URL: https://qc.ca.account.docusign.com/
Submission: On November 09 via automatic, source certstream-suspicious

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 40.86.219.41, located in Québec, Canada and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is qc.ca.account.docusign.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on October 2nd 2020. Valid for: 8 months.
This is the only time qc.ca.account.docusign.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
11 40.86.219.41 8075 (MICROSOFT...)
11 1
Apex Domain
Subdomains
Transfer
11 docusign.com
qc.ca.account.docusign.com
384 KB
11 1
Domain Requested by
11 qc.ca.account.docusign.com qc.ca.account.docusign.com
11 1

This site contains links to these domains. Also see Links.

Domain
www.docusign.com
Subject Issuer Validity Valid
ca.account.docusign.com
DigiCert SHA2 Extended Validation Server CA
2020-10-02 -
2021-06-07
8 months crt.sh

This page contains 1 frames:

Primary Page: https://qc.ca.account.docusign.com/
Frame ID: ECFC406DDE34727840CEBFACFFA1C20E
Requests: 11 HTTP requests in this frame

Screenshot


Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

384 kB
Transfer

994 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set /
qc.ca.account.docusign.com/
62 KB
14 KB
Document
General
Full URL
https://qc.ca.account.docusign.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.86.219.41 Québec, Canada, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
edf220832631580b8857e05a9d0a5d7f3c8fabc803197290bef995f661fffd95
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' 'self';style-src 'unsafe-inline' 'self';img-src data: https://docucdn-a.akamaihd.net 'self' https://*.docusign.com https://*.docusign.net https://www.docusign.com.au https://www.docusign.co.uk https://www.docusign.ca;font-src 'self' https://* data:;connect-src 'self' data:;object-src 'none';media-src 'none';frame-src https://docusign.sjv.io https://*.docusign.com; report-uri /client-errors/csp/enforce
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block; report=/client-errors/xss

Request headers

Host
qc.ca.account.docusign.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Cache-Control
no-cache, no-store, must-revalidate
Pragma
no-cache
Content-Type
text/html; charset=utf-8
Expires
-1
X-DocuSign-TraceToken
b42de519-d154-4235-906a-83947d867f0b
X-Frame-Options
SAMEORIGIN
Content-Security-Policy-Report-Only
script-src 'unsafe-inline' 'unsafe-eval' 'self';style-src 'unsafe-inline' 'self';img-src data: https://docucdn-a.akamaihd.net 'self' https://*.docusign.com https://*.docusign.net https://www.docusign.com.au https://www.docusign.co.uk https://www.docusign.ca;font-src 'self' https://* data:;connect-src 'self' data:;object-src 'none';media-src 'none';frame-src https://docusign.sjv.io https://*.docusign.com; report-uri /client-errors/csp/report
Content-Security-Policy
script-src 'unsafe-inline' 'unsafe-eval' 'self';style-src 'unsafe-inline' 'self';img-src data: https://docucdn-a.akamaihd.net 'self' https://*.docusign.com https://*.docusign.net https://www.docusign.com.au https://www.docusign.co.uk https://www.docusign.ca;font-src 'self' https://* data:;connect-src 'self' data:;object-src 'none';media-src 'none';frame-src https://docusign.sjv.io https://*.docusign.com; report-uri /client-errors/csp/enforce
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-XSS-Protection
1; mode=block; report=/client-errors/xss
Set-Cookie
__RequestVerificationToken=AadBnAV9KupNSomqpO2n7QUB0; path=/; secure; HttpOnly
X-DocuSign-Node
QC1FE16
Date
Mon, 09 Nov 2020 15:49:37 GMT
Content-Length
12854
Vary
Accept-Encoding
Content-Encoding
gzip
Connection
Keep-Alive
app
qc.ca.account.docusign.com/LoginAppNext/styles/olive/and/
236 KB
61 KB
Stylesheet
General
Full URL
https://qc.ca.account.docusign.com/LoginAppNext/styles/olive/and/app?v=7_dKAUfFq_HQdBnGB4k7hYZKoOae-bgnT30ORlEXHEk1
Requested by
Host: qc.ca.account.docusign.com
URL: https://qc.ca.account.docusign.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.86.219.41 Québec, Canada, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
f39daa36e62d2902109b1971bcd36cee542b3c0a67d27fa7388ef7e12923594c

