Submitted URL: https://clients.myibxtpaplan.com/
Effective URL: https://clients.myibxtpaplan.com/Public/Login/
Submission: On November 27 via manual from US — Scanned from US

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 2606:4700::6812:10a3, located in United States and belongs to CLOUDFLARENET, US. The main domain is clients.myibxtpaplan.com. The Cisco Umbrella rank of the primary domain is 754938.
TLS certificate: Issued by WE1 on October 16th 2024. Valid for: 3 months.
This is the only time clients.myibxtpaplan.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 11 2606:4700::68... 13335 (CLOUDFLAR...)
9 1
Apex Domain
Subdomains
Transfer
11 myibxtpaplan.com
clients.myibxtpaplan.com — Cisco Umbrella Rank: 754938
753 KB
9 1
Domain Requested by
11 clients.myibxtpaplan.com 2 redirects clients.myibxtpaplan.com
9 1

This site contains links to these domains. Also see Links.

Domain
www.ibxtpa.com
Subject Issuer Validity Valid
myibxtpaplan.com
WE1
2024-10-16 -
2025-01-14
3 months crt.sh

This page contains 2 frames:

Primary Page: https://clients.myibxtpaplan.com/Public/Login/
Frame ID: BCCB2F15FA5ADF4C5F56153C1AB5BC8C
Requests: 7 HTTP requests in this frame

Frame: https://clients.myibxtpaplan.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/a6e12e96a2d5/main.js
Frame ID: B79E663AA3CDEA9AE7A8F7CCB4B4B000
Requests: 2 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://clients.myibxtpaplan.com/ HTTP 302
    https://clients.myibxtpaplan.com/Public/Login/ Page URL

Page Statistics

9
Requests

89 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

752 kB
Transfer

905 kB
Size

8
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://clients.myibxtpaplan.com/ HTTP 302
    https://clients.myibxtpaplan.com/Public/Login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3
  • https://clients.myibxtpaplan.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://clients.myibxtpaplan.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/a6e12e96a2d5/main.js

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
clients.myibxtpaplan.com/Public/Login/
Redirect Chain
  • https://clients.myibxtpaplan.com/
  • https://clients.myibxtpaplan.com/Public/Login/
13 KB
4 KB
Document
General
Full URL
https://clients.myibxtpaplan.com/Public/Login/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:10a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85f6ab0a1916fe849301d1c1f5830a162586b6f43d2efdc9dd337a00402d4e72
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

CF-Cache-Status
DYNAMIC
CF-RAY
8e92c45ce89b7bf2-LAX
Cache-Control
public
Connection
keep-alive
Content-Encoding
gzip
Content-Security-Policy
frame-ancestors 'self';
Content-Type
text/html; charset=utf-8
Date
Wed, 27 Nov 2024 14:21:51 GMT
Feature-Policy
microphone 'none'; payment 'none'
Server
cloudflare
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-OneAgent-JS-Injection
true
X-XSS-Protection
1; mode=block
X-ruxit-JS-Agent
true

Redirect headers

CF-Cache-Status
DYNAMIC
CF-RAY
8e92c45a6e577bf2-LAX
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Date
Wed, 27 Nov 2024 14:21:51 GMT
Feature-Policy
microphone 'none'; payment 'none'
Location
https://clients.myibxtpaplan.com/Public/Login/
Server
cloudflare
Transfer-Encoding
chunked
X-Frame-Options
SAMEORIGIN
ruxitagentjs_ICA7NVfgqrux_10303241106123517.js
clients.myibxtpaplan.com/
232 KB
88 KB
Script
General
Full URL
https://clients.myibxtpaplan.com/ruxitagentjs_ICA7NVfgqrux_10303241106123517.js
Requested by
Host: clients.myibxtpaplan.com
URL: https://clients.myibxtpaplan.com/Public/Login/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:10a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2330f179daee0fbd2b33959862a25226a819f8c7cae18d1af470648dd536f361
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://clients.myibxtpaplan.com/Public/Login/

Response headers

Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
X-Content-Type-Options
nosniff
Expires
Thu, 27 Nov 2025 14:21:51 GMT
Date
Wed, 27 Nov 2024 14:21:51 GMT
Content-Type
text/javascript; charset=utf-8
Feature-Policy
microphone 'none'; payment 'none'
Vary
Accept-Encoding
Last-Modified
Wed, 03 Mar 2010 07:01:40 GMT
X-Frame-Options
SAMEORIGIN
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Security-Policy
frame-ancestors 'self';
Cache-Control
public, max-age=31536000, immutable
Connection
keep-alive
CF-RAY
8e92c45e9a7e7bf2-LAX
Access-Control-Allow-Origin
*
X-XSS-Protection
1; mode=block
Server
cloudflare
IA
clients.myibxtpaplan.com/Public/logo/
14 KB
14 KB
Image
General
Full URL
https://clients.myibxtpaplan.com/Public/logo/IA
Requested by
Host: clients.myibxtpaplan.com
URL: https://clients.myibxtpaplan.com/Public/Login/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:10a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e51365681263833ca19ce971e0ca524d2c1fc2ee7591b66a0c3587858839f501
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://clients.myibxtpaplan.com/Public/Login/

Response headers

Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
X-Content-Type-Options
nosniff
Date
Wed, 27 Nov 2024 14:21:52 GMT
Content-Type
image/jpeg
Vary
Accept-Encoding
Feature-Policy
microphone 'none'; payment 'none'
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Security-Policy
frame-ancestors 'self';
Cache-Control
public
Connection
keep-alive
CF-RAY
8e92c45f8fe578de-LAX
Content-Length
14054
X-XSS-Protection
1; mode=block
Server
cloudflare
LoginBackground.jpg
clients.myibxtpaplan.com/Public/Images/
637 KB
638 KB
Image
General
Full URL
https://clients.myibxtpaplan.com/Public/Images/LoginBackground.jpg
Requested by
Host: clients.myibxtpaplan.com
URL: https://clients.myibxtpaplan.com/Public/Login/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:10a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
baa9f2f97f48c9679d5b9bc531f27badd0cb5b17a941fb90a0a205cfbc266d43
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://clients.myibxtpaplan.com/Public/Login/

Response headers

Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
ETag
"0165fa8a136db1:0-gzip"
X-Content-Type-Options
nosniff
Date
Wed, 27 Nov 2024 14:21:52 GMT
Content-Type
image/jpeg
Feature-Policy
microphone 'none'; payment 'none'
Vary
Accept-Encoding
Last-Modified
Thu, 14 Nov 2024 14:29:48 GMT
X-Frame-Options
SAMEORIGIN
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Security-Policy
frame-ancestors 'self';
Cache-Control
public,public,max-age=31536000
Connection
keep-alive
CF-RAY
8e92c45f89817c59-LAX
Accept-Ranges
bytes
X-XSS-Protection
1; mode=block
Server
cloudflare
main.js
clients.myibxtpaplan.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/a6e12e96a2d5/ Frame B79E
Redirect Chain
  • https://clients.myibxtpaplan.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://clients.myibxtpaplan.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/a6e12e96a2d5/main.js?
9 KB
4 KB
Script
General
Full URL
https://clients.myibxtpaplan.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/a6e12e96a2d5/main.js?
Requested by
Host: clients.myibxtpaplan.com
URL: https://clients.myibxtpaplan.com/Public/Login/
Protocol
HTTP/1.1
Server
2606:4700::6812:10a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d579efbcb2047388c0152a64cb793f23ca91690382948e94aa4aa731300dd91c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Transfer-Encoding
chunked
cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
Content-Encoding
gzip
Connection
keep-alive
x-content-type-options
nosniff
CF-RAY
8e92c461dd8c7bf2-LAX
Date
Wed, 27 Nov 2024 14:21:52 GMT
Content-Type
application/javascript; charset=UTF-8
Server
cloudflare

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/b/scripts/jsd/a6e12e96a2d5/main.js?
Connection
keep-alive
CF-RAY
8e92c4615d147bf2-LAX
access-control-allow-origin
*
Content-Length
0
Date
Wed, 27 Nov 2024 14:21:52 GMT
Server
cloudflare
8e92c45ce89b7bf2
clients.myibxtpaplan.com/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame B79E
0
942 B
XHR
General
Full URL
https://clients.myibxtpaplan.com/cdn-cgi/challenge-platform/h/b/jsd/r/8e92c45ce89b7bf2
Requested by
Host: clients.myibxtpaplan.com
URL: https://clients.myibxtpaplan.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:10a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
application/json
Referer

Response headers

CF-RAY
8e92c462fc1278de-LAX
Content-Length
0
Date
Wed, 27 Nov 2024 14:21:52 GMT
Content-Type
text/plain; charset=UTF-8
Connection
keep-alive
Server
cloudflare
favicon.ico
clients.myibxtpaplan.com/
631 B
1 KB
Other
General
Full URL
https://clients.myibxtpaplan.com/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:10a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e43fcc3e98c28f444e6bd62b9ad7fa5e9c21e98e45370c07ac8fdf06e95ba062
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://clients.myibxtpaplan.com/Public/Login/

Response headers

Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
X-Content-Type-Options
nosniff
X-OneAgent-JS-Injection
true
Date
Wed, 27 Nov 2024 14:21:53 GMT
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Feature-Policy
microphone 'none'; payment 'none'
X-ruxit-JS-Agent
true
X-Frame-Options
SAMEORIGIN
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Security-Policy
frame-ancestors 'self';
Last-Modified
Tue, 09 Nov 2021 17:10:34 GMT
Connection
keep-alive
CF-RAY
8e92c46678557c59-LAX
X-XSS-Protection
1; mode=block
Server
cloudflare
rb_bf18336fji
clients.myibxtpaplan.com/
123 B
666 B
Fetch
General
Full URL
https://clients.myibxtpaplan.com/rb_bf18336fji?type=js3&sn=v_4_srv_9_sn_26D7152561BA113074539D1656EDFE8A_perc_100000_ol_0_mul_1_app-3A5ab709031ecb748a_1&svrid=9&flavor=post&vi=TJUEMVOUFWVPBIMWGPDKCKQFWUPJGALK-0&modifiedSince=1732303315012&rf=https%3A%2F%2Fclients.myibxtpaplan.com%2FPublic%2FLogin%2F&bp=3&app=5ab709031ecb748a&crc=258136246&en=pb1lulax&end=1
Requested by
Host: clients.myibxtpaplan.com
URL: https://clients.myibxtpaplan.com/ruxitagentjs_ICA7NVfgqrux_10303241106123517.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:10a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4c808330200c708eed20d9bc22e3f04e1e68679df69d0c606bb48f41265dbff
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://clients.myibxtpaplan.com/Public/Login/

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Security-Policy
frame-ancestors 'self';
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
Connection
keep-alive
X-Content-Type-Options
nosniff
CF-RAY
8e92c46d2f167c59-LAX
Content-Length
132
Date
Wed, 27 Nov 2024 14:21:54 GMT
X-XSS-Protection
1; mode=block
Content-Type
text/plain; charset=utf-8
Vary
Accept-Encoding
Feature-Policy
microphone 'none'; payment 'none'
Server
cloudflare
X-Frame-Options
SAMEORIGIN
rb_bf18336fji
clients.myibxtpaplan.com/
123 B
666 B
Fetch
General
Full URL
https://clients.myibxtpaplan.com/rb_bf18336fji?type=js3&sn=v_4_srv_9_sn_26D7152561BA113074539D1656EDFE8A_perc_100000_ol_0_mul_1_app-3A5ab709031ecb748a_1&svrid=9&flavor=post&vi=TJUEMVOUFWVPBIMWGPDKCKQFWUPJGALK-0&modifiedSince=1732303315012&rf=https%3A%2F%2Fclients.myibxtpaplan.com%2FPublic%2FLogin%2F&bp=3&app=5ab709031ecb748a&crc=292441897&en=pb1lulax&end=1
Requested by
Host: clients.myibxtpaplan.com
URL: https://clients.myibxtpaplan.com/ruxitagentjs_ICA7NVfgqrux_10303241106123517.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:10a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4c808330200c708eed20d9bc22e3f04e1e68679df69d0c606bb48f41265dbff
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://clients.myibxtpaplan.com/Public/Login/

