URL: https://payments-toolkit.qa.trevipay.app/
Submission: On October 07 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 35.172.143.216, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is payments-toolkit.qa.trevipay.app.
TLS certificate: Issued by R3 on October 7th 2023. Valid for: 3 months.
This is the only time payments-toolkit.qa.trevipay.app was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
9 35.172.143.216 14618 (AMAZON-AES)
3 52.201.13.17 14618 (AMAZON-AES)
12 2
Domain Requested by
9 payments-toolkit.qa.trevipay.app payments-toolkit.qa.trevipay.app
3 credit-cards.payments-toolkit.qa.trevipay.app payments-toolkit.qa.trevipay.app
credit-cards.payments-toolkit.qa.trevipay.app
12 2

This site contains no links.

Subject Issuer Validity Valid
payments-toolkit.qa.trevipay.app
R3
2023-10-07 -
2024-01-05
3 months crt.sh
credit-cards.payments-toolkit.qa.trevipay.app
R3
2023-08-15 -
2023-11-13
3 months crt.sh

This page contains 1 frames:

Primary Page: https://payments-toolkit.qa.trevipay.app/
Frame ID: 910C2670392BE6094A2003C66D8484E4
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

Payments Toolkit Core

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

400 kB
Transfer

395 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
payments-toolkit.qa.trevipay.app/
796 B
1 KB
Document
General
Full URL
https://payments-toolkit.qa.trevipay.app/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.172.143.216 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-172-143-216.compute-1.amazonaws.com
Software
/ Express
Resource Hash
a67be08350d9aba56d8a4ede7bfaa30e149a1bb90bd4ec01f9fddbe91d94b815
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-ancestors undefined; script-src 'self' 'unsafe-eval' https://api.amplitude.com/ https://credit-cards.payments-toolkit.qa.trevipay.app https://app.payments-toolkit.qa.trevipay.app; connect-src 'self' https://api.amplitude.com/ https://integration.bluesnap.qa.trevipay.app; style-src 'self' 'unsafe-inline';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options default-src https:

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
content-length
796
content-security-policy
default-src 'self'; frame-ancestors undefined; script-src 'self' 'unsafe-eval' https://api.amplitude.com/ https://credit-cards.payments-toolkit.qa.trevipay.app https://app.payments-toolkit.qa.trevipay.app; connect-src 'self' https://api.amplitude.com/ https://integration.bluesnap.qa.trevipay.app; style-src 'self' 'unsafe-inline';
content-type
text/html; charset=utf-8
date
Sat, 07 Oct 2023 17:16:33 GMT
etag
W/"31c-nJRw6cHWt3o+/OYwBzwOi+ZbnoQ"
permissions-policy
camera=(), microphone=(), geolocation=(), payment=(), publickey-credentials-get=(), web-share=()
referrer-policy
origin
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-frame-options
default-src https:
x-powered-by
Express
main.a31beb81.js
payments-toolkit.qa.trevipay.app/js/
9 KB
9 KB
Script
General
Full URL
https://payments-toolkit.qa.trevipay.app/js/main.a31beb81.js
Requested by
Host: payments-toolkit.qa.trevipay.app
URL: https://payments-toolkit.qa.trevipay.app/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.172.143.216 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-172-143-216.compute-1.amazonaws.com
Software
/ Express
Resource Hash
0b7a1b31de5ba4528f3d706f8df0c8b79f2607ffc762e39c8203e24fba935592
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://payments-toolkit.qa.trevipay.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Sat, 07 Oct 2023 17:16:33 GMT
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Mon, 02 Oct 2023 14:45:12 GMT
x-powered-by
Express
etag
W/"222a-18af0d9acc0"
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0
accept-ranges
bytes
content-length
8746
340.683b20c6.css
payments-toolkit.qa.trevipay.app/css/
195 KB
196 KB
Stylesheet
General
Full URL
https://payments-toolkit.qa.trevipay.app/css/340.683b20c6.css
Requested by
Host: payments-toolkit.qa.trevipay.app
URL: https://payments-toolkit.qa.trevipay.app/js/main.a31beb81.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.172.143.216 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-172-143-216.compute-1.amazonaws.com
Software
/ Express
Resource Hash
643d43b01da49b052672041421e42d7574e72c7ee73a70d3e92714110e688b8b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://payments-toolkit.qa.trevipay.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Sat, 07 Oct 2023 17:16:33 GMT
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Mon, 02 Oct 2023 14:45:12 GMT
x-powered-by
Express
etag
W/"30cc9-18af0d9acc0"
content-type
text/css; charset=UTF-8
cache-control
public, max-age=0
accept-ranges
bytes
content-length
199881
340.12fbab24.js
payments-toolkit.qa.trevipay.app/js/
41 KB
41 KB
Script
General
Full URL
https://payments-toolkit.qa.trevipay.app/js/340.12fbab24.js
Requested by
Host: payments-toolkit.qa.trevipay.app
URL: https://payments-toolkit.qa.trevipay.app/js/main.a31beb81.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.172.143.216 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-172-143-216.compute-1.amazonaws.com
Software
/ Express
Resource Hash
82d66660bf03d3c2feb349c85825ff561d7ca9f2562c020b39fec520641822d2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://payments-toolkit.qa.trevipay.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Sat, 07 Oct 2023 17:16:33 GMT
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Mon, 02 Oct 2023 14:45:12 GMT
x-powered-by
Express
etag
W/"a2bb-18af0d9acc0"
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0
accept-ranges
bytes
content-length
41659
remoteEntry.js
credit-cards.payments-toolkit.qa.trevipay.app/static/
6 KB
6 KB
Script
General
Full URL
https://credit-cards.payments-toolkit.qa.trevipay.app/static/remoteEntry.js
Requested by
Host: payments-toolkit.qa.trevipay.app
URL: https://payments-toolkit.qa.trevipay.app/js/main.a31beb81.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
52.201.13.17 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-201-13-17.compute-1.amazonaws.com
Software
/ Express
Resource Hash
228427df26e96df1c7de8c0d75350a20639c5c735c9f54674ecb8cb594d75022
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-ancestors undefined; script-src 'self' 'unsafe-eval' https://api.amplitude.com/; connect-src 'self' https://api.amplitude.com/; style-src 'self' 'unsafe-inline';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options default-src https:

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://payments-toolkit.qa.trevipay.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Sat, 07 Oct 2023 17:16:34 GMT
content-security-policy
default-src 'self'; frame-ancestors undefined; script-src 'self' 'unsafe-eval' https://api.amplitude.com/; connect-src 'self' https://api.amplitude.com/; style-src 'self' 'unsafe-inline';
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Thu, 28 Sep 2023 14:59:46 GMT
referrer-policy
origin
x-powered-by
Express
etag
W/"174f-18adc4d92d0"
x-frame-options
default-src https:
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0
permissions-policy
camera=(), microphone=(), geolocation=(), payment=(), publickey-credentials-get=(), web-share=()
accept-ranges
bytes
content-length
5967
794.31d6cfe0.css
payments-toolkit.qa.trevipay.app/css/
0
214 B
Stylesheet
General
Full URL
https://payments-toolkit.qa.trevipay.app/css/794.31d6cfe0.css
Requested by
Host: payments-toolkit.qa.trevipay.app
URL: https://payments-toolkit.qa.trevipay.app/js/main.a31beb81.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.172.143.216 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-172-143-216.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://payments-toolkit.qa.trevipay.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Sat, 07 Oct 2023 17:16:33 GMT
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Mon, 02 Oct 2023 14:45:12 GMT
x-powered-by
Express
etag
W/"0-18af0d9acc0"
content-type
text/css; charset=UTF-8
cache-control
public, max-age=0
accept-ranges
bytes
content-length
0
794.f95553c6.js
payments-toolkit.qa.trevipay.app/js/
1 KB
2 KB
Script
General
Full URL
https://payments-toolkit.qa.trevipay.app/js/794.f95553c6.js
Requested by
Host: payments-toolkit.qa.trevipay.app
URL: https://payments-toolkit.qa.trevipay.app/js/main.a31beb81.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.172.143.216 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-172-143-216.compute-1.amazonaws.com
Software
/ Express
Resource Hash
a89bface60598ce239c5c970c11cbb1a5f2e15769c32bad66520b7dc0657bb13
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://payments-toolkit.qa.trevipay.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Sat, 07 Oct 2023 17:16:33 GMT
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Mon, 02 Oct 2023 14:45:12 GMT
x-powered-by
Express
etag
W/"52b-18af0d9acc0"
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0
accept-ranges
bytes
content-length
1323
334.d3ad060e.js
credit-cards.payments-toolkit.qa.trevipay.app/static/js/
87 KB
87 KB
Script
General
Full URL
https://credit-cards.payments-toolkit.qa.trevipay.app/static/js/334.d3ad060e.js
Requested by
Host: credit-cards.payments-toolkit.qa.trevipay.app
URL: https://credit-cards.payments-toolkit.qa.trevipay.app/static/remoteEntry.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
52.201.13.17 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-201-13-17.compute-1.amazonaws.com
Software
/ Express
Resource Hash
167f7ed0f56bec0f6eca83ffa2dbc7dcadcf6212ef37c0fc7fad32ae331321ac
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-ancestors undefined; script-src 'self' 'unsafe-eval' https://api.amplitude.com/; connect-src 'self' https://api.amplitude.com/; style-src 'self' 'unsafe-inline';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options default-src https:

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://payments-toolkit.qa.trevipay.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Sat, 07 Oct 2023 17:16:34 GMT
content-security-policy
default-src 'self'; frame-ancestors undefined; script-src 'self' 'unsafe-eval' https://api.amplitude.com/; connect-src 'self' https://api.amplitude.com/; style-src 'self' 'unsafe-inline';
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Thu, 28 Sep 2023 14:59:46 GMT
referrer-policy
origin
x-powered-by
Express
etag
W/"15a86-18adc4d92d0"
x-frame-options
default-src https:
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0
permissions-policy
camera=(), microphone=(), geolocation=(), payment=(), publickey-credentials-get=(), web-share=()
accept-ranges
bytes
content-length
88710
339.a44fb39a.js
credit-cards.payments-toolkit.qa.trevipay.app/static/js/
25 KB
26 KB
Script
General
Full URL
https://credit-cards.payments-toolkit.qa.trevipay.app/static/js/339.a44fb39a.js
Requested by
Host: credit-cards.payments-toolkit.qa.trevipay.app
URL: https://credit-cards.payments-toolkit.qa.trevipay.app/static/remoteEntry.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
52.201.13.17 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-201-13-17.compute-1.amazonaws.com
Software
/ Express
Resource Hash
8e226ef6e7520d7c0692f399745e5938d868f8d02ba8a49770f0c708f000908e
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-ancestors undefined; script-src 'self' 'unsafe-eval' https://api.amplitude.com/; connect-src 'self' https://api.amplitude.com/; style-src 'self' 'unsafe-inline';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options default-src https:

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://payments-toolkit.qa.trevipay.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Sat, 07 Oct 2023 17:16:34 GMT
content-security-policy
default-src 'self'; frame-ancestors undefined; script-src 'self' 'unsafe-eval' https://api.amplitude.com/; connect-src 'self' https://api.amplitude.com/; style-src 'self' 'unsafe-inline';
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Thu, 28 Sep 2023 14:59:46 GMT
referrer-policy
origin
x-powered-by
Express
etag
W/"63ef-18adc4d92d0"
x-frame-options
default-src https:
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0
permissions-policy
camera=(), microphone=(), geolocation=(), payment=(), publickey-credentials-get=(), web-share=()
accept-ranges
bytes
content-length
25583
357.3766ed01.js
payments-toolkit.qa.trevipay.app/js/
11 KB
11 KB
Script
General
Full URL
https://payments-toolkit.qa.trevipay.app/js/357.3766ed01.js
Requested by
Host: payments-toolkit.qa.trevipay.app
URL: https://payments-toolkit.qa.trevipay.app/js/main.a31beb81.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.172.143.216 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-172-143-216.compute-1.amazonaws.com
Software
/ Express
Resource Hash
b8defc130a2cd4093688ba32a09327d2c81f44ca504f6166f2db9fcc80e9f663
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://payments-toolkit.qa.trevipay.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Sat, 07 Oct 2023 17:16:34 GMT
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Mon, 02 Oct 2023 14:45:12 GMT
x-powered-by
Express
etag
W/"2c2e-18af0d9acc0"
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0
accept-ranges
bytes
content-length
11310
29.34731625.js
payments-toolkit.qa.trevipay.app/js/
572 B
818 B
Script
General
Full URL
https://payments-toolkit.qa.trevipay.app/js/29.34731625.js
Requested by
Host: payments-toolkit.qa.trevipay.app
URL: https://payments-toolkit.qa.trevipay.app/js/main.a31beb81.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.172.143.216 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-172-143-216.compute-1.amazonaws.com
Software
/ Express
Resource Hash
4dd75ba73c838207c5601ae52611c8b356bd80a96639d94829a1e3d669e352c6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://payments-toolkit.qa.trevipay.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Sat, 07 Oct 2023 17:16:34 GMT
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Mon, 02 Oct 2023 14:45:12 GMT
x-powered-by
Express
etag
W/"23c-18af0d9acc0"
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0
accept-ranges
bytes
content-length
572
KFOmCnqEu92Fr1Mu4mxM.f1e2a767.woff
payments-toolkit.qa.trevipay.app/fonts/
20 KB
20 KB
Font
General
Full URL
https://payments-toolkit.qa.trevipay.app/fonts/KFOmCnqEu92Fr1Mu4mxM.f1e2a767.woff
Requested by
Host: payments-toolkit.qa.trevipay.app
URL: https://payments-toolkit.qa.trevipay.app/css/340.683b20c6.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.172.143.216 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-172-143-216.compute-1.amazonaws.com
Software
/ Express
Resource Hash
f2abf7fbabe298e5823d257e48f5dc2138c6d5e0c210066f76b0067e8eda194f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://payments-toolkit.qa.trevipay.app/css/340.683b20c6.css
Origin
https://payments-toolkit.qa.trevipay.app
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Sat, 07 Oct 2023 17:16:34 GMT
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Mon, 02 Oct 2023 14:45:12 GMT
x-powered-by
Express
etag
W/"4f78-18af0d9acc0"
content-type
font/woff
cache-control
public, max-age=0
accept-ranges
bytes
content-length
20344

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| webpackChunkpayments_toolkit_core object| credit_cards object| webpackChunkpayments_toolkit_credit_cards_module object| __VUE_INSTANCE_SETTERS__ boolean| __VUE__

0 Cookies

1 Console Messages

Source Level URL
Text
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'web-share'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; frame-ancestors undefined; script-src 'self' 'unsafe-eval' https://api.amplitude.com/ https://credit-cards.payments-toolkit.qa.trevipay.app https://app.payments-toolkit.qa.trevipay.app; connect-src 'self' https://api.amplitude.com/ https://integration.bluesnap.qa.trevipay.app; style-src 'self' 'unsafe-inline';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options default-src https: