URL: https://it.worldbox.one/
Submission: On July 27 via api from US — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 14 HTTP transactions. The main IP is 154.17.231.181, located in San Jose, United States and belongs to DMIT, US. The main domain is it.worldbox.one.
TLS certificate: Issued by Buypass Class 2 CA 5 on July 26th 2024. Valid for: 6 months.
This is the only time it.worldbox.one was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
5 154.17.231.181 906 (DMIT)
14 2
Apex Domain
Subdomains
Transfer
5 worldbox.one
it.worldbox.one
3 MB
0 apple.com Failed
www.apple.com Failed
14 2
Domain Requested by
5 it.worldbox.one it.worldbox.one
0 www.apple.com Failed it.worldbox.one
14 2

This site contains no links.

Subject Issuer Validity Valid
it.worldbox.one
Buypass Class 2 CA 5
2024-07-26 -
2025-01-21
6 months crt.sh

This page contains 1 frames:

Primary Page: https://it.worldbox.one/
Frame ID: 0C1D3956D8460A569168F268018C5365
Requests: 15 HTTP requests in this frame

Screenshot

Page Title

iCloud

Page Statistics

14
Requests

36 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

3082 kB
Transfer

3088 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
it.worldbox.one/
29 KB
31 KB
Document
General
Full URL
https://it.worldbox.one/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
154.17.231.181 San Jose, United States, ASN906 (DMIT, US),
Reverse DNS
Host-By.DMIT.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
ac936bbfa6cebc4d8e0b8f69eb61692db6d87d5b0abc05cff4a84e491a72e3f5
Security Headers
Name Value
Content-Security-Policy img-src 'self' blob: data: icloud.com *.icloud.com *.apple.com *.cdn-apple.com *.icloud-content.com *.icloud-content.com.cn *.apple-mapkit.com *.mzstatic.com; media-src 'self' blob: data: *.icloud.com *.apple.com *.cdn-apple.com *.icloud-content.com *.icloud-content.com.cn; font-src 'self' blob: data: icloud.com *.icloud.com *.apple.com *.cdn-apple.com; connect-src blob: 'self' icloud.com *.icloud.com *.apple.com *.cdn-apple.com *.icloud-content.com *.icloud-content.com.cn *.apple-mapkit.com; frame-src 'self' blob: mailto: tel: *.icloud.com *.apple.com *.icloud-sandbox.com *.icloud-content.com *.icloud-content.com.cn; frame-ancestors 'self' *.icloud.com *.apple.com; form-action 'self' *.icloud.com *.apple.com; child-src blob: 'self'; base-uri 'self' *.icloud.com *.cdn-apple.com; report-uri https://feedbackws.icloud.com/reportRaw
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Access-Control-Expose-Headers
X-Apple-Request-UUID,Via
Cache-Control
public, max-age=300
Connection
keep-alive
Content-Language
en-us
Content-Location
/system/icloud.com/index.html.en-us.gz
Content-Security-Policy
img-src 'self' blob: data: icloud.com *.icloud.com *.apple.com *.cdn-apple.com *.icloud-content.com *.icloud-content.com.cn *.apple-mapkit.com *.mzstatic.com; media-src 'self' blob: data: *.icloud.com *.apple.com *.cdn-apple.com *.icloud-content.com *.icloud-content.com.cn; font-src 'self' blob: data: icloud.com *.icloud.com *.apple.com *.cdn-apple.com; connect-src blob: 'self' icloud.com *.icloud.com *.apple.com *.cdn-apple.com *.icloud-content.com *.icloud-content.com.cn *.apple-mapkit.com; frame-src 'self' blob: mailto: tel: *.icloud.com *.apple.com *.icloud-sandbox.com *.icloud-content.com *.icloud-content.com.cn; frame-ancestors 'self' *.icloud.com *.apple.com; form-action 'self' *.icloud.com *.apple.com; child-src blob: 'self'; base-uri 'self' *.icloud.com *.cdn-apple.com; report-uri https://feedbackws.icloud.com/reportRaw
Content-Type
text/html
Content-Version
V1
Date
Sat, 27 Jul 2024 03:27:39 GMT
Expect-CT
max-age=30, report-uri="https://feedbackws.icloud.com/reportRaw"
Link
<https://www.icloud.com/>; rel="canonical"
Server
nginx/1.18.0 (Ubuntu)
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Transfer-Encoding
chunked
X-Apple-Request-UUID
2ca4e4d8-6f10-41b2-81f6-e3f5db0c903f
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
main.js
it.worldbox.one/system/icloud.com/2420Hotfix12/en-us/
2 MB
3 MB
Script
General
Full URL
https://it.worldbox.one/system/icloud.com/2420Hotfix12/en-us/main.js
Requested by
Host: it.worldbox.one
URL: https://it.worldbox.one/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
154.17.231.181 San Jose, United States, ASN906 (DMIT, US),
Reverse DNS
Host-By.DMIT.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
405d90a4fa6f60de2f6d46ed0ce21527622d977e861ef2428a2d1ff4e6250c3a
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; default-src 'none'; form-action 'none'; frame-ancestors 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://it.worldbox.one/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sat, 27 Jul 2024 03:27:40 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Security-Policy
base-uri 'none'; default-src 'none'; form-action 'none'; frame-ancestors 'none'
Transfer-Encoding
chunked
Content-Version
V1
Connection
keep-alive
Server
nginx/1.18.0 (Ubuntu)
ETag
"190c27b9770ab9d7"
Content-Language
en-us
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-Apple-Request-UUID,Via
Cache-Control
public, max-age=86400
X-Apple-Request-UUID
52182099-1c29-4087-8959-5a8061842925
Content-Location
/system/icloud.com/2420Hotfix12/en-us/main.js.gz
X-Robots-Tag
none, noarchive
/
www.apple.com/wss/fonts/
0
0