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Security-Policy
frame-ancestors 'self';
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
Connection
keep-alive
X-Content-Type-Options
nosniff
CF-RAY
8e92c479db7e7c59-LAX
Content-Length
132
Date
Wed, 27 Nov 2024 14:21:56 GMT
X-XSS-Protection
1; mode=block
Content-Type
text/plain; charset=utf-8
Vary
Accept-Encoding
Feature-Policy
microphone 'none'; payment 'none'
Server
cloudflare
X-Frame-Options
SAMEORIGIN

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| dT_ object| dtrum object| dynatrace function| onBodyLoad function| onLoginBtnClick function| submitform function| setFocusOnElement function| getParameterByName function| updateErrorMessage function| getErrorMessage

8 Cookies

Domain/Path Name / Value
.myibxtpaplan.com/ Name: dtCookie
Value: v_4_srv_9_sn_26D7152561BA113074539D1656EDFE8A_perc_100000_ol_0_mul_1_app-3A5ab709031ecb748a_1
.clients.myibxtpaplan.com/ Name: TS01ca4261
Value: 0128776a8394679fb6ee55edeb7e1f3f8005d6f32d47f02dd51f3c5ac58a4c77c20cb5b7381687e7ef3607e743185ad42a35cc9e49
.myibxtpaplan.com/ Name: __cf_bm
Value: KAQw6HPdsoLUZ7cuHQ5S1Jq4XIKulv4uUZjvzVlww2w-1732717311-1.0.1.1-Xq_sWPgxkEGEpcTyAdlQGfcL2b.r2ZdlZehABjbgmFBZbB8Uy6Ty.qu2HjhqD6rdyCB6OzGv.p.gTMiZApNOGA
.myibxtpaplan.com/ Name: rxVisitor
Value: 1732717312133FDR0CBP03BQ4UKG7DKEHSUM3G9JH1UM6
.myibxtpaplan.com/ Name: dtSa
Value: -
.myibxtpaplan.com/ Name: cf_clearance
Value: 850KzFPgTz5n6nYeh7zv92y9Pd9BSMShpPU_lib08fA-1732717312-1.2.1.1-pOMs8zHAh5tuIkFKAWsu2moltYvCKUy0KgBKMeAiJ5tNYtPUP8k80dm29QzF3r59xBMN57I06Qp.qgoxnMZwHfJUERP2pXRTuxHSWAZXV5QoohMuYE3Fdk0hUxa_OFpfBeM0Id6bcO.nEBRtGIsLQfbVPUz9gibwqZitXp5vY.2UW2OXaQe4utbTnmcS3Ugj5ewI6koBHzhdwOtBMFTrmr2bD0z_Dg3Nh15UMUyS95XPdl_Jda4Nz89nYd1qzt_e.x7agFC1DztKPu_LvhRv9xxWn2tMkRY4SW0lT00yrRUW91Uq_..N4FYlVxdaJk3WwH5lwcW3zmJmjyrdoloE._tUesfvVGxvVuwl3U8ddJRX4Nd_n4rRmnTK07woUdNQ
.myibxtpaplan.com/ Name: rxvt
Value: 1732719112974|1732717312134
.myibxtpaplan.com/ Name: dtPC
Value: 9$517312131_141h-vTJUEMVOUFWVPBIMWGPDKCKQFWUPJGALK-0e0

1 Console Messages

Source Level URL
Text
network error URL: https://clients.myibxtpaplan.com/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block