URL: https://broadcast.windows.ovh/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
Submission Tags: @phishunt_io
Submission: On November 21 via api from ES

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 51.38.235.255, located in France and belongs to OVH, FR. The main domain is broadcast.windows.ovh.
TLS certificate: Issued by Let's Encrypt Authority X3 on November 20th 2020. Valid for: 3 months.
This is the only time broadcast.windows.ovh was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
11 51.38.235.255 16276 (OVH)
11 2
Apex Domain
Subdomains
Transfer
11 windows.ovh
broadcast.windows.ovh
403 KB
11 1
Domain Requested by
11 broadcast.windows.ovh broadcast.windows.ovh
11 1

This site contains no links.

Subject Issuer Validity Valid
broadcast.windows.ovh
Let's Encrypt Authority X3
2020-11-20 -
2021-02-18
3 months crt.sh

This page contains 1 frames:

Primary Page: https://broadcast.windows.ovh/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
Frame ID: 5DC71CF38750C7B1658F13D88AE26BC3
Requests: 12 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /Ubuntu/i

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

403 kB
Transfer

593 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login
broadcast.windows.ovh/auth/
7 KB
3 KB
Document
General
Full URL
https://broadcast.windows.ovh/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.38.235.255 , France, ASN16276 (OVH, FR),
Reverse DNS
255.ip-51-38-235.eu
Software
nginx/1.16.1 (Ubuntu) /
Resource Hash
05fd1d42038ac50cb94519fed62e50860629f11171d9192bbd3853fd6caeaf9c
Security Headers
Name Value
Content-Security-Policy default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff

Request headers

:method
GET
:authority
broadcast.windows.ovh
:scheme
https
:path
/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

server
nginx/1.16.1 (Ubuntu)
date
Sat, 21 Nov 2020 00:17:42 GMT
content-type
text/html; charset=UTF-8
content-security-policy
default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
set-cookie
_csrf=XGqSIoxciSowaskwsgvDtFLqGEaVYHit; Max-Age=3600; HttpOnly; Secure
strict-transport-security
max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains; preload;
vary
Cookie
x-content-type-options
nosniff
content-encoding
gzip
fonts.32305687b0.css
broadcast.windows.ovh/assets/fonts/
420 B
510 B
Stylesheet
General
Full URL
https://broadcast.windows.ovh/assets/fonts/fonts.32305687b0.css
Requested by
Host: broadcast.windows.ovh
URL: https://broadcast.windows.ovh/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.38.235.255 , France, ASN16276 (OVH, FR),
Reverse DNS
255.ip-51-38-235.eu
Software
nginx/1.16.1 (Ubuntu) /
Resource Hash
32305687b0444bdb9a55415d12a0562daa5bd62a901d8c3476438931c6fc0885
Security Headers
Name Value
Content-Security-Policy default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff

Request headers

Referer
https://broadcast.windows.ovh/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
content-encoding
gzip
x-content-type-options
nosniff
server
nginx/1.16.1 (Ubuntu)
date
Sat, 21 Nov 2020 00:17:42 GMT
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000, public, immutable
strict-transport-security
max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
content-length
166
cozy-ui.2fe34fe5d0.min.css
broadcast.windows.ovh/assets/css/
203 KB
29 KB
Stylesheet
General
Full URL
https://broadcast.windows.ovh/assets/css/cozy-ui.2fe34fe5d0.min.css
Requested by
Host: broadcast.windows.ovh
URL: https://broadcast.windows.ovh/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.38.235.255 , France, ASN16276 (OVH, FR),
Reverse DNS
255.ip-51-38-235.eu
Software
nginx/1.16.1 (Ubuntu) /
Resource Hash
2fe34fe5d0dc7e2657829c22af38590048c099c77ef6af390c73f0ec4d31b329
Security Headers
Name Value
Content-Security-Policy default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff

Request headers

Referer
https://broadcast.windows.ovh/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
content-encoding
gzip
x-content-type-options
nosniff
server
nginx/1.16.1 (Ubuntu)
date
Sat, 21 Nov 2020 00:17:42 GMT
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000, public, immutable
strict-transport-security
max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
content-length
29228
theme.faa4e12bdc.css
broadcast.windows.ovh/assets/styles/
36 B
403 B
Stylesheet
General
Full URL
https://broadcast.windows.ovh/assets/styles/theme.faa4e12bdc.css
Requested by
Host: broadcast.windows.ovh
URL: https://broadcast.windows.ovh/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.38.235.255 , France, ASN16276 (OVH, FR),
Reverse DNS
255.ip-51-38-235.eu
Software
nginx/1.16.1 (Ubuntu) /
Resource Hash
faa4e12bdc1c8403eba5fb714b82f1fcc0f2ad1edaa635f7f320144196c65537
Security Headers
Name Value
Content-Security-Policy default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff

Request headers

Referer
https://broadcast.windows.ovh/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
content-encoding
gzip
x-content-type-options
nosniff
server
nginx/1.16.1 (Ubuntu)
date
Sat, 21 Nov 2020 00:17:42 GMT
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000, public, immutable
strict-transport-security
max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
content-length
60
avatar
broadcast.windows.ovh/public/
12 KB
11 KB
Image
General
Full URL
https://broadcast.windows.ovh/public/avatar
Requested by
Host: broadcast.windows.ovh
URL: https://broadcast.windows.ovh/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.38.235.255 , France, ASN16276 (OVH, FR),
Reverse DNS
255.ip-51-38-235.eu
Software
nginx/1.16.1 (Ubuntu) /
Resource Hash
8573ce0df8eade905bcda8b6762b27b3039ebb1c354b7275d1d3527ade981d63
Security Headers
Name Value
Content-Security-Policy default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff

Request headers

Referer
https://broadcast.windows.ovh/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
content-encoding
gzip
vary
Accept-Encoding
server
nginx/1.16.1 (Ubuntu)
etag
"8573ce0df8"
strict-transport-security
max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
content-type
image/png
cache-control
no-cache, public
date
Sat, 21 Nov 2020 00:17:42 GMT
content-length
10839
x-content-type-options
nosniff
password-helpers.c909f732f5.js
broadcast.windows.ovh/assets/scripts/
7 KB
2 KB
Script
General
Full URL
https://broadcast.windows.ovh/assets/scripts/password-helpers.c909f732f5.js
Requested by
Host: broadcast.windows.ovh
URL: https://broadcast.windows.ovh/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.38.235.255 , France, ASN16276 (OVH, FR),
Reverse DNS
255.ip-51-38-235.eu
Software
nginx/1.16.1 (Ubuntu) /
Resource Hash
c909f732f50a5b3717dcbae7a6c319d6ac27adce71b6e5f1e7fd026f6eeb75ba
Security Headers
Name Value
Content-Security-Policy default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff

Request headers

Referer
https://broadcast.windows.ovh/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
content-encoding
gzip
x-content-type-options
nosniff
server
nginx/1.16.1 (Ubuntu)
date
Sat, 21 Nov 2020 00:17:42 GMT
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000, public, immutable
strict-transport-security
max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
content-length
2139
password-visibility.82bd010993.js
broadcast.windows.ovh/assets/scripts/
1 KB
737 B
Script
General
Full URL
https://broadcast.windows.ovh/assets/scripts/password-visibility.82bd010993.js
Requested by
Host: broadcast.windows.ovh
URL: https://broadcast.windows.ovh/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.38.235.255 , France, ASN16276 (OVH, FR),
Reverse DNS
255.ip-51-38-235.eu
Software
nginx/1.16.1 (Ubuntu) /
Resource Hash
82bd010993088e6a6e78d316f6e92f567f05f8deff5cf51aee95f104b59bf286
Security Headers
Name Value
Content-Security-Policy default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff

Request headers

Referer
https://broadcast.windows.ovh/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
content-encoding
gzip
x-content-type-options
nosniff
server
nginx/1.16.1 (Ubuntu)
date
Sat, 21 Nov 2020 00:17:42 GMT
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000, public, immutable
strict-transport-security
max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
content-length
383
login.19bbeb8c8b.js
broadcast.windows.ovh/assets/scripts/
4 KB
2 KB
Script
General
Full URL
https://broadcast.windows.ovh/assets/scripts/login.19bbeb8c8b.js
Requested by
Host: broadcast.windows.ovh
URL: https://broadcast.windows.ovh/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.38.235.255 , France, ASN16276 (OVH, FR),
Reverse DNS
255.ip-51-38-235.eu
Software
nginx/1.16.1 (Ubuntu) /
Resource Hash
19bbeb8c8b343a750a2a64315cb8ba7a23f1c5cdbb51584e523483914682bf24
Security Headers
Name Value
Content-Security-Policy default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff

Request headers

Referer
https://broadcast.windows.ovh/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
content-encoding
gzip
x-content-type-options
nosniff
server
nginx/1.16.1 (Ubuntu)
date
Sat, 21 Nov 2020 00:17:42 GMT
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000, public, immutable
strict-transport-security
max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
content-length
1312
responsive.d19ccdf5d3.js
broadcast.windows.ovh/assets/scripts/
215 B
526 B
Script
General
Full URL
https://broadcast.windows.ovh/assets/scripts/responsive.d19ccdf5d3.js
Requested by
Host: broadcast.windows.ovh
URL: https://broadcast.windows.ovh/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.38.235.255 , France, ASN16276 (OVH, FR),
Reverse DNS
255.ip-51-38-235.eu
Software
nginx/1.16.1 (Ubuntu) /
Resource Hash
d19ccdf5d37aff4b607e138632e672eac6e0caecb5b6123e10b018a2369e08d0
Security Headers
Name Value
Content-Security-Policy default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff

Request headers

Referer
https://broadcast.windows.ovh/auth/login?redirect=https%3A%2F%2Fstore.broadcast.windows.ovh%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
content-encoding
gzip
x-content-type-options
nosniff
server
nginx/1.16.1 (Ubuntu)
date
Sat, 21 Nov 2020 00:17:42 GMT
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000, public, immutable
strict-transport-security
max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
content-length
172
truncated
/
184 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4b3bf841020caa7755dc20c401d5fba7a684651f150d58c6fb83d49f46c83d6b

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
Lato-Bold.immutable.woff2
broadcast.windows.ovh/assets/fonts/
181 KB
178 KB
Font
General
Full URL
https://broadcast.windows.ovh/assets/fonts/Lato-Bold.immutable.woff2
Requested by
Host: broadcast.windows.ovh
URL: https://broadcast.windows.ovh/assets/fonts/fonts.32305687b0.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.38.235.255 , France, ASN16276 (OVH, FR),
Reverse DNS
255.ip-51-38-235.eu
Software
nginx/1.16.1 (Ubuntu) /
Resource Hash
ae88fc0d7a961832f809527d30bd3983a6866d42f66a56ade23f543681594db6
Security Headers
Name Value
Content-Security-Policy default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff

Request headers

Origin
https://broadcast.windows.ovh
Referer
https://broadcast.windows.ovh/assets/fonts/fonts.32305687b0.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 21 Nov 2020 00:17:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
nginx/1.16.1 (Ubuntu)
vary
Origin, Accept-Encoding
content-type
font/woff2
access-control-allow-origin
https://broadcast.windows.ovh
cache-control
max-age=31536000, public, immutable
access-control-allow-credentials
true
content-security-policy
default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
strict-transport-security
max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
content-length
181502
Lato-Regular.immutable.woff2
broadcast.windows.ovh/assets/fonts/
178 KB
176 KB
Font
General
Full URL
https://broadcast.windows.ovh/assets/fonts/Lato-Regular.immutable.woff2
Requested by
Host: broadcast.windows.ovh
URL: https://broadcast.windows.ovh/assets/fonts/fonts.32305687b0.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.38.235.255 , France, ASN16276 (OVH, FR),
Reverse DNS
255.ip-51-38-235.eu
Software
nginx/1.16.1 (Ubuntu) /
Resource Hash
983b0caf336e8542214fc17019a4fc5e0360864b92806ca14d55c1fc1c2c5a0f
Security Headers
Name Value
Content-Security-Policy default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff

Request headers

Origin
https://broadcast.windows.ovh
Referer
https://broadcast.windows.ovh/assets/fonts/fonts.32305687b0.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 21 Nov 2020 00:17:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
nginx/1.16.1 (Ubuntu)
vary
Origin, Accept-Encoding
content-type
font/woff2
access-control-allow-origin
https://broadcast.windows.ovh
cache-control
max-age=31536000, public, immutable
access-control-allow-credentials
true
content-security-policy
default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
strict-transport-security
max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload;
content-length
179587

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| password

1 Cookies

Domain/Path Name / Value
broadcast.windows.ovh/auth Name: _csrf
Value: XGqSIoxciSowaskwsgvDtFLqGEaVYHit

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self';img-src data: blob: 'self';frame-ancestors 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff