URL: https://support.easywave.io/
Submission: On February 01 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 144.76.5.146, located in Bad Bellingen, Germany and belongs to HETZNER-AS, DE. The main domain is support.easywave.io.
TLS certificate: Issued by R3 on February 1st 2024. Valid for: 3 months.
This is the only time support.easywave.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
12 144.76.5.146 24940 (HETZNER-AS)
12 1
Apex Domain
Subdomains
Transfer
12 easywave.io
support.easywave.io
1 MB
12 1
Domain Requested by
12 support.easywave.io support.easywave.io
12 1

This site contains links to these domains. Also see Links.

Domain
zammad.org
Subject Issuer Validity Valid
support.easywave.io
R3
2024-02-01 -
2024-05-01
3 months crt.sh

This page contains 1 frames:

Primary Page: https://support.easywave.io/
Frame ID: 751F4CE3915531CD6932BD1537C03643
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

Zammad Helpdesk - Sign in

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1421 kB
Transfer

4425 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
support.easywave.io/
3 KB
3 KB
Document
General
Full URL
https://support.easywave.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
144.76.5.146 Bad Bellingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.146.5.76.144.clients.your-server.de
Software
openresty /
Resource Hash
10eb366c982c1c273b54e7a418213ffbbe85d33f0f168de2357eb2f35f100c76
Security Headers
Name Value
Content-Security-Policy base-uri 'self' https://support.easywave.io; default-src 'self' ws: wss: https://images.zammad.com; font-src 'self' data:; img-src * data:; object-src 'none'; script-src 'self' 'unsafe-eval' 'nonce-g/kma4wg4M5vRg8E3tIuDQ=='; style-src 'self' 'unsafe-inline'; frame-src www.youtube.com player.vimeo.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=0, private, must-revalidate
content-encoding
gzip
content-length
1540
content-security-policy
base-uri 'self' https://support.easywave.io; default-src 'self' ws: wss: https://images.zammad.com; font-src 'self' data:; img-src * data:; object-src 'none'; script-src 'self' 'unsafe-eval' 'nonce-g/kma4wg4M5vRg8E3tIuDQ=='; style-src 'self' 'unsafe-inline'; frame-src www.youtube.com player.vimeo.com
content-type
text/html; charset=utf-8
csrf-token
2Xp0bluhF0bN9bG-ZF68OD9bYQXWzv5Vb0lfD0KCTbCVyrJ3f8CUwvk_rKRlkVmP2HlmEJJVm7oc1gkG4Bs9dg
date
Thu, 01 Feb 2024 20:52:27 GMT
etag
W/"10eb366c982c1c273b54e7a418213ffb-gzip"
link
</assets/application-375a32be032507c30966c744ef9f31fd87738454d1f3c75bacd4fd1c0e31f063.css>; rel=preload; as=style; nopush,</assets/application-print-03b49985a4830cb5379c75dde562b82d9cb2d7eee523c566dc793e7be07a85e0.css>; rel=preload; as=style; nopush
referrer-policy
strict-origin-when-cross-origin
server
openresty
vary
Accept-Encoding
x-content-type-options
nosniff
x-download-options
noopen
x-frame-options
SAMEORIGIN
x-permitted-cross-domain-policies
none
x-request-id
a5f4791d-cf6c-431b-8f34-b2d81140b4b4
x-runtime
0.020745
x-served-by
support.easywave.io
x-xss-protection
1; mode=block
application-375a32be032507c30966c744ef9f31fd87738454d1f3c75bacd4fd1c0e31f063.css
support.easywave.io/assets/
378 KB
66 KB
Stylesheet
General
Full URL
https://support.easywave.io/assets/application-375a32be032507c30966c744ef9f31fd87738454d1f3c75bacd4fd1c0e31f063.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
144.76.5.146 Bad Bellingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.146.5.76.144.clients.your-server.de
Software
openresty /
Resource Hash
5c1acb4ca0e35df07ae103198899f4303f7a72aacffd9f07b53fed43a66e80ca

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://support.easywave.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Thu, 01 Feb 2024 20:52:27 GMT
content-encoding
gzip
last-modified
Mon, 08 Jan 2024 09:43:30 GMT
server
openresty
etag
"5e974-60e6c07c6f480-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
x-served-by
support.easywave.io
application-print-03b49985a4830cb5379c75dde562b82d9cb2d7eee523c566dc793e7be07a85e0.css
support.easywave.io/assets/
3 KB
1 KB
Stylesheet
General
Full URL
https://support.easywave.io/assets/application-print-03b49985a4830cb5379c75dde562b82d9cb2d7eee523c566dc793e7be07a85e0.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
144.76.5.146 Bad Bellingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.146.5.76.144.clients.your-server.de
Software
openresty /
Resource Hash
03b49985a4830cb5379c75dde562b82d9cb2d7eee523c566dc793e7be07a85e0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://support.easywave.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Thu, 01 Feb 2024 20:52:27 GMT
content-encoding
gzip
last-modified
Mon, 08 Jan 2024 09:43:30 GMT
server
openresty
etag
"af3-60e6c07c6f480-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
1062
x-served-by
support.easywave.io
application-6f6d2944dc5178c0df0e1d9d462d392aa6d39b857f54ea2d862021ba27d674e8.js
support.easywave.io/assets/
3 MB
753 KB
Script
General
Full URL
https://support.easywave.io/assets/application-6f6d2944dc5178c0df0e1d9d462d392aa6d39b857f54ea2d862021ba27d674e8.js
Requested by
Host: support.easywave.io
URL: https://support.easywave.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
144.76.5.146 Bad Bellingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.146.5.76.144.clients.your-server.de
Software
openresty /
Resource Hash
6f6d2944dc5178c0df0e1d9d462d392aa6d39b857f54ea2d862021ba27d674e8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://support.easywave.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Thu, 01 Feb 2024 20:52:27 GMT
content-encoding
gzip
last-modified
Tue, 30 Jan 2024 09:14:30 GMT
server
openresty
etag
"35a266-610263092e980-gzip"
vary
Accept-Encoding
content-type
text/javascript
accept-ranges
bytes
x-served-by
support.easywave.io
form.js
support.easywave.io/assets/form/
19 KB
5 KB
Script
General
Full URL
https://support.easywave.io/assets/form/form.js
Requested by
Host: support.easywave.io
URL: https://support.easywave.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
144.76.5.146 Bad Bellingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.146.5.76.144.clients.your-server.de
Software
openresty /
Resource Hash
8618763ace2158ce908b5c9df4bbdc133c0b3982cc2b0d32ed46da0eba557c12

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://support.easywave.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Thu, 01 Feb 2024 20:52:27 GMT
content-encoding
gzip
last-modified
Tue, 30 Jan 2024 09:14:03 GMT
server
openresty
etag
"4df2-610262ef6ecc0-gzip"
vary
Accept-Encoding
content-type
text/javascript
accept-ranges
bytes
content-length
5086
x-served-by
support.easywave.io
icons.svg
support.easywave.io/assets/images/
103 KB
104 KB
Other
General
Full URL
https://support.easywave.io/assets/images/icons.svg
Requested by
Host: support.easywave.io
URL: https://support.easywave.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
144.76.5.146 Bad Bellingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.146.5.76.144.clients.your-server.de
Software
openresty /
Resource Hash
dc269e095088d4399e6a31517a11b59b063f7b4727de0fe47c46ec514c355021

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://support.easywave.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Thu, 01 Feb 2024 20:52:27 GMT
last-modified
Tue, 30 Jan 2024 09:14:03 GMT
server
openresty
etag
"19ce1-610262ef6ecc0"
content-type
image/svg+xml
accept-ranges
bytes
content-length
105697
x-served-by
support.easywave.io
FiraSans-Regular.woff2
support.easywave.io/assets/fonts/
125 KB
125 KB
Font
General
Full URL
https://support.easywave.io/assets/fonts/FiraSans-Regular.woff2
Requested by
Host: support.easywave.io
URL: https://support.easywave.io/assets/application-375a32be032507c30966c744ef9f31fd87738454d1f3c75bacd4fd1c0e31f063.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
144.76.5.146 Bad Bellingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.146.5.76.144.clients.your-server.de
Software
openresty /
Resource Hash
8d739118905988fffe702241d03ac1463ae5e56aef49c66bc4995669dc43d4dc

Request headers

Referer
https://support.easywave.io/assets/application-375a32be032507c30966c744ef9f31fd87738454d1f3c75bacd4fd1c0e31f063.css
Origin
https://support.easywave.io
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Thu, 01 Feb 2024 20:52:27 GMT
last-modified
Tue, 30 Jan 2024 09:14:03 GMT
server
openresty
etag
"1f26c-610262ef6ecc0"
content-type
font/woff2
accept-ranges
bytes
content-length
127596
x-served-by
support.easywave.io
signshow
support.easywave.io/api/v1/
11 KB
12 KB
XHR
General
Full URL
https://support.easywave.io/api/v1/signshow
Requested by
Host: support.easywave.io
URL: https://support.easywave.io/assets/application-6f6d2944dc5178c0df0e1d9d462d392aa6d39b857f54ea2d862021ba27d674e8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
144.76.5.146 Bad Bellingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.146.5.76.144.clients.your-server.de
Software
openresty /
Resource Hash
dae60ca3763710c7df7ccc1731520b091bb6554ea286eba6ac1852e09510e0bc
Security Headers
Name Value
Content-Security-Policy base-uri 'self' https://support.easywave.io; default-src 'self' ws: wss: https://images.zammad.com; font-src 'self' data:; img-src * data:; object-src 'none'; script-src 'self' 'unsafe-eval' 'nonce-r5rdGtLFvANPsB/K2Z10tw=='; style-src 'self' 'unsafe-inline'; frame-src www.youtube.com player.vimeo.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://support.easywave.io/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 01 Feb 2024 20:52:28 GMT
content-security-policy
base-uri 'self' https://support.easywave.io; default-src 'self' ws: wss: https://images.zammad.com; font-src 'self' data:; img-src * data:; object-src 'none'; script-src 'self' 'unsafe-eval' 'nonce-r5rdGtLFvANPsB/K2Z10tw=='; style-src 'self' 'unsafe-inline'; frame-src www.youtube.com player.vimeo.com
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
content-length
11655
x-xss-protection
1; mode=block
x-request-id
927ce2c8-bf85-4903-953a-18dd5a6f26d8
x-served-by
support.easywave.io
x-runtime
0.050955
referrer-policy
strict-origin-when-cross-origin
server
openresty
etag
W/"dae60ca3763710c7df7ccc1731520b09"
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Accept
content-type
application/json; charset=utf-8
csrf-token
RtuE7eHXy8AoHLsrlk8N7dF0mAPQeTT2Q78sbH-WwT8Ka0L0xbZIRBzWpjGXgOhaNlafFpTiURkwIHpl3Q-x-Q
cache-control
max-age=0, private, must-revalidate
en-us
support.easywave.io/api/v1/translations/lang/
252 KB
253 KB
XHR
General
Full URL
https://support.easywave.io/api/v1/translations/lang/en-us?_=1706820748066
Requested by
Host: support.easywave.io
URL: https://support.easywave.io/assets/application-6f6d2944dc5178c0df0e1d9d462d392aa6d39b857f54ea2d862021ba27d674e8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
144.76.5.146 Bad Bellingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.146.5.76.144.clients.your-server.de
Software
openresty /
Resource Hash
df585175ecede36d8189470a7f131d9152c84d1f0391c4b6f88bbef2d35e47fc
Security Headers
Name Value
Content-Security-Policy base-uri 'self' https://support.easywave.io; default-src 'self' ws: wss: https://images.zammad.com; font-src 'self' data:; img-src * data:; object-src 'none'; script-src 'self' 'unsafe-eval' 'nonce-Gckbw/efU6tqZn5LHA4bAQ=='; style-src 'self' 'unsafe-inline'; frame-src www.youtube.com player.vimeo.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://support.easywave.io/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 01 Feb 2024 20:52:28 GMT
content-security-policy
base-uri 'self' https://support.easywave.io; default-src 'self' ws: wss: https://images.zammad.com; font-src 'self' data:; img-src * data:; object-src 'none'; script-src 'self' 'unsafe-eval' 'nonce-Gckbw/efU6tqZn5LHA4bAQ=='; style-src 'self' 'unsafe-inline'; frame-src www.youtube.com player.vimeo.com
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
content-length
258503
x-xss-protection
1; mode=block
x-request-id
75d9bc66-d272-461c-9c46-b8ba2a2533e0
x-served-by
support.easywave.io
x-runtime
0.048744
referrer-policy
strict-origin-when-cross-origin
server
openresty
etag
W/"df585175ecede36d8189470a7f131d91"
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Accept
content-type
application/json; charset=utf-8
csrf-token
JcXqH22atQzupkBDcHUP0srGuxbewqbyC71HwbbkrVFpdSwGSfs2iNpsXVlxuuplLeS8A5pZwx14IhHIFH3dlw
cache-control
max-age=0, private, must-revalidate
chat_new.mp3
support.easywave.io/assets/sounds/
44 KB
44 KB
Media
General
Full URL
https://support.easywave.io/assets/sounds/chat_new.mp3
Requested by
Host: support.easywave.io
URL: https://support.easywave.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
144.76.5.146 Bad Bellingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.146.5.76.144.clients.your-server.de
Software
openresty /
Resource Hash
a7ede5b71656854a2708101bab4fea49a632e7a90b82187c01b5e1e0e7653940

Request headers

Referer
https://support.easywave.io/
Accept-Encoding
identity;q=1, *;q=0
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Range
bytes=0-

Response headers

date
Thu, 01 Feb 2024 20:52:28 GMT
last-modified
Tue, 30 Jan 2024 09:14:03 GMT
server
openresty
etag
"af8f-610262ef6ecc0"
content-type
audio/mpeg
Content-Range
bytes 0-44942/44943
accept-ranges
bytes
Content-Length
44943
x-served-by
support.easywave.io
chat_message.mp3
support.easywave.io/assets/sounds/
42 KB
42 KB
Media
General
Full URL
https://support.easywave.io/assets/sounds/chat_message.mp3
Requested by
Host: support.easywave.io
URL: https://support.easywave.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
144.76.5.146 Bad Bellingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.146.5.76.144.clients.your-server.de
Software
openresty /
Resource Hash
c03005fa00123eeed2dbe67611d3f8ce5811e019bd146226dbdb6693c273ed31

Request headers

Referer
https://support.easywave.io/
Accept-Encoding
identity;q=1, *;q=0
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Range
bytes=0-

Response headers

date
Thu, 01 Feb 2024 20:52:28 GMT
last-modified
Tue, 30 Jan 2024 09:14:03 GMT
server
openresty
etag
"a81c-610262ef6ecc0"
content-type
audio/mpeg
Content-Range
bytes 0-43035/43036
accept-ranges
bytes
Content-Length
43036
x-served-by
support.easywave.io
1706820648
support.easywave.io/api/v1/system_assets/product_logo/
12 KB
12 KB
Image
General
Full URL
https://support.easywave.io/api/v1/system_assets/product_logo/1706820648
Requested by
Host: support.easywave.io
URL: https://support.easywave.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
144.76.5.146 Bad Bellingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.146.5.76.144.clients.your-server.de
Software
openresty /
Resource Hash
7fb4b5e370941747a887dabbfe5de047053b738e14ec66477376eaaa09f4be31
Security Headers
Name Value
Content-Security-Policy default-src 'none'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://support.easywave.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Thu, 01 Feb 2024 20:52:28 GMT
content-security-policy
default-src 'none'
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
content-transfer-encoding
binary
content-disposition
inline; filename="logo"; filename*=UTF-8''logo
content-length
11866
x-xss-protection
1; mode=block
x-request-id
31752f2a-d63b-488d-ad13-0cb26ef3c2f6
x-served-by
support.easywave.io
x-runtime
0.009523
referrer-policy
strict-origin-when-cross-origin
server
openresty
etag
W/"7fb4b5e370941747a887dabbfe5de047"
x-download-options
noopen
x-frame-options
SAMEORIGIN
content-type
image/png
csrf-token
IO7CemxJNtarn2HtePzj7aY75Ym1N-MBC8hraaeXfVlsXgRjSCi1Up9VfPd5MwZaQRninPGshu54Vz1gBQ4Nnw
cache-control
max-age=31556952, public

Verdicts & Comments Add Verdict or Comment

44 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| polyfillScriptTag boolean| svgPolyfill function| UploadManager function| FileUpload function| isMobile function| __ function| escapeRegExp function| difference function| byteLength function| clone function| underscored function| toCamelCase function| isRetina function| originalLeave function| originalShow object| module function| noop undefined| supportsFileApi function| qq object| jsonlint object| linkify function| linkifyStr object| qrcodegen function| $ function| jQuery function| _ object| Spine object| rangy object| clipboard function| CodeMirror object| notify function| emailAddresses function| EXIF object| hljs object| html5Upload function| noty function| marked object| Modernizr function| tinycolor function| UAParser object| webauthnJSON function| word_filter function| App object| JST

1 Cookies

Domain/Path Name / Value
support.easywave.io/ Name: _zammad_session_a138cfd0f37
Value: 061458d47c32c376ce2528455764c0b0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy base-uri 'self' https://support.easywave.io; default-src 'self' ws: wss: https://images.zammad.com; font-src 'self' data:; img-src * data:; object-src 'none'; script-src 'self' 'unsafe-eval' 'nonce-g/kma4wg4M5vRg8E3tIuDQ=='; style-src 'self' 'unsafe-inline'; frame-src www.youtube.com player.vimeo.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block