.ingbank.com.tr
URL: https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.158.99.164 Istanbul, Turkey, ASN34403 (INGBANKTR-AS, TR),
Reverse DNS
vpnbox-1.ingbank.com.tr
Software
/
Resource Hash
108e944537405ae37d95d7e8cada991adcee704849c83175e1bfb1979f87ab37
Security Headers
Name Value
Content-Security-Policy img-src * data:
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1, 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi

Response headers

Transfer-Encoding
chunked
Strict-Transport-Security
max-age=31536000
HSTS
max-age=31536000; includeSubDomains
Content-Security-Policy
img-src * data:
Content-Encoding
gzip
accept-ch
Sec-CH-UA-Platform-Version
Connection
Keep-Alive
X-Content-Type-Options
nosniff
Keep-Alive
timeout=15
X-XSS-Protection
1, 1;mode=block
Content-Type
application/x-javascript
Last-Modified
Thu, 29 Feb 2024 12:03:41 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
welcome.cgi
vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi?p=logo&signinId=url_default
Requested by
Host: vpnbox-1.ingbank.com.tr
URL: https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.158.99.164 Istanbul, Turkey, ASN34403 (INGBANKTR-AS, TR),
Reverse DNS
vpnbox-1.ingbank.com.tr
Software
/
Resource Hash
639c79a58ac7963bcce97449d0b03d9db7284c7ed705017cedf96553615d6733
Security Headers
Name Value
Content-Security-Policy img-src * data:
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1, 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi

Response headers

Transfer-Encoding
chunked
Strict-Transport-Security
max-age=31536000
HSTS
max-age=31536000; includeSubDomains
Content-Security-Policy
img-src * data:
Cache-Control
no-store
Pragma
no-cache
accept-ch
Sec-CH-UA-Platform-Version
Connection
Keep-Alive
X-Content-Type-Options
nosniff
Expires
-1
Keep-Alive
timeout=15
X-XSS-Protection
1, 1;mode=block
Content-Type
image/png
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
space.gif
vpnbox-1.ingbank.com.tr/dana-na/imgs/ 		85 B
602 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vpnbox-1.ingbank.com.tr/dana-na/imgs/space.gif
Requested by
Host: vpnbox-1.ingbank.com.tr
URL: https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.158.99.164 Istanbul, Turkey, ASN34403 (INGBANKTR-AS, TR),
Reverse DNS
vpnbox-1.ingbank.com.tr
Software
/
Resource Hash
18291ff0709725d77c01f264cbc2802905abbfb9d4d9428f33242ba475fda93e
Security Headers
Name Value
Content-Security-Policy img-src * data:
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1, 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi

Response headers

HSTS
max-age=31536000; includeSubDomains
Strict-Transport-Security
max-age=31536000
Content-Security-Policy
img-src * data:
Cache-Control
max-age=86400, must-revalidate
accept-ch
Sec-CH-UA-Platform-Version
Connection
Keep-Alive
X-Content-Type-Options
nosniff
Keep-Alive
timeout=15
Content-Length
85
X-XSS-Protection
1, 1;mode=block
Content-Type
image/gif
Last-Modified
Thu, 29 Feb 2024 12:06:52 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
ds_nav_a5b5b3183ff93eaa6698e0491ce8c3f10e2b51441b12185ae91032aea45259c0.css
vpnbox-1.ingbank.com.tr/dana-na/css/ 		8 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://vpnbox-1.ingbank.com.tr/dana-na/css/ds_nav_a5b5b3183ff93eaa6698e0491ce8c3f10e2b51441b12185ae91032aea45259c0.css
Requested by
Host: vpnbox-1.ingbank.com.tr
URL: https://vpnbox-1.ingbank.com.tr/dana-na/css/ds_a5b5b3183ff93eaa6698e0491ce8c3f10e2b51441b12185ae91032aea45259c0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.158.99.164 Istanbul, Turkey, ASN34403 (INGBANKTR-AS, TR),
Reverse DNS
vpnbox-1.ingbank.com.tr
Software
/
Resource Hash
990750a2d6eecf0455d83a482d62297bc81f619ad0f82041e9a4c08528362af6
Security Headers
Name Value
Content-Security-Policy img-src * data:
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1, 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi

Response headers

Transfer-Encoding
chunked
Strict-Transport-Security
max-age=31536000
HSTS
max-age=31536000; includeSubDomains
Content-Security-Policy
img-src * data:
Content-Encoding
gzip
accept-ch
Sec-CH-UA-Platform-Version
Connection
Keep-Alive
X-Content-Type-Options
nosniff
Keep-Alive
timeout=15
X-XSS-Protection
1, 1;mode=block
Content-Type
text/css
Last-Modified
Thu, 29 Feb 2024 12:07:29 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
space.gif
vpnbox-1.ingbank.com.tr/dana-na/imgs/ 		85 B
602 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vpnbox-1.ingbank.com.tr/dana-na/imgs/space.gif
Requested by
Host: vpnbox-1.ingbank.com.tr
URL: https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.158.99.164 Istanbul, Turkey, ASN34403 (INGBANKTR-AS, TR),
Reverse DNS
vpnbox-1.ingbank.com.tr
Software
/
Resource Hash
18291ff0709725d77c01f264cbc2802905abbfb9d4d9428f33242ba475fda93e
Security Headers
Name Value
Content-Security-Policy img-src * data:
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1, 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi

Response headers

HSTS
max-age=31536000; includeSubDomains
Strict-Transport-Security
max-age=31536000
Content-Security-Policy
img-src * data:
Cache-Control
max-age=86400, must-revalidate
accept-ch
Sec-CH-UA-Platform-Version
Connection
Keep-Alive
X-Content-Type-Options
nosniff
Keep-Alive
timeout=15
Content-Length
85
X-XSS-Protection
1, 1;mode=block
Content-Type
image/gif
Last-Modified
Thu, 29 Feb 2024 12:06:52 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
footerbg.gif
vpnbox-1.ingbank.com.tr/dana-na/imgs/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vpnbox-1.ingbank.com.tr/dana-na/imgs/footerbg.gif
Requested by
Host: vpnbox-1.ingbank.com.tr
URL: https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.158.99.164 Istanbul, Turkey, ASN34403 (INGBANKTR-AS, TR),
Reverse DNS
vpnbox-1.ingbank.com.tr
Software
/
Resource Hash
141553aec082836eccb072573361c770d448b117bed20ad80df9f409c3a968ee
Security Headers
Name Value
Content-Security-Policy img-src * data:
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1, 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi

Response headers

HSTS
max-age=31536000; includeSubDomains
Strict-Transport-Security
max-age=31536000
Content-Security-Policy
img-src * data:
Cache-Control
max-age=86400, must-revalidate
accept-ch
Sec-CH-UA-Platform-Version
Connection
Keep-Alive
X-Content-Type-Options
nosniff
Keep-Alive
timeout=15
Content-Length
1918
X-XSS-Protection
1, 1;mode=block
Content-Type
image/gif
Last-Modified
Thu, 29 Feb 2024 12:06:52 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
Product_favicon.png
vpnbox-1.ingbank.com.tr/dana-na/imgs/ 		160 B
678 B 		Other
General
Check archive.org
Download Go to
Full URL
https://vpnbox-1.ingbank.com.tr/dana-na/imgs/Product_favicon.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.158.99.164 Istanbul, Turkey, ASN34403 (INGBANKTR-AS, TR),
Reverse DNS
vpnbox-1.ingbank.com.tr
Software
/
Resource Hash
9e7913966b6e5bb9ae4afa7fa601863f21f89420dc20da10d6b87040c71ca4bf
Security Headers
Name Value
Content-Security-Policy img-src * data:
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1, 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi

Response headers

HSTS
max-age=31536000; includeSubDomains
Strict-Transport-Security
max-age=31536000
Content-Security-Policy
img-src * data:
Cache-Control
max-age=86400, must-revalidate
accept-ch
Sec-CH-UA-Platform-Version
Connection
Keep-Alive
X-Content-Type-Options
nosniff
Keep-Alive
timeout=15
Content-Length
160
X-XSS-Protection
1, 1;mode=block
Content-Type
image/png
Last-Modified
Thu, 29 Feb 2024 12:06:52 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN

Verdicts & Comments Add Verdict or Comment

63 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| isGecko boolean| isNav boolean| isUx boolean| isChrome boolean| isSafari string| browserName number| gVersion function| GetCSS function| WriteCSS function| WriteThemeCSS function| WriteVanillaCSS function| GetVersion function| GetGeckoVersion function| HandleSeparator function| IsSeparator function| GetContainingElementByTagName function| SelectAll function| UnselectAll function| GetNumSelected function| GetNumSelectCheckboxes function| ClearOnloadHandlers function| AddOnloadHandler function| GDocumentOnKeyDown function| ClearKeyDownHandlers function| AddKeyDownHandler function| GDocumentOnClick function| CancelEvent function| ClearClickHandlers function| AddClickHandler function| StdKeyEvent function| StdMouseEvent function| Dbg function| DbgObject function| hasOptions function| selectUnselectMatchingOptions function| selectMatchingOptions function| selectOnlyMatchingOptions function| unSelectMatchingOptions function| sortSelect function| selectAllOptions function| moveSelectedOptions function| copySelectedOptions function| moveAllOptions function| copyAllOptions function| swapOptions function| moveOptionUp function| moveOptionDown function| removeSelectedOptions function| removeAllOptions function| addOption function| hideJSWarn function| SetLastRealm function| SetLastWsamInfo function| LoginImpl function| Login function| LoginPPC function| GetCookieValue function| recallLastRealmUsed function| removeLastRealmCookie function| removeLastSignInCookie function| FinishLoad function| FinishLoadPPC function| deletepreauth

5 Cookies

Domain/Path Name / Value
vpnbox-1.ingbank.com.tr/dana-na/ Name: DSSIGNIN
Value: url_default
vpnbox-1.ingbank.com.tr/ Name: DSSignInURL
Value: /
vpnbox-1.ingbank.com.tr/ Name: SUPPORTCHROMEOS
Value: 1
vpnbox-1.ingbank.com.tr/ Name: DISABLE_PHC
Value: 1
vpnbox-1.ingbank.com.tr/ Name: DSBrowserID
Value: 18514c5dd7ac9237adbab942536b50d2

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://vpnbox-1.ingbank.com.tr/dana-na/auth/url_default/welcome.cgi
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy img-src * data:
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1 1;mode=block