Request headers

Referer
https://qc.ca.account.docusign.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 09 Nov 2020 15:49:38 GMT
Content-Encoding
gzip
Last-Modified
Mon, 09 Nov 2020 15:49:38 GMT
X-DocuSign-Node
QC1FE17
Vary
User-Agent, Accept-Encoding
Content-Type
text/css; charset=utf-8
Cache-Control
public
Connection
Keep-Alive
Content-Length
61890
Expires
Tue, 09 Nov 2021 15:49:38 GMT
core_via_npm
qc.ca.account.docusign.com/LoginAppNext/
367 KB
139 KB
Script
General
Full URL
https://qc.ca.account.docusign.com/LoginAppNext/core_via_npm?v=HmqVrseATw9A8eLx4-PxjAKYi3QSWgFzyC0R2L_sc9Q1
Requested by
Host: qc.ca.account.docusign.com
URL: https://qc.ca.account.docusign.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.86.219.41 Québec, Canada, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
6be83f132e3b23c96ec90857636dabb56f323891c67bf16d70bd6919a894140f

Request headers

Referer
https://qc.ca.account.docusign.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 09 Nov 2020 15:49:37 GMT
Content-Encoding
gzip
Last-Modified
Mon, 09 Nov 2020 15:49:38 GMT
X-DocuSign-Node
QC1FE18
Vary
User-Agent, Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Cache-Control
public
Connection
Keep-Alive
Content-Length
141880
Expires
Tue, 09 Nov 2021 15:49:38 GMT
templates
qc.ca.account.docusign.com/LoginAppNext/
102 KB
25 KB
Script
General
Full URL
https://qc.ca.account.docusign.com/LoginAppNext/templates?v=xXGqfXV9e3RCrv99_P1HyZe7t8BG4KPFXZrc-NwQz-M1
Requested by
Host: qc.ca.account.docusign.com
URL: https://qc.ca.account.docusign.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.86.219.41 Québec, Canada, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
3e6a5a1e169f194b39bacba3d3ef16a230b4dc35f7a3909667da82d34c6701bf

Request headers

Referer
https://qc.ca.account.docusign.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 09 Nov 2020 15:49:38 GMT
Content-Encoding
gzip
Last-Modified
Mon, 09 Nov 2020 15:49:38 GMT
X-DocuSign-Node
QC1FE15
Vary
User-Agent, Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Cache-Control
public
Connection
Keep-Alive
Content-Length
25475
Expires
Tue, 09 Nov 2021 15:49:38 GMT
app
qc.ca.account.docusign.com/Scripts/
125 KB
40 KB
Script
General
Full URL
https://qc.ca.account.docusign.com/Scripts/app?v=6ihmLLtFupVmh26nXO6mC8TSaGaTp8BRzbGLPRG_kKo1
Requested by
Host: qc.ca.account.docusign.com
URL: https://qc.ca.account.docusign.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.86.219.41 Québec, Canada, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
b04ace097c1f15b6023930be0c34996a90f666d6dbcd704dbc539aec4cda81c7

Request headers

Referer
https://qc.ca.account.docusign.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 09 Nov 2020 15:49:37 GMT
Content-Encoding
gzip
Last-Modified
Mon, 09 Nov 2020 15:49:38 GMT
X-DocuSign-Node
QC1FE16
Vary
User-Agent, Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Cache-Control
public
Connection
Keep-Alive
Content-Length
40720
Expires
Tue, 09 Nov 2021 15:49:38 GMT
HelveticaNeueW01-55Roma.woff
qc.ca.account.docusign.com/LoginAppNext/styles/olive/fonts/
47 KB
47 KB
Font
General
Full URL
https://qc.ca.account.docusign.com/LoginAppNext/styles/olive/fonts/HelveticaNeueW01-55Roma.woff
Requested by
Host: qc.ca.account.docusign.com
URL: https://qc.ca.account.docusign.com/LoginAppNext/styles/olive/and/app?v=7_dKAUfFq_HQdBnGB4k7hYZKoOae-bgnT30ORlEXHEk1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.86.219.41 Québec, Canada, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
dac5803d6cbe40244dfd39661406239f83e94e86c976e7229a4e35305a9b5efe

Request headers

Origin
https://qc.ca.account.docusign.com
Referer
https://qc.ca.account.docusign.com/LoginAppNext/styles/olive/and/app?v=7_dKAUfFq_HQdBnGB4k7hYZKoOae-bgnT30ORlEXHEk1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 09 Nov 2020 15:49:38 GMT
ETag
"82b7b2251afd61:0"
Last-Modified
Fri, 30 Oct 2020 21:10:51 GMT
Accept-Ranges
bytes
X-DocuSign-Node
QC1FE15
Content-Length
47748
Content-Type
application/x-font-woff
docusign_logo_old_small.png
qc.ca.account.docusign.com/LoginAppNext/images/
5 KB
5 KB
Image
General
Full URL
https://qc.ca.account.docusign.com/LoginAppNext/images/docusign_logo_old_small.png
Requested by
Host: qc.ca.account.docusign.com
URL: https://qc.ca.account.docusign.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.86.219.41 Québec, Canada, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
ee3cec3c33913424b8a94f2ba811277a4aaf0a8476d61653769c5d953ddeecbd

Request headers

Referer
https://qc.ca.account.docusign.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 09 Nov 2020 15:49:37 GMT
ETag
"695da8251afd61:0"
Last-Modified
Fri, 30 Oct 2020 21:10:51 GMT
Accept-Ranges
bytes
X-DocuSign-Node
QC1FE16
Content-Length
5352
Content-Type
image/png
docusign_logo_small.png
qc.ca.account.docusign.com/LoginAppNext/images/
4 KB
4 KB
Image
General
Full URL
https://qc.ca.account.docusign.com/LoginAppNext/images/docusign_logo_small.png
Requested by
Host: qc.ca.account.docusign.com
URL: https://qc.ca.account.docusign.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.86.219.41 Québec, Canada, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e83f8d0b4a78d14185abfca96ee2fbaf18e396a047f725d944ff27a845787279

Request headers

Referer
https://qc.ca.account.docusign.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 09 Nov 2020 15:49:38 GMT
ETag
"6c88a8251afd61:0"
Last-Modified
Fri, 30 Oct 2020 21:10:51 GMT
Accept-Ranges
bytes
X-DocuSign-Node
QC1FE17
Content-Length
4064
Content-Type
image/png
maven_pro_bold.woff
qc.ca.account.docusign.com/LoginAppNext/styles/olive/fonts/
33 KB
33 KB
Font
General
Full URL
https://qc.ca.account.docusign.com/LoginAppNext/styles/olive/fonts/maven_pro_bold.woff
Requested by
Host: qc.ca.account.docusign.com
URL: https://qc.ca.account.docusign.com/LoginAppNext/styles/olive/and/app?v=7_dKAUfFq_HQdBnGB4k7hYZKoOae-bgnT30ORlEXHEk1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.86.219.41 Québec, Canada, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
8f6a520a392ff62149e5fc5aa87bfab9b3816cd6010d4d4fca194e8683ca498b

Request headers

Origin
https://qc.ca.account.docusign.com
Referer
https://qc.ca.account.docusign.com/LoginAppNext/styles/olive/and/app?v=7_dKAUfFq_HQdBnGB4k7hYZKoOae-bgnT30ORlEXHEk1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 09 Nov 2020 15:49:38 GMT
ETag
"a35cc7251afd61:0"
Last-Modified
Fri, 30 Oct 2020 21:10:51 GMT
Accept-Ranges
bytes
X-DocuSign-Node
QC1FE17
Content-Length
33752
Content-Type
application/x-font-woff
olive-icons.woff
qc.ca.account.docusign.com/LoginAppNext/styles/olive/fonts/
13 KB
13 KB
Font
General
Full URL
https://qc.ca.account.docusign.com/LoginAppNext/styles/olive/fonts/olive-icons.woff
Requested by
Host: qc.ca.account.docusign.com
URL: https://qc.ca.account.docusign.com/LoginAppNext/styles/olive/and/app?v=7_dKAUfFq_HQdBnGB4k7hYZKoOae-bgnT30ORlEXHEk1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.86.219.41 Québec, Canada, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e335d0fea78a01565a4dca5f26503d15170ef4b6c9a855f5f1d5cac3ee6e9e6d

