Submitted URL: https://go99.lv/
Effective URL: https://app.go99ok.xyz/
Submission: On November 23 via manual from BD — Scanned from DE

Summary

This website contacted 5 IPs in 4 countries across 5 domains to perform 14 HTTP transactions. The main IP is 154.82.110.60, located in Singapore, Singapore and belongs to TERAEXCH, US. The main domain is app.go99ok.xyz.
TLS certificate: Issued by R10 on November 13th 2024. Valid for: 3 months.
This is the only time app.go99ok.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 172.67.133.164 13335 (CLOUDFLAR...)
6 154.82.110.60 399077 (TERAEXCH)
1 2a00:1450:400... 15169 (GOOGLE)
2 14.215.182.140 4134 (CHINANET-...)
2 2001:4860:480... 15169 (GOOGLE)
14 5
Apex Domain
Subdomains
Transfer
6 go99ok.xyz
app.go99ok.xyz
269 KB
2 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 3353
2 baidu.com
hm.baidu.com — Cisco Umbrella Rank: 12020
12 KB
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39
108 KB
1 go99.lv
go99.lv
710 B
14 5
Domain Requested by
6 app.go99ok.xyz app.go99ok.xyz
2 region1.google-analytics.com www.googletagmanager.com
2 hm.baidu.com app.go99ok.xyz
1 www.googletagmanager.com app.go99ok.xyz
1 go99.lv 1 redirects
14 5

This site contains no links.

Subject Issuer Validity Valid
app.go99ok.xyz
R10
2024-11-13 -
2025-02-11
3 months crt.sh
*.google-analytics.com
WR2
2024-10-21 -
2025-01-13
3 months crt.sh
baidu.com
GlobalSign RSA OV SSL CA 2018
2024-07-08 -
2025-08-09
a year crt.sh

This page contains 1 frames:

Primary Page: https://app.go99ok.xyz/
Frame ID: 526225CD345443AD6AA3C2C8AA8BE814
Requests: 14 HTTP requests in this frame

Screenshot

Page Title

GO99 - 16Go99 Game thiên đường điện tử top 1 châu á

Page URL History Show full URLs

  1. https://go99.lv/ HTTP 301
    https://app.go99ok.xyz/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • hm\.baidu\.com/hm\.js

Overall confidence: 100%
Detected patterns

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Page Statistics

14
Requests

79 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

5
IPs

4
Countries

389 kB
Transfer

3260 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://go99.lv/ HTTP 301
    https://app.go99ok.xyz/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 9
  • https://go99.lv/img/favicon.png HTTP 301
  • https://app.go99ok.xyz/img/favicon.png
Request Chain 10
  • https://go99.lv/img/favicon.png HTTP 301
  • https://app.go99ok.xyz/img/favicon.png

14 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
app.go99ok.xyz/
Redirect Chain
  • https://go99.lv/
  • https://app.go99ok.xyz/
4 KB
2 KB
Document
General
Full URL
https://app.go99ok.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.82.110.60 Singapore, Singapore, ASN399077 (TERAEXCH, US),
Reverse DNS
Software
nginx /
Resource Hash
1f93c9d59533efa8f73abb2848dfc73ffd7b8d472d63dd2c152d4c44beebfe64
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding
gzip
content-type
text/html
date
Sat, 23 Nov 2024 10:47:05 GMT
etag
W/"673ae6c4-f22"
last-modified
Mon, 18 Nov 2024 07:03:32 GMT
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
max-age=3600
cf-ray
8e70943c0fdd3730-FRA
content-length
167
content-type
text/html
date
Sat, 23 Nov 2024 10:47:04 GMT
expires
Sat, 23 Nov 2024 11:47:04 GMT
location
https://app.go99ok.xyz/
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4qdcL2Y%2BAPz2FPdB1%2Ba9tAGEb4NBgA%2Fvgrn58OkKzukJF6t0VIgaMbQB58rYd6yHWrWBgXq2jg02UVqRufQpBTfDjUsVJ4KzNf1H82cCMEJJmVxBE6iD49S4"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=41387&sent=10&recv=7&lost=0&retrans=0&sent_bytes=4079&recv_bytes=4342&delivery_rate=73988&cwnd=12000&unsent_bytes=0&cid=d80ee73e94e1bd09&ts=59&x=1" cfExtPri cfHdrFlush;dur=0
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
index8.css
app.go99ok.xyz/css/
67 KB
12 KB
Stylesheet
General
Full URL
https://app.go99ok.xyz/css/index8.css
Requested by
Host: app.go99ok.xyz
URL: https://app.go99ok.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.82.110.60 Singapore, Singapore, ASN399077 (TERAEXCH, US),
Reverse DNS
Software
nginx /
Resource Hash
9f3ccbade02ead712da9ece14f0ef05ec2b752c321bf56549c947f49b85813a8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://app.go99ok.xyz/

Response headers

strict-transport-security
max-age=31536000
cache-control
max-age=43200
content-encoding
gzip
etag
W/"6739dfc4-10c11"
expires
Sat, 23 Nov 2024 22:47:05 GMT
date
Sat, 23 Nov 2024 10:47:05 GMT
content-type
text/css
last-modified
Sun, 17 Nov 2024 12:21:24 GMT
server
nginx
vary
Accept-Encoding
logo.png
app.go99ok.xyz/img/
15 KB
15 KB
Image
General
Full URL
https://app.go99ok.xyz/img/logo.png
Requested by
Host: app.go99ok.xyz
URL: https://app.go99ok.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.82.110.60 Singapore, Singapore, ASN399077 (TERAEXCH, US),
Reverse DNS
Software
nginx /
Resource Hash
95f9ad571a29a01422e5a682991e67f755736ec87d6444d61b8505b445f8d220
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://app.go99ok.xyz/

Response headers

strict-transport-security
max-age=31536000
cache-control
max-age=2592000
content-encoding
gzip
etag
W/"6739e235-3ad6"
expires
Mon, 23 Dec 2024 10:47:05 GMT
date
Sat, 23 Nov 2024 10:47:05 GMT
content-type
image/png
last-modified
Sun, 17 Nov 2024 12:31:49 GMT
server
nginx
vary
Accept-Encoding
js
www.googletagmanager.com/gtag/
323 KB
108 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-CJTHKD9J0L
Requested by
Host: app.go99ok.xyz
URL: https://app.go99ok.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
23623dbad77e315ffa55536604078abe6df732f98f1e50e2be0dff894bee3a08
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://app.go99ok.xyz/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Sat, 23 Nov 2024 10:47:05 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 23 Nov 2024 10:47:05 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
109829
x-xss-protection
0
server
Google Tag Manager
2024.mp4
app.go99ok.xyz/img/
3 MB
0
Media
General
Full URL
https://app.go99ok.xyz/img/2024.mp4
Requested by
Host: app.go99ok.xyz
URL: https://app.go99ok.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.82.110.60 Singapore, Singapore, ASN399077 (TERAEXCH, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://app.go99ok.xyz/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Range
bytes=0-

Response headers

strict-transport-security
max-age=31536000
etag
"6739e234-73ec93"
Content-Range
bytes 0-7597202/7597203
Content-Length
7597203
date
Sat, 23 Nov 2024 10:47:05 GMT
content-type
video/mp4
last-modified
Sun, 17 Nov 2024 12:31:48 GMT
server
nginx
icon01.png
app.go99ok.xyz/images/
148 B
148 B
Image
General
Full URL
https://app.go99ok.xyz/images/icon01.png
Requested by
Host: app.go99ok.xyz
URL: https://app.go99ok.xyz/css/index8.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.82.110.60 Singapore, Singapore, ASN399077 (TERAEXCH, US),
Reverse DNS
Software
nginx /
Resource Hash
9cad3cff676946810a81047247f12e4e51faccc01df4134edfd871aee8ba0956

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://app.go99ok.xyz/css/index8.css

Response headers

content-length
148
date
Sat, 23 Nov 2024 10:47:05 GMT
etag
"673453d0-94"
content-type
text/html
server
nginx
welcome.jpg
app.go99ok.xyz/img/
246 KB
240 KB
Image
General
Full URL
https://app.go99ok.xyz/img/welcome.jpg
Requested by
Host: app.go99ok.xyz
URL: https://app.go99ok.xyz/css/index8.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.82.110.60 Singapore, Singapore, ASN399077 (TERAEXCH, US),
Reverse DNS
Software
nginx /
Resource Hash
3feb904857fe562ce6bd7a6c991cf2549294d511ef02364897603ede7e6666fa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://app.go99ok.xyz/css/index8.css

Response headers

strict-transport-security
max-age=31536000
cache-control
max-age=2592000
content-encoding
gzip
etag
W/"6739e227-3d92f"
expires
Mon, 23 Dec 2024 10:47:05 GMT
date
Sat, 23 Nov 2024 10:47:05 GMT
content-type
image/jpeg
last-modified
Sun, 17 Nov 2024 12:31:35 GMT
server
nginx
vary
Accept-Encoding
hm.js
hm.baidu.com/
29 KB
12 KB
Script
General
Full URL
https://hm.baidu.com/hm.js?309a440e4e562b3b8d09fced93ec64f7
Requested by
Host: app.go99ok.xyz
URL: https://app.go99ok.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
14.215.182.140 Guangzhou, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
apache /
Resource Hash
8f0c69470835e23d789130b9752e1d3663872d1521c147f4920863f07e76a856
Security Headers
Name Value
Strict-Transport-Security max-age=172800

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://app.go99ok.xyz/

Response headers

Strict-Transport-Security
max-age=172800
Cache-Control
max-age=0, must-revalidate
Content-Encoding
gzip
Etag
149282dfc790b723497894eef80e23cc
Content-Length
11292
P3p
CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date
Sat, 23 Nov 2024 10:47:09 GMT
Content-Type
application/javascript
Server
apache
collect
region1.google-analytics.com/g/
0
0
Fetch
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-CJTHKD9J0L&gtm=45je4bk0v9196281676za200&_p=1732358825532&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855~102081485&cid=12080443.1732358826&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1732358825&sct=1&seg=0&dl=https%3A%2F%2Fapp.go99ok.xyz%2F&dt=GO99%20-%2016Go99%20Game%20thi%C3%AAn%20%C4%91%C6%B0%E1%BB%9Dng%20%C4%91i%E1%BB%87n%20t%E1%BB%AD%20top%201%20ch%C3%A2u%20%C3%A1&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1419
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CJTHKD9J0L
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://app.go99ok.xyz/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://app.go99ok.xyz
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 23 Nov 2024 10:47:05 GMT
content-type
text/plain
server
Golfe2
hm.gif
hm.baidu.com/
43 B
299 B
Image
General
Full URL
https://hm.baidu.com/hm.gif?hca=2380DD832CC361BF&cc=1&ck=1&cl=24-bit&ds=1600x1200&vl=1200&et=0&ja=0&ln=de-de&lo=0&rnd=698991639&si=309a440e4e562b3b8d09fced93ec64f7&v=1.3.2&lv=1&sn=6639&r=0&ww=1600&u=https%3A%2F%2Fapp.go99ok.xyz%2F&tt=GO99%20-%2016Go99%20Game%20thi%C3%AAn%20%C4%91%C6%B0%E1%BB%9Dng%20%C4%91i%E1%BB%87n%20t%E1%BB%AD%20top%201%20ch%C3%A2u%20%C3%A1
Requested by
Host: app.go99ok.xyz
URL: https://app.go99ok.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
14.215.182.140 Guangzhou, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=172800
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://app.go99ok.xyz/

Response headers

Strict-Transport-Security
max-age=172800
Cache-Control
private, max-age=0, no-cache
Pragma
no-cache
X-Content-Type-Options
nosniff
Content-Length
43
Date
Sat, 23 Nov 2024 10:47:09 GMT
Content-Type
image/gif
Server
apache
favicon.png
app.go99ok.xyz/img/
Redirect Chain
  • https://go99.lv/img/favicon.png
  • https://app.go99ok.xyz/img/favicon.png
0
0

favicon.png
app.go99ok.xyz/img/
Redirect Chain
  • https://go99.lv/img/favicon.png
  • https://app.go99ok.xyz/img/favicon.png
0
0

collect
region1.google-analytics.com/g/
0
0
Fetch
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-CJTHKD9J0L&gtm=45je4bk0v9196281676za200&_p=1732358825532&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855~102081485&cid=12080443.1732358826&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEA&_s=2&sid=1732358825&sct=1&seg=0&dl=https%3A%2F%2Fapp.go99ok.xyz%2F&dt=GO99%20-%2016Go99%20Game%20thi%C3%AAn%20%C4%91%C6%B0%E1%BB%9Dng%20%C4%91i%E1%BB%87n%20t%E1%BB%AD%20top%201%20ch%C3%A2u%20%C3%A1&en=scroll&epn.percent_scrolled=90&_et=3&tfd=6425
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CJTHKD9J0L
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://app.go99ok.xyz/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://app.go99ok.xyz
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 23 Nov 2024 10:47:10 GMT
content-type
text/plain
server
Golfe2
2024.mp4
app.go99ok.xyz/img/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
app.go99ok.xyz
URL
https://app.go99ok.xyz/img/favicon.png
Domain
app.go99ok.xyz
URL
https://app.go99ok.xyz/img/favicon.png
Domain
app.go99ok.xyz
URL
https://app.go99ok.xyz/img/2024.mp4

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _hmt function| gtag object| dataLayer object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal boolean| _bdhm_loaded_309a440e4e562b3b8d09fced93ec64f7

6 Cookies

Domain/Path Name / Value
.go99ok.xyz/ Name: _ga
Value: GA1.1.12080443.1732358826
.go99ok.xyz/ Name: _ga_CJTHKD9J0L
Value: GS1.1.1732358825.1.0.1732358825.0.0.0
.hm.baidu.com/ Name: HMACCOUNT_BFESS
Value: 2380DD832CC361BF
.app.go99ok.xyz/ Name: Hm_lvt_309a440e4e562b3b8d09fced93ec64f7
Value: 1732358829
.app.go99ok.xyz/ Name: Hm_lpvt_309a440e4e562b3b8d09fced93ec64f7
Value: 1732358829
.app.go99ok.xyz/ Name: HMACCOUNT
Value: 2380DD832CC361BF

1 Console Messages

Source Level URL
Text
network error URL: https://app.go99ok.xyz/images/icon01.png
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000