Submitted URL: https://affadmin.nova88.net/
Effective URL: https://affadmin.nova88.net/Portal/Login?ReturnUrl=%2f
Submission: On May 30 via api from US — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 104.18.43.237, located in and belongs to CLOUDFLARENET, US. The main domain is affadmin.nova88.net.
TLS certificate: Issued by GTS CA 1P5 on May 30th 2024. Valid for: 3 months.
This is the only time affadmin.nova88.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 9 104.18.43.237 13335 (CLOUDFLAR...)
8 2
Apex Domain
Subdomains
Transfer
9 nova88.net
affadmin.nova88.net
587 KB
8 1
Domain Requested by
9 affadmin.nova88.net 1 redirects affadmin.nova88.net
8 1

This site contains no links.

Subject Issuer Validity Valid
affadmin.nova88.net
GTS CA 1P5
2024-05-30 -
2024-08-28
3 months crt.sh

This page contains 1 frames:

Primary Page: https://affadmin.nova88.net/Portal/Login?ReturnUrl=%2f
Frame ID: ED8FBB95FF178750FF2F5F52F7238632
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Affiliate Admin

Page URL History Show full URLs

  1. https://affadmin.nova88.net/ HTTP 302
    https://affadmin.nova88.net/Portal/Login?ReturnUrl=%2f Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • moment(?:\.min)?\.js

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

586 kB
Transfer

2153 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://affadmin.nova88.net/ HTTP 302
    https://affadmin.nova88.net/Portal/Login?ReturnUrl=%2f Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Login
affadmin.nova88.net/Portal/
Redirect Chain
  • https://affadmin.nova88.net/
  • https://affadmin.nova88.net/Portal/Login?ReturnUrl=%2f
1 KB
774 B
Document
General
Full URL
https://affadmin.nova88.net/Portal/Login?ReturnUrl=%2f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.43.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
da378fb00a0ac44182fc1ad7285cc27acdb6d00cdd8b8fbcdc458bea4fb74ae8
Security Headers
Name Value
Content-Security-Policy default-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' https://cdn.ravenjs.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; connect-src 'self' https://sentry.starific.net; object-src *
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
private
cf-cache-status
DYNAMIC
cf-ray
88c0dd9b3a28926b-FRA
content-encoding
gzip
content-security-policy
default-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' https://cdn.ravenjs.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; connect-src 'self' https://sentry.starific.net; object-src *
content-type
text/html; charset=utf-8
date
Thu, 30 May 2024 18:42:43 GMT
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN SAMEORIGIN
x-xss-protection
1; mode=block

Redirect headers

cache-control
private
cf-cache-status
DYNAMIC
cf-ray
88c0dd98ff3d926b-FRA
content-security-policy
default-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' https://cdn.ravenjs.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; connect-src 'self' https://sentry.starific.net; object-src *
content-type
text/html; charset=utf-8
date
Thu, 30 May 2024 18:42:43 GMT
location
/Portal/Login?ReturnUrl=%2f
server
cloudflare
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
bootstrap.css
affadmin.nova88.net/Areas/Portal/www/dist/vendors/
151 KB
35 KB
Stylesheet
General
Full URL
https://affadmin.nova88.net/Areas/Portal/www/dist/vendors/bootstrap.css?v=4.3.1
Requested by
Host: affadmin.nova88.net
URL: https://affadmin.nova88.net/Portal/Login?ReturnUrl=%2f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.43.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5961cd9081f3ed94fa899c09e56b901376bb9f5151ff07ef3ed4b5602d16db8e
Security Headers
Name Value
Content-Security-Policy default-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' https://cdn.ravenjs.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; connect-src 'self' https://sentry.starific.net; object-src *
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://affadmin.nova88.net/Portal/Login?ReturnUrl=%2f
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 30 May 2024 18:42:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' https://cdn.ravenjs.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; connect-src 'self' https://sentry.starific.net; object-src *
last-modified
Wed, 26 Feb 2020 08:19:03 GMT
server
cloudflare
cf-cache-status
MISS
etag
"d0fe24687decd51:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
accept-ranges
bytes
cf-ray
88c0dd9d7d44926b-FRA
content-length
35542
x-xss-protection
1; mode=block
login.css
affadmin.nova88.net/Areas/Portal/www/dist/style/
4 KB
3 KB
Stylesheet
General
Full URL
https://affadmin.nova88.net/Areas/Portal/www/dist/style/login.css?v=203756v001
Requested by
Host: affadmin.nova88.net
URL: https://affadmin.nova88.net/Portal/Login?ReturnUrl=%2f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.43.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aff8d1790731a1ca2e8ab70d319e81818e837590bfab99fb8e1cd64604dbc0b1
Security Headers
Name Value
Content-Security-Policy default-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' https://cdn.ravenjs.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; connect-src 'self' https://sentry.starific.net; object-src *
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://affadmin.nova88.net/Portal/Login?ReturnUrl=%2f
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 30 May 2024 18:42:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' https://cdn.ravenjs.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; connect-src 'self' https://sentry.starific.net; object-src *
last-modified
Mon, 11 May 2020 06:47:14 GMT
server
cloudflare
cf-cache-status
MISS
etag
"19c17716027d61:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
accept-ranges
bytes
cf-ray
88c0dd9d7d45926b-FRA
content-length
2636
x-xss-protection
1; mode=block
react.js
affadmin.nova88.net/Areas/Portal/www/dist/vendors/
2 MB
473 KB
Script
General
Full URL
https://affadmin.nova88.net/Areas/Portal/www/dist/vendors/react.js?v=20190424
Requested by
Host: affadmin.nova88.net
URL: https://affadmin.nova88.net/Portal/Login?ReturnUrl=%2f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.43.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a105f0fdaede7ee6e1a841d792b035add9244410bb6ca4cbccd1bf47fb218d47
Security Headers
Name Value
Content-Security-Policy default-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' https://cdn.ravenjs.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; connect-src 'self' https://sentry.starific.net; object-src *
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://affadmin.nova88.net/Portal/Login?ReturnUrl=%2f
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 30 May 2024 18:42:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' https://cdn.ravenjs.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; connect-src 'self' https://sentry.starific.net; object-src *
last-modified
Tue, 20 Jun 2023 06:36:52 GMT
server
cloudflare
cf-cache-status
MISS
etag
"c5f9679941a3d91:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
cf-ray
88c0dd9d7d46926b-FRA
x-xss-protection
1; mode=block
moment.js
affadmin.nova88.net/Areas/Portal/www/dist/vendors/
158 KB
46 KB
Script
General
Full URL
https://affadmin.nova88.net/Areas/Portal/www/dist/vendors/moment.js?v=20190424
Requested by
Host: affadmin.nova88.net
URL: https://affadmin.nova88.net/Portal/Login?ReturnUrl=%2f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.43.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7dcfef2923d9f9f1bad83a49beea96dbe65535281046a8399dd04fd5c0cc69c9
Security Headers
Name Value
Content-Security-Policy default-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' https://cdn.ravenjs.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; connect-src 'self' https://sentry.starific.net; object-src *
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://affadmin.nova88.net/Portal/Login?ReturnUrl=%2f
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 30 May 2024 18:42:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' https://cdn.ravenjs.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; connect-src 'self' https://sentry.starific.net; object-src *
last-modified
Tue, 20 Jun 2023 06:36:52 GMT
server
cloudflare
cf-cache-status
MISS
etag
"625669941a3d91:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
accept-ranges
bytes
cf-ray
88c0dd9d7d47926b-FRA
content-length
47190
x-xss-protection
1; mode=block
login.js
affadmin.nova88.net/Areas/Portal/www/dist/js/pages/
65 KB
27 KB
Script
General
Full URL
https://affadmin.nova88.net/Areas/Portal/www/dist/js/pages/login.js?v=203756v001
Requested by
Host: affadmin.nova88.net
URL: https://affadmin.nova88.net/Portal/Login?ReturnUrl=%2f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.43.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fffea13ae78d17c03a4384edd03376bd61270e35865f920d4aa6b71fb4db0f11
Security Headers
Name Value
Content-Security-Policy default-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' https://cdn.ravenjs.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; connect-src 'self' https://sentry.starific.net; object-src *
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://affadmin.nova88.net/Portal/Login?ReturnUrl=%2f
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 30 May 2024 18:42:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' https://cdn.ravenjs.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; connect-src 'self' https://sentry.starific.net; object-src *
last-modified
Wed, 29 May 2024 03:05:25 GMT
server
cloudflare
cf-cache-status
MISS
etag
"41ed53d75b1da1:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
accept-ranges
bytes
cf-ray
88c0dd9d7d49926b-FRA
content-length
27965
x-xss-protection
1; mode=block
N88-lightmode.css
affadmin.nova88.net/Areas/Portal/www/dist/style/
250 B
402 B
Stylesheet
General
Full URL
https://affadmin.nova88.net/Areas/Portal/www/dist/style/N88-lightmode.css
Requested by
Host: affadmin.nova88.net
URL: https://affadmin.nova88.net/Areas/Portal/www/dist/js/pages/login.js?v=203756v001
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.43.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e13a1dc77f39a35609d78e63055a41d9dcfac61f21bdd6e822238d27648a40f4
Security Headers
Name Value
Content-Security-Policy default-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' https://cdn.ravenjs.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; connect-src 'self' https://sentry.starific.net; object-src *
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://affadmin.nova88.net/Portal/Login?ReturnUrl=%2f
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 30 May 2024 18:42:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' https://cdn.ravenjs.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; connect-src 'self' https://sentry.starific.net; object-src *
last-modified
Wed, 06 May 2020 04:23:58 GMT
server
cloudflare
cf-cache-status
MISS
etag
"b493aa295e23d61:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
accept-ranges
bytes
cf-ray
88c0dda5eece926b-FRA
content-length
275
x-xss-protection
1; mode=block
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a3c68142b03df8ec1b676edd8f42d42dfb6c9e78dd063877a02d3c3ba0c736ec

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
favicon-N88.ico
affadmin.nova88.net/
636 B
772 B
Other
General
Full URL
https://affadmin.nova88.net/favicon-N88.ico?v=203756v001
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.43.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2930c9aab877673bf14b6a91392c3a7365de53b69065ed7002d7cdc3ca72a568
Security Headers
Name Value
Content-Security-Policy default-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' https://cdn.ravenjs.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; connect-src 'self' https://sentry.starific.net; object-src *
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://affadmin.nova88.net/Portal/Login?ReturnUrl=%2f
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 30 May 2024 18:42:45 GMT
content-security-policy
default-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' https://cdn.ravenjs.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; connect-src 'self' https://sentry.starific.net; object-src *
x-content-type-options
nosniff
cf-cache-status
MISS
last-modified
Fri, 05 Jun 2020 02:13:41 GMT
server
cloudflare
content-encoding
gzip
etag
W/"18d8beede3ad61:0"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
image/x-icon
cf-ray
88c0dda7c8fa926b-FRA
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| react_6eaedd8de8ef8ace45b0 function| moment_6eaedd8de8ef8ace45b0 object| initialState object| regeneratorRuntime

5 Cookies

Domain/Path Name / Value
affadmin.nova88.net/ Name: TbtNpCD33ifIBgVKt1LniX+bS-sR+Y9FT46S6NU_
Value: v1xaIqgw__6As
affadmin.nova88.net/ Name: SERVERID
Value: pl836w
.affadmin.nova88.net/ Name: __cf_bm
Value: 7guNVccm.D47CrRZ0Kno6HJdMdGxdq.J3IUePeOuCuQ-1717094563-1.0.1.1-KxOsZ19PQNn_LOQhfIHbmIRBnbYhMDY_xt.FHra5LzKSH2fLRUSBfNOPDjSwBokQ84euuRA5kROHflbh8Ha9qQ
affadmin.nova88.net/ Name: __RequestVerificationToken
Value: m_Ugz6junLHP5BqZOOHJWxfCgComx1rEPDaCVGGcrMDePLwsAtXUq_hrE9kuQnJIPJBmiw4JYqt79M2rhhHjSaAfW_w1
affadmin.nova88.net/ Name: mode
Value: lightmode

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' https://cdn.ravenjs.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; connect-src 'self' https://sentry.starific.net; object-src *
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN SAMEORIGIN
X-Xss-Protection 1; mode=block