Request headers

Origin
https://qc.ca.account.docusign.com
Referer
https://qc.ca.account.docusign.com/LoginAppNext/styles/olive/and/app?v=7_dKAUfFq_HQdBnGB4k7hYZKoOae-bgnT30ORlEXHEk1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 09 Nov 2020 15:49:37 GMT
ETag
"fbb2c7251afd61:0"
Last-Modified
Fri, 30 Oct 2020 21:10:51 GMT
Accept-Ranges
bytes
X-DocuSign-Node
QC1FE16
Content-Length
13472
Content-Type
application/x-font-woff
client-perf
qc.ca.account.docusign.com/
0
1 KB
XHR
General
Full URL
https://qc.ca.account.docusign.com/client-perf
Requested by
Host: qc.ca.account.docusign.com
URL: https://qc.ca.account.docusign.com/LoginAppNext/core_via_npm?v=HmqVrseATw9A8eLx4-PxjAKYi3QSWgFzyC0R2L_sc9Q1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.86.219.41 Québec, Canada, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' 'self';style-src 'unsafe-inline' 'self';img-src data: https://docucdn-a.akamaihd.net 'self' https://*.docusign.com https://*.docusign.net https://www.docusign.com.au https://www.docusign.co.uk https://www.docusign.ca;font-src 'self' https://* data:;connect-src 'self' data:;object-src 'none';media-src 'none';frame-src https://docusign.sjv.io https://*.docusign.com; report-uri /client-errors/csp/enforce
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block; report=/client-errors/xss

Request headers

Accept
application/json, text/plain, */*
Referer
https://qc.ca.account.docusign.com/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Content-Security-Policy
script-src 'unsafe-inline' 'unsafe-eval' 'self';style-src 'unsafe-inline' 'self';img-src data: https://docucdn-a.akamaihd.net 'self' https://*.docusign.com https://*.docusign.net https://www.docusign.com.au https://www.docusign.co.uk https://www.docusign.ca;font-src 'self' https://* data:;connect-src 'self' data:;object-src 'none';media-src 'none';frame-src https://docusign.sjv.io https://*.docusign.com; report-uri /client-errors/csp/enforce
X-Content-Type-Options
nosniff
X-DocuSign-TraceToken
8c58c7c4-75f5-4c21-8172-0c2e9119fe1d
X-DocuSign-Node
QC1FE18
X-Frame-Options
SAMEORIGIN
Cache-Control
no-cache, no-store, must-revalidate
Date
Mon, 09 Nov 2020 15:49:38 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Security-Policy-Report-Only
script-src 'unsafe-inline' 'unsafe-eval' 'self';style-src 'unsafe-inline' 'self';img-src data: https://docucdn-a.akamaihd.net 'self' https://*.docusign.com https://*.docusign.net https://www.docusign.com.au https://www.docusign.co.uk https://www.docusign.ca;font-src 'self' https://* data:;connect-src 'self' data:;object-src 'none';media-src 'none';frame-src https://docusign.sjv.io https://*.docusign.com; report-uri /client-errors/csp/report
Content-Length
0
X-XSS-Protection
1; mode=block; report=/client-errors/xss
Expires
-1

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| htmlAttributeDecode object| fixtureInput object| fixture object| xsrfInputs object| xsrfFormTokenElement object| angular object| i18nlink object| localePolicy object| dsi18nlayer function| GDPRUtils object| LoginAppNext number| ng339

1 Cookies

Domain/Path Name / Value
qc.ca.account.docusign.com/ Name: __RequestVerificationToken
Value: AadBnAV9KupNSomqpO2n7QUB0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' 'self';style-src 'unsafe-inline' 'self';img-src data: https://docucdn-a.akamaihd.net 'self' https://*.docusign.com https://*.docusign.net https://www.docusign.com.au https://www.docusign.co.uk https://www.docusign.ca;font-src 'self' https://* data:;connect-src 'self' data:;object-src 'none';media-src 'none';frame-src https://docusign.sjv.io https://*.docusign.com; report-uri /client-errors/csp/enforce
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block; report=/client-errors/xss