sf-pro-display_regular.woff2
www.apple.com/wss/fonts/SF-Pro-Display/v3/
0
0

sf-pro-text_regular.woff2
www.apple.com/wss/fonts/SF-Pro-Text/v3/
0
0

sf-pro-display_semibold.woff2
www.apple.com/wss/fonts/SF-Pro-Display/v3/
0
0

sf-pro-text_semibold.woff2
www.apple.com/wss/fonts/SF-Pro-Text/v3/
0
0

main.css
it.worldbox.one/system/icloud.com/2420Hotfix12/en-us/
452 KB
453 KB
Stylesheet
General
Full URL
https://it.worldbox.one/system/icloud.com/2420Hotfix12/en-us/main.css
Requested by
Host: it.worldbox.one
URL: https://it.worldbox.one/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
154.17.231.181 San Jose, United States, ASN906 (DMIT, US),
Reverse DNS
Host-By.DMIT.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
6467eb502939dd287ed6231575e5872d3340a900ffddcb5a4519235cbb9495ab
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; default-src 'none'; form-action 'none'; frame-ancestors 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://it.worldbox.one/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sat, 27 Jul 2024 03:27:40 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Security-Policy
base-uri 'none'; default-src 'none'; form-action 'none'; frame-ancestors 'none'
Server
nginx/1.18.0 (Ubuntu)
ETag
"190c27b60c0b36e"
Transfer-Encoding
chunked
Content-Language
en-us
Content-Type
text/css
Access-Control-Expose-Headers
X-Apple-Request-UUID,Via
Cache-Control
public, max-age=86400
X-Apple-Request-UUID
5503a606-e00f-42e1-887f-d2ea3a7abb62
Content-Version
V1
Connection
keep-alive
Content-Location
/system/icloud.com/2420Hotfix12/en-us/main.css.gz
X-Robots-Tag
none, noarchive
images@1x.bin
it.worldbox.one/system/icloud.com/2420Hotfix12/en-us/
13 KB
13 KB
XHR
General
Full URL
https://it.worldbox.one/system/icloud.com/2420Hotfix12/en-us/images@1x.bin
Requested by
Host: it.worldbox.one
URL: https://it.worldbox.one/system/icloud.com/2420Hotfix12/en-us/main.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
154.17.231.181 San Jose, United States, ASN906 (DMIT, US),
Reverse DNS
Host-By.DMIT.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
b850423e8f72c4b66773e25edf27d1d769c6b4a892b1c3193330f48f65583207
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; default-src 'none'; form-action 'none'; frame-ancestors 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://it.worldbox.one/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sat, 27 Jul 2024 03:27:41 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Security-Policy
base-uri 'none'; default-src 'none'; form-action 'none'; frame-ancestors 'none'
Server
nginx/1.18.0 (Ubuntu)
ETag
"190c27b58f030f5"
Content-Language
en-us
Content-Type
application/octet-stream
Access-Control-Expose-Headers
X-Apple-Request-UUID,Via
Cache-Control
public, max-age=86400
X-Apple-Request-UUID
67412359-29d2-4648-bf04-86b81b455a8f
Content-Version
V1
Connection
keep-alive
Content-Location
/system/icloud.com/2420Hotfix12/en-us/images@1x.bin.gz
X-Robots-Tag
none, noarchive
Content-Length
13051
favicon.ico
it.worldbox.one/
22 KB
22 KB
Other
General
Full URL
https://it.worldbox.one/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
154.17.231.181 San Jose, United States, ASN906 (DMIT, US),
Reverse DNS
Host-By.DMIT.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
2ee7ca9b189df54d7ccdd064d75d0143a8229bae9bdb69f37105e59f433c0a8b
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; default-src 'none'; form-action 'none'; frame-ancestors 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://it.worldbox.one/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sat, 27 Jul 2024 03:27:41 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Security-Policy
base-uri 'none'; default-src 'none'; form-action 'none'; frame-ancestors 'none'
Server
nginx/1.18.0 (Ubuntu)
ETag
"190a68b2be85e2"
Content-Language
en-us
Content-Type
image/x-icon
Access-Control-Expose-Headers
X-Apple-Request-UUID,Via
Cache-Control
public, max-age=300
X-Apple-Request-UUID
ebbeea7b-658e-4821-8325-2a4927532ce4
Content-Version
V1
Connection
keep-alive
Content-Location
/favicon.ico.gz
X-Robots-Tag
none, noarchive
Content-Length
22382
430656d6-2968-415b-9d39-913b71466bcb
https://it.worldbox.one/
884 B
0
Image
General
Full URL
blob:https://it.worldbox.one/430656d6-2968-415b-9d39-913b71466bcb
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c7037d9b702f2a33c79588eb11c56b0333d283802a5786372c18d58184854017

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Length
884
Content-Type
image/svg+xml
b2b7882e-9694-4df5-9e7b-685d5aaf5fa3
https://it.worldbox.one/
4 KB
0
Image
General
Full URL
blob:https://it.worldbox.one/b2b7882e-9694-4df5-9e7b-685d5aaf5fa3
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
27a062e1f7c1f84bd52495db51e4de6e8fc9d95396b9ea40a454f158992f61bb

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Length
3775
Content-Type
image/png
d6603272-8d3e-4e18-9a62-18f6edcad89d
https://it.worldbox.one/
8 KB
0
Image
General
Full URL
blob:https://it.worldbox.one/d6603272-8d3e-4e18-9a62-18f6edcad89d
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b83a9e79962d613be760201c8790f785fece8a4c65b829a1e6cdf18b54dfc258

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Length
7703
Content-Type
image/png
e3723e86-667d-4f3d-81e6-0eb3a45c4a4f
https://it.worldbox.one/
661 B
0
Image
General
Full URL
blob:https://it.worldbox.one/e3723e86-667d-4f3d-81e6-0eb3a45c4a4f
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
446c4fde5ecf439bfed24e9704de915bdc7b0d06b4e8a6c5c7eb6493e06f4a37

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Length
661
Content-Type
image/svg+xml
truncated
/
581 B
0
Stylesheet
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b8460cc602293106c22d32d7e5054e8f97bdfea0b649e29900772cffe614d834

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
text/css

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.apple.com
URL
https://www.apple.com/wss/fonts/?families=SF+Pro,v3
Domain
www.apple.com
URL
https://www.apple.com/wss/fonts/SF-Pro-Display/v3/sf-pro-display_regular.woff2
Domain
www.apple.com
URL
https://www.apple.com/wss/fonts/SF-Pro-Text/v3/sf-pro-text_regular.woff2
Domain
www.apple.com
URL
https://www.apple.com/wss/fonts/SF-Pro-Display/v3/sf-pro-display_semibold.woff2
Domain
www.apple.com
URL
https://www.apple.com/wss/fonts/SF-Pro-Text/v3/sf-pro-text_semibold.woff2

Verdicts & Comments Add Verdict or Comment

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| event object| _BUILD_INFO_FOR_GLOBAL_ERROR_HANDLERS object| _CW_BUILD_INFO string| filterIndexHtml string| filterMainJs object| regexIndexHtml object| regexMainJs function| logMessageToParent function| buildMessageFromErrorEvent function| defaultErrorFilter function| defaultFatalErrorHandler function| defaultNonFatalErrorHandler function| buildMessageFromRejectionEvent function| defaultUnhandledRejectionFilter function| defaultFatalUnhandledRejectionHandler function| defaultNonFatalUnhandledRejectionHandler object| __globalErrorCatcherDefaults object| globalDefaults function| __startFilteringErrors function| __startFilteringUnhandledRejections object| __CW_BUILD_INFO function| __CW_loadBinaries object| __CW_IMG_URLS object| __CW_BLOB_URLS boolean| __CW_BLOBS_READY object| __LOADABLE_LOADED_CHUNKS__ function| clearImmediate function| setImmediate function| applyFocusVisiblePolyfill

0 Cookies

13 Console Messages

Source Level URL
Text
javascript error URL: https://it.worldbox.one/(Line 142)
Message:
Access to font at 'https://www.apple.com/wss/fonts/SF-Pro-Text/v3/sf-pro-text_semibold.woff2' from origin 'https://it.worldbox.one' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.apple.com/wss/fonts/SF-Pro-Text/v3/sf-pro-text_semibold.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://it.worldbox.one/(Line 142)
Message:
Access to font at 'https://www.apple.com/wss/fonts/SF-Pro-Display/v3/sf-pro-display_regular.woff2' from origin 'https://it.worldbox.one' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.apple.com/wss/fonts/SF-Pro-Display/v3/sf-pro-display_regular.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://it.worldbox.one/(Line 142)
Message:
Access to font at 'https://www.apple.com/wss/fonts/SF-Pro-Display/v3/sf-pro-display_semibold.woff2' from origin 'https://it.worldbox.one' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.apple.com/wss/fonts/SF-Pro-Display/v3/sf-pro-display_semibold.woff2
Message:
Failed to load resource: net::ERR_FAILED
security error URL: https://it.worldbox.one/(Line 159)
Message:
Refused to execute inline script because it violates the following Content Security Policy directive: "script-src blob: 'self' *.apple.com *.apple-cloudkit.com *.cdn-apple.com 'sha256-JFJvxqMr7d0c5kvkhpyFwvNHHhwfiIFw0UaFnTp+u9M=' 'sha256-vo2FjI3ZJuiNBTAc4F/9v3i+RWMpJLGasXzScBa5CUo=' 'sha256-26W8JbT1vQArZ+8F3eitbNZVzh5WonwHlQl29E4pato=' 'sha256-svdOQzSg9T05h6Q3mC/8FCU+2bG3vWTBwdPa+czq+YY=' 'sha256-HenvlWVrAISuwfRzCus0xoCe+m4/jV6vXViy4FodZC8=' 'sha256-lRaqSyfzcyRaZDbyf9zk3ZsU3HWpfeHMdgqioLyb3K4=' 'sha256-/91TqXBvbat3YqYPLReHkv4cdoLvEmys25vTYibv/XA='". Either the 'unsafe-inline' keyword, a hash ('sha256-o6aNMzzbyKP/mwV7GNN8ur4mX6VCf81OhJZEOXOZsak='), or a nonce ('nonce-...') is required to enable inline execution.
javascript error URL: https://it.worldbox.one/(Line 166)
Message:
Access to font at 'https://www.apple.com/wss/fonts/SF-Pro-Text/v3/sf-pro-text_regular.woff2' from origin 'https://it.worldbox.one' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.apple.com/wss/fonts/SF-Pro-Text/v3/sf-pro-text_regular.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript warning URL: https://it.worldbox.one/
Message:
The resource https://www.apple.com/wss/fonts/SF-Pro-Display/v3/sf-pro-display_regular.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://it.worldbox.one/
Message:
The resource https://www.apple.com/wss/fonts/SF-Pro-Text/v3/sf-pro-text_regular.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://it.worldbox.one/
Message:
The resource https://www.apple.com/wss/fonts/SF-Pro-Text/v3/sf-pro-text_semibold.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://it.worldbox.one/
Message:
The resource https://www.apple.com/wss/fonts/SF-Pro-Display/v3/sf-pro-display_semibold.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy img-src 'self' blob: data: icloud.com *.icloud.com *.apple.com *.cdn-apple.com *.icloud-content.com *.icloud-content.com.cn *.apple-mapkit.com *.mzstatic.com; media-src 'self' blob: data: *.icloud.com *.apple.com *.cdn-apple.com *.icloud-content.com *.icloud-content.com.cn; font-src 'self' blob: data: icloud.com *.icloud.com *.apple.com *.cdn-apple.com; connect-src blob: 'self' icloud.com *.icloud.com *.apple.com *.cdn-apple.com *.icloud-content.com *.icloud-content.com.cn *.apple-mapkit.com; frame-src 'self' blob: mailto: tel: *.icloud.com *.apple.com *.icloud-sandbox.com *.icloud-content.com *.icloud-content.com.cn; frame-ancestors 'self' *.icloud.com *.apple.com; form-action 'self' *.icloud.com *.apple.com; child-src blob: 'self'; base-uri 'self' *.icloud.com *.cdn-apple.com; report-uri https://feedbackws.icloud.com/reportRaw
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block