URL: https://mycommunitylendingaccount.com/
Submission: On August 21 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 20 HTTP transactions. The main IP is 44.205.146.198, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is mycommunitylendingaccount.com.
TLS certificate: Issued by Amazon RSA 2048 M02 on August 19th 2024. Valid for: a year.
This is the only time mycommunitylendingaccount.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
8 44.205.146.198 14618 (AMAZON-AES)
1 2a00:1450:400... 15169 (GOOGLE)
1 9 13.248.237.39 16509 (AMAZON-02)
1 3.5.84.112 16509 (AMAZON-02)
2 52.92.211.32 16509 (AMAZON-02)
20 5
Domain Requested by
9 communitylending.mobilizecollections.com 1 redirects mycommunitylendingaccount.com
8 mycommunitylendingaccount.com mycommunitylendingaccount.com
2 s3-us-west-2.amazonaws.com
1 dev-payix-s3.s3.us-west-2.amazonaws.com
1 fonts.googleapis.com mycommunitylendingaccount.com
20 5

This site contains no links.

Subject Issuer Validity Valid
mycommunitylendingaccount.com
Amazon RSA 2048 M02
2024-08-19 -
2025-09-17
a year crt.sh
upload.video.google.com
WR2
2024-07-30 -
2024-10-22
3 months crt.sh
mobilizecollections.com
Amazon RSA 2048 M03
2024-02-01 -
2025-03-01
a year crt.sh
*.s3-us-west-2.amazonaws.com
Amazon RSA 2048 M01
2024-07-15 -
2025-07-08
a year crt.sh

This page contains 1 frames:

Primary Page: https://mycommunitylendingaccount.com/
Frame ID: DAF8C12394FF9031964DE62850021845
Requests: 16 HTTP requests in this frame

Screenshot

Page Title

Community Lending Works

Page Statistics

20
Requests

95 %
HTTPS

20 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

2810 kB
Transfer

2809 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 16
  • https://communitylending.mobilizecollections.com/app/favicon HTTP 302
  • https://dev-payix-s3.s3.us-west-2.amazonaws.com/favicon/FcuMlZ8JgeQLWOwEfXxrkIoc0DHHmY8NQWD9BLrO.ico

20 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
mycommunitylendingaccount.com/
588 B
1 KB
Document
General
Full URL
https://mycommunitylendingaccount.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.205.146.198 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-205-146-198.compute-1.amazonaws.com
Software
nginx /
Resource Hash
326958fa46146b5ae6621704bb9baa21753e131738568de84db3555dd8add179
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.mobilizecollections.com; frame-src https://*.cec-infrastructure.com https://*.constant.ai; script-src 'self' code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://* data:; child-src 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
content-length
588
content-security-policy
default-src 'self' *.mobilizecollections.com; frame-src https://*.cec-infrastructure.com https://*.constant.ai; script-src 'self' code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://* data:; child-src 'none';
content-type
text/html
date
Wed, 21 Aug 2024 16:50:58 GMT
etag
"665770cc-24c"
last-modified
Wed, 29 May 2024 18:15:40 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
main.55907aa2.js
mycommunitylendingaccount.com/static/js/
1 MB
1 MB
Script
General
Full URL
https://mycommunitylendingaccount.com/static/js/main.55907aa2.js
Requested by
Host: mycommunitylendingaccount.com
URL: https://mycommunitylendingaccount.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.205.146.198 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-205-146-198.compute-1.amazonaws.com
Software
nginx /
Resource Hash
7f9281cdfb650bf426472221d3820114837ffa0102d4a418bf845222bd56bbeb
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.mobilizecollections.com; frame-src https://*.cec-infrastructure.com https://*.constant.ai; script-src 'self' code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://* data:; child-src 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://mycommunitylendingaccount.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 21 Aug 2024 16:50:58 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-security-policy
default-src 'self' *.mobilizecollections.com; frame-src https://*.cec-infrastructure.com https://*.constant.ai; script-src 'self' code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://* data:; child-src 'none';
last-modified
Wed, 29 May 2024 18:15:40 GMT
server
nginx
etag
"665770cc-1784f1"
x-frame-options
SAMEORIGIN
content-type
application/javascript
accept-ranges
bytes
content-length
1541361
x-xss-protection
1; mode=block
main.13bba001.css
mycommunitylendingaccount.com/static/css/
131 KB
132 KB
Stylesheet
General
Full URL
https://mycommunitylendingaccount.com/static/css/main.13bba001.css
Requested by
Host: mycommunitylendingaccount.com
URL: https://mycommunitylendingaccount.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.205.146.198 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-205-146-198.compute-1.amazonaws.com
Software
nginx /
Resource Hash
8fa6c7dc26d02d627e3dab4cf721b9784f03fd6bc20eae44a8ed3a9f2ebd766a
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.mobilizecollections.com; frame-src https://*.cec-infrastructure.com https://*.constant.ai; script-src 'self' code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://* data:; child-src 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://mycommunitylendingaccount.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 21 Aug 2024 16:50:58 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-security-policy
default-src 'self' *.mobilizecollections.com; frame-src https://*.cec-infrastructure.com https://*.constant.ai; script-src 'self' code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://* data:; child-src 'none';
last-modified
Wed, 29 May 2024 18:15:40 GMT
server
nginx
etag
"665770cc-20b14"
x-frame-options
SAMEORIGIN
content-type
text/css
accept-ranges
bytes
content-length
133908
x-xss-protection
1; mode=block
css
fonts.googleapis.com/
12 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Montserrat:100,200,300,400,500,600,700
Requested by
Host: mycommunitylendingaccount.com
URL: https://mycommunitylendingaccount.com/static/css/main.13bba001.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
126d8ae88beae6908925ecff3b97b5b897ff38b2cb89fa024cc2bf91f093b20f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://mycommunitylendingaccount.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 21 Aug 2024 16:50:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 21 Aug 2024 16:26:11 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 21 Aug 2024 16:50:59 GMT
get-background-image
communitylending.mobilizecollections.com/app/api/users/web/
0
0
Preflight
General
Full URL
https://communitylending.mobilizecollections.com/app/api/users/web/get-background-image
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.237.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a780f16b3e5d5a20e.awsglobalaccelerator.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
accesstoken
Access-Control-Request-Method
GET
Origin
https://mycommunitylendingaccount.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
accesstoken
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
0
cache-control
no-cache, private
date
Wed, 21 Aug 2024 16:51:01 GMT
server
nginx
vary
Access-Control-Request-Method, Access-Control-Request-Headers
get-client-details
communitylending.mobilizecollections.com/app/api/client/
0
0
Preflight
General
Full URL
https://communitylending.mobilizecollections.com/app/api/client/get-client-details?loan_no=undefined&lang=en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.237.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a780f16b3e5d5a20e.awsglobalaccelerator.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
accesstoken
Access-Control-Request-Method
GET
Origin
https://mycommunitylendingaccount.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
accesstoken
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
0
cache-control
no-cache, private
date
Wed, 21 Aug 2024 16:51:01 GMT
server
nginx
vary
Access-Control-Request-Method, Access-Control-Request-Headers
payment-frequencies
communitylending.mobilizecollections.com/app/api/client/
0
0
Preflight
General
Full URL
https://communitylending.mobilizecollections.com/app/api/client/payment-frequencies
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.237.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a780f16b3e5d5a20e.awsglobalaccelerator.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
accesstoken
Access-Control-Request-Method
GET
Origin
https://mycommunitylendingaccount.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
accesstoken
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
0
cache-control
no-cache, private
date
Wed, 21 Aug 2024 16:51:00 GMT
server
nginx
vary
Access-Control-Request-Method, Access-Control-Request-Headers
7281.026b26d8.chunk.js
mycommunitylendingaccount.com/static/js/
803 KB
804 KB
Script
General
Full URL
https://mycommunitylendingaccount.com/static/js/7281.026b26d8.chunk.js
Requested by
Host: mycommunitylendingaccount.com
URL: https://mycommunitylendingaccount.com/static/js/main.55907aa2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.205.146.198 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-205-146-198.compute-1.amazonaws.com
Software
nginx /
Resource Hash
5c8b350c8d4612ca1c2e32af7740bc10cf40a098f4b2dbfb7c345bd6d9fc57ec
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.mobilizecollections.com; frame-src https://*.cec-infrastructure.com https://*.constant.ai; script-src 'self' code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://* data:; child-src 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://mycommunitylendingaccount.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 21 Aug 2024 16:51:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-security-policy
default-src 'self' *.mobilizecollections.com; frame-src https://*.cec-infrastructure.com https://*.constant.ai; script-src 'self' code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://* data:; child-src 'none';
last-modified
Wed, 29 May 2024 18:15:40 GMT
server
nginx
etag
"665770cc-c8bcf"
x-frame-options
SAMEORIGIN
content-type
application/javascript
accept-ranges
bytes
content-length
822223
x-xss-protection
1; mode=block
get-background-image
communitylending.mobilizecollections.com/app/api/users/web/
209 B
958 B
XHR
General
Full URL
https://communitylending.mobilizecollections.com/app/api/users/web/get-background-image
Requested by
Host: mycommunitylendingaccount.com
URL: https://mycommunitylendingaccount.com/static/js/main.55907aa2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.237.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a780f16b3e5d5a20e.awsglobalaccelerator.com
Software
nginx /
Resource Hash
15cf01e78621fb8e0be49580815386f1b15029ea876580be4a8b58d2dd751fa5
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.mobilizecollections.com; script-src 'self' 'nonce-tpneqa195k' *.mobilizecollections.com code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://*; child-src 'none'; frame-ancestors 'self' ;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/plain, */*
accessToken
[object Object]
Referer
https://mycommunitylendingaccount.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 21 Aug 2024 16:51:01 GMT
content-security-policy
default-src 'self' *.mobilizecollections.com; script-src 'self' 'nonce-tpneqa195k' *.mobilizecollections.com code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://*; child-src 'none'; frame-ancestors 'self' ;
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
server
nginx
x-ratelimit-remaining
297
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, private
x-ratelimit-limit
300
x-xss-protection
1; mode=block
get-client-details
communitylending.mobilizecollections.com/app/api/client/
18 KB
19 KB
XHR
General
Full URL
https://communitylending.mobilizecollections.com/app/api/client/get-client-details?loan_no=undefined&lang=en
Requested by
Host: mycommunitylendingaccount.com
URL: https://mycommunitylendingaccount.com/static/js/main.55907aa2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.237.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a780f16b3e5d5a20e.awsglobalaccelerator.com
Software
nginx /
Resource Hash
caf2f401c22deaa774d522c2627dcc3060532c1825d942a0aadb280fe18b7e54
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.mobilizecollections.com; script-src 'self' 'nonce-mykxc7ti0l' *.mobilizecollections.com code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://*; child-src 'none'; frame-ancestors 'self' ;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/plain, */*
accessToken
[object Object]
Referer
https://mycommunitylendingaccount.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 21 Aug 2024 16:51:01 GMT
content-security-policy
default-src 'self' *.mobilizecollections.com; script-src 'self' 'nonce-mykxc7ti0l' *.mobilizecollections.com code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://*; child-src 'none'; frame-ancestors 'self' ;
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
server
nginx
x-ratelimit-remaining
296
x-frame-options
SAMEORIGIN
content-type
application/json
access-control-allow-origin
*
cache-control
no-cache, private
x-ratelimit-limit
300
x-xss-protection
1; mode=block
payment-frequencies
communitylending.mobilizecollections.com/app/api/client/
251 B
993 B
XHR
General
Full URL
https://communitylending.mobilizecollections.com/app/api/client/payment-frequencies
Requested by
Host: mycommunitylendingaccount.com
URL: https://mycommunitylendingaccount.com/static/js/main.55907aa2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.237.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a780f16b3e5d5a20e.awsglobalaccelerator.com
Software
nginx /
Resource Hash
bd818277d73a4158dfb7c36dbb2ba663bcc5b5ea7864d5b896cdf39bbb4e2519
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.mobilizecollections.com; script-src 'self' 'nonce-l34ih8fs29' *.mobilizecollections.com code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://*; child-src 'none'; frame-ancestors 'self' ;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/plain, */*
accessToken
[object Object]
Referer
https://mycommunitylendingaccount.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 21 Aug 2024 16:51:01 GMT
content-security-policy
default-src 'self' *.mobilizecollections.com; script-src 'self' 'nonce-l34ih8fs29' *.mobilizecollections.com code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://*; child-src 'none'; frame-ancestors 'self' ;
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
server
nginx
x-ratelimit-remaining
298
x-frame-options
SAMEORIGIN
content-type
application/json
access-control-allow-origin
*
cache-control
no-cache, private
x-ratelimit-limit
300
x-xss-protection
1; mode=block
white-labels
communitylending.mobilizecollections.com/app/api/client/
19 KB
20 KB
XHR
General
Full URL
https://communitylending.mobilizecollections.com/app/api/client/white-labels?lang=en
Requested by
Host: mycommunitylendingaccount.com
URL: https://mycommunitylendingaccount.com/static/js/main.55907aa2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.237.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a780f16b3e5d5a20e.awsglobalaccelerator.com
Software
nginx /
Resource Hash
6c1a93d1264cc6b5d8953dbc146141345d0bd949dc3d5ff62df7fcd0f30dfa25
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.mobilizecollections.com; script-src 'self' 'nonce-sq5lpft9r6' *.mobilizecollections.com code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://*; child-src 'none'; frame-ancestors 'self' ;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/plain, */*
accessToken
[object Object]
Referer
https://mycommunitylendingaccount.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 21 Aug 2024 16:51:01 GMT
content-security-policy
default-src 'self' *.mobilizecollections.com; script-src 'self' 'nonce-sq5lpft9r6' *.mobilizecollections.com code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://*; child-src 'none'; frame-ancestors 'self' ;
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
server
nginx
x-ratelimit-remaining
297
x-frame-options
SAMEORIGIN
content-type
application/json
access-control-allow-origin
*
cache-control
no-cache, private
x-ratelimit-limit
300
x-xss-protection
1; mode=block
white-labels
communitylending.mobilizecollections.com/app/api/client/
0
0
Preflight
General
Full URL
https://communitylending.mobilizecollections.com/app/api/client/white-labels?lang=en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.237.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a780f16b3e5d5a20e.awsglobalaccelerator.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
accesstoken
Access-Control-Request-Method
GET
Origin
https://mycommunitylendingaccount.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
accesstoken
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
0
cache-control
no-cache, private
date
Wed, 21 Aug 2024 16:51:01 GMT
server
nginx
vary
Access-Control-Request-Method, Access-Control-Request-Headers
GothamBook.771a8cef115be183abf0.woff2
mycommunitylendingaccount.com/static/media/
20 KB
20 KB
Font
General
Full URL
https://mycommunitylendingaccount.com/static/media/GothamBook.771a8cef115be183abf0.woff2
Requested by
Host: mycommunitylendingaccount.com
URL: https://mycommunitylendingaccount.com/static/css/main.13bba001.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.205.146.198 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-205-146-198.compute-1.amazonaws.com
Software
nginx /
Resource Hash
7187ab0fd55b3c7a04a8c055985ae3c533cb19c32bfb2380b4e747ff062a6610
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.mobilizecollections.com; frame-src https://*.cec-infrastructure.com https://*.constant.ai; script-src 'self' code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://* data:; child-src 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://mycommunitylendingaccount.com/static/css/main.13bba001.css
Origin
https://mycommunitylendingaccount.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 21 Aug 2024 16:51:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-security-policy
default-src 'self' *.mobilizecollections.com; frame-src https://*.cec-infrastructure.com https://*.constant.ai; script-src 'self' code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://* data:; child-src 'none';
last-modified
Wed, 29 May 2024 18:15:40 GMT
server
nginx
etag
"665770cc-4f6c"
x-frame-options
SAMEORIGIN
content-type
font/woff2
accept-ranges
bytes
content-length
20332
x-xss-protection
1; mode=block
fa-solid-900.802ad9928206725a2dd7.woff2
mycommunitylendingaccount.com/static/media/
49 KB
50 KB
Font
General
Full URL
https://mycommunitylendingaccount.com/static/media/fa-solid-900.802ad9928206725a2dd7.woff2
Requested by
Host: mycommunitylendingaccount.com
URL: https://mycommunitylendingaccount.com/static/css/main.13bba001.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.205.146.198 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-205-146-198.compute-1.amazonaws.com
Software
nginx /
Resource Hash
cbbca7d9888b4a9eab7d479756d2924f9b067fd38dab376797029df741f96ee4
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.mobilizecollections.com; frame-src https://*.cec-infrastructure.com https://*.constant.ai; script-src 'self' code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://* data:; child-src 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://mycommunitylendingaccount.com/static/css/main.13bba001.css
Origin
https://mycommunitylendingaccount.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 21 Aug 2024 16:51:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-security-policy
default-src 'self' *.mobilizecollections.com; frame-src https://*.cec-infrastructure.com https://*.constant.ai; script-src 'self' code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://* data:; child-src 'none';
last-modified
Wed, 29 May 2024 18:15:40 GMT
server
nginx
etag
"665770cc-c4c4"
x-frame-options
SAMEORIGIN
content-type
font/woff2
accept-ranges
bytes
content-length
50372
x-xss-protection
1; mode=block
GothamMedium.51b6f83d5e431cc2d5c5.woff2
mycommunitylendingaccount.com/static/media/
20 KB
20 KB
Font
General
Full URL
https://mycommunitylendingaccount.com/static/media/GothamMedium.51b6f83d5e431cc2d5c5.woff2
Requested by
Host: mycommunitylendingaccount.com
URL: https://mycommunitylendingaccount.com/static/css/main.13bba001.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.205.146.198 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-205-146-198.compute-1.amazonaws.com
Software
nginx /
Resource Hash
02e4d6c31b36cacbfe6267d4be26772766c4e295c19b7eb8c0ebb5b3d5ca4608
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.mobilizecollections.com; frame-src https://*.cec-infrastructure.com https://*.constant.ai; script-src 'self' code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://* data:; child-src 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://mycommunitylendingaccount.com/static/css/main.13bba001.css
Origin
https://mycommunitylendingaccount.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 21 Aug 2024 16:51:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-security-policy
default-src 'self' *.mobilizecollections.com; frame-src https://*.cec-infrastructure.com https://*.constant.ai; script-src 'self' code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://* data:; child-src 'none';
last-modified
Wed, 29 May 2024 18:15:40 GMT
server
nginx
etag
"665770cc-4e94"
x-frame-options
SAMEORIGIN
content-type
font/woff2
accept-ranges
bytes
content-length
20116
x-xss-protection
1; mode=block
GothamBold.e1c4caffdf143a92aa58.woff2
mycommunitylendingaccount.com/static/media/
19 KB
20 KB
Font
General
Full URL
https://mycommunitylendingaccount.com/static/media/GothamBold.e1c4caffdf143a92aa58.woff2
Requested by
Host: mycommunitylendingaccount.com
URL: https://mycommunitylendingaccount.com/static/css/main.13bba001.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.205.146.198 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-205-146-198.compute-1.amazonaws.com
Software
nginx /
Resource Hash
8afda0594174ac15b4eacee723c47798ed70385038509f25f972c15a9ded6a43
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.mobilizecollections.com; frame-src https://*.cec-infrastructure.com https://*.constant.ai; script-src 'self' code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://* data:; child-src 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://mycommunitylendingaccount.com/static/css/main.13bba001.css
Origin
https://mycommunitylendingaccount.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 21 Aug 2024 16:51:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-security-policy
default-src 'self' *.mobilizecollections.com; frame-src https://*.cec-infrastructure.com https://*.constant.ai; script-src 'self' code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://* data:; child-src 'none';
last-modified
Wed, 29 May 2024 18:15:40 GMT
server
nginx
etag
"665770cc-4d24"
x-frame-options
SAMEORIGIN
content-type
font/woff2
accept-ranges
bytes
content-length
19748
x-xss-protection
1; mode=block
FcuMlZ8JgeQLWOwEfXxrkIoc0DHHmY8NQWD9BLrO.ico
dev-payix-s3.s3.us-west-2.amazonaws.com/favicon/
Redirect Chain
  • https://communitylending.mobilizecollections.com/app/favicon
  • https://dev-payix-s3.s3.us-west-2.amazonaws.com/favicon/FcuMlZ8JgeQLWOwEfXxrkIoc0DHHmY8NQWD9BLrO.ico
11 KB
11 KB
Other
General
Full URL
https://dev-payix-s3.s3.us-west-2.amazonaws.com/favicon/FcuMlZ8JgeQLWOwEfXxrkIoc0DHHmY8NQWD9BLrO.ico
Protocol
HTTP/1.1
Server
3.5.84.112 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-us-west-2-r-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
a3b190e52e83441cdd9c145d8868e5c1b5103f2209620adc3f3665b916626ae2

Request headers

Referer
https://mycommunitylendingaccount.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Wed, 21 Aug 2024 16:51:03 GMT
x-amz-version-id
null
Last-Modified
Tue, 02 Aug 2022 21:41:32 GMT
Server
AmazonS3
x-amz-request-id
SKCAMTQ97E7AJKW8
ETag
"1d691567ef3800e8faa809e7130f4b86"
Content-Type
text/plain
Accept-Ranges
bytes
Content-Length
11342
x-amz-id-2
QVLqQCrp9Jf9B7huhZXmr/C2TxjempiC3J7LhTRF8/Hw4wk3SIYOgtDuCrN/y5eZJukv0yxrc/hUpXl+tElbAg==

Redirect headers

date
Wed, 21 Aug 2024 16:51:01 GMT
content-security-policy
default-src 'self' *.mobilizecollections.com; script-src 'self' 'nonce-bn7mw839rt' *.mobilizecollections.com code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://*; child-src 'none'; frame-ancestors 'self' ;
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
server
nginx
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
location
https://dev-payix-s3.s3.us-west-2.amazonaws.com/favicon/FcuMlZ8JgeQLWOwEfXxrkIoc0DHHmY8NQWD9BLrO.ico
access-control-allow-origin
*
cache-control
no-cache, private
x-xss-protection
1; mode=block
b1f9b6482adf8d9cd4a8708a01c74673.jpg
s3-us-west-2.amazonaws.com/dev-payix-s3/backgeround_image/
129 KB
130 KB
Image
General
Full URL
https://s3-us-west-2.amazonaws.com/dev-payix-s3/backgeround_image/b1f9b6482adf8d9cd4a8708a01c74673.jpg
Protocol
HTTP/1.1
Security
TLS 1.3, , CHACHA20_POLY1305
Server
52.92.211.32 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-us-west-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
43b17c4fc9c11abbd33de543ac3dbeb8cd9cf1c83728b5bb08b2d0ad0f0ac968

Request headers

Referer
https://mycommunitylendingaccount.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Wed, 21 Aug 2024 16:51:02 GMT
x-amz-version-id
es3YH3ZiZJA19fm2nUgMr8RdyrdtbPIs
Last-Modified
Mon, 19 Aug 2024 19:24:08 GMT
Server
AmazonS3
x-amz-request-id
X21WNA36K23B9FPB
ETag
"df13c9fdbc61a9272ff1b91ade317e51"
x-amz-server-side-encryption
AES256
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
132167
x-amz-id-2
Jz9RY6ed0YVHrEZIg9hQFu3AylTwy0ZrLk+P+Myg03hg6+IH5nXdUdpPfVkKvgJzOKQuWTBjMWo=
19b9d56ecd9093c2691d39366dc65555.jpg
s3-us-west-2.amazonaws.com/dev-payix-s3/client_image/
72 KB
72 KB
Image
General
Full URL
https://s3-us-west-2.amazonaws.com/dev-payix-s3/client_image/19b9d56ecd9093c2691d39366dc65555.jpg
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.92.211.32 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-us-west-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
495ffca767432180d5b24ee483d1621c71ba854522c0a641b8b54a9bb46158ca

Request headers

Referer
https://mycommunitylendingaccount.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Wed, 21 Aug 2024 16:51:03 GMT
x-amz-version-id
null
Last-Modified
Tue, 02 Aug 2022 21:40:37 GMT
Server
AmazonS3
x-amz-request-id
SKC587C9AFRS5YS3
ETag
"5b1ef38f5b485463ceda6c5902f7e7a7"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
73626
x-amz-id-2
65wBNuQeqnFy1zNfZnlysnbhF4c8NOLPGLQzIYd3gYzcWbrp3mTMEC8PDp3iZhrcUChPhxtM2eE=

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| webpackChunkborrower_react function| JSEncrypt object| regeneratorRuntime object| __core-js_shared__ function| _ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate boolean| _babelPolyfill function| axios object| __localeData__

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' *.mobilizecollections.com; frame-src https://*.cec-infrastructure.com https://*.constant.ai; script-src 'self' code.jquery.com *.amazonaws.com cdnjs.cloudflare.com; style-src 'self' *.mobilizecollections.com maxcdn.bootstrapcdn.com fonts.googleapis.com code.jquery.com; font-src 'self' maxcdn.bootstrapcdn.com fonts.gstatic.com fonts.googleapis.com; img-src 'self' *.mobilizecollections.com https://* data:; child-src 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block