urlscan.io logo urlscan.io
SecurityTrails logo

login.stage.contactify.app Open in urlscan Pro
20.208.5.32  Public Scan

Go To Rescan Add Verdict Report
URL: https://login.stage.contactify.app/
Submission: On December 27 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 20.208.5.32, located in Zurich, Switzerland and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is login.stage.contactify.app.
TLS certificate: Issued by GeoTrust Global TLS RSA4096 SHA256 20... on December 27th 2023. Valid for: 6 months.
This is the only time login.stage.contactify.app was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
5 20.208.5.32 8075 (MICROSOFT...)
1 2620:1ec:46::40 8075 (MICROSOFT...)
2 51.107.48.68 8075 (MICROSOFT...)
8 3
Apex Domain
Subdomains		 Transfer
5 contactify.app
login.stage.contactify.app
66 KB
3 azure.com
js.monitor.azure.com — Cisco Umbrella Rank: 1582
switzerlandnorth-0.in.applicationinsights.azure.com
57 KB
8 2
Domain Requested by
5 login.stage.contactify.app login.stage.contactify.app
2 switzerlandnorth-0.in.applicationinsights.azure.com js.monitor.azure.com
1 js.monitor.azure.com login.stage.contactify.app
8 3

This site contains no links.

Subject Issuer Validity Valid
login.stage.contactify.app
GeoTrust Global TLS RSA4096 SHA256 2022 CA1		 2023-12-27 -
2024-06-27		 6 months crt.sh
js.monitor.azure.com
Microsoft Azure RSA TLS Issuing CA 03		 2023-12-19 -
2024-12-13		 a year crt.sh
prod.ai.ingestion.msftcloudes.com
Microsoft Azure RSA TLS Issuing CA 03		 2023-11-19 -
2024-11-13		 a year crt.sh

This page contains 1 frames:

Primary Page: https://login.stage.contactify.app/
Frame ID: 76D52AA1378BA570AE4AD04F31DE3B5A
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Contactify - Login

Page Statistics

8
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

123 kB
Transfer

202 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
login.stage.contactify.app/ 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://login.stage.contactify.app/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.208.5.32 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
8e609661f92fbea0522faa14baa0c53359a62881f5ec13b1ca7e570be5d37e1c
Security Headers
Name Value
Content-Security-Policy default-src 'self'; font-src 'self'; connect-src 'self' https://*.applicationinsights.azure.com https://*.livediagnostics.monitor.azure.com; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' https://js.monitor.azure.com/scripts/b/ai.2.min.js; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; form-action 'self'; frame-ancestors https: http://localhost:*; frame-src 'none'; upgrade-insecure-requests; media-src 'self' blob: data:; manifest-src 'none'; worker-src 'none'; object-src 'none'; child-src 'self'; base-uri 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version
access-control-allow-methods
GET
access-control-allow-origin
*
content-encoding
gzip
content-security-policy
default-src 'self'; font-src 'self'; connect-src 'self' https://*.applicationinsights.azure.com https://*.livediagnostics.monitor.azure.com; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' https://js.monitor.azure.com/scripts/b/ai.2.min.js; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; form-action 'self'; frame-ancestors https: http://localhost:*; frame-src 'none'; upgrade-insecure-requests; media-src 'self' blob: data:; manifest-src 'none'; worker-src 'none'; object-src 'none'; child-src 'self'; base-uri 'self';
content-type
text/html
date
Wed, 27 Dec 2023 15:53:16 GMT
etag
W/"65858e01-cdd"
last-modified
Fri, 22 Dec 2023 13:24:17 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-frame-options
DENY
x-xss-protection
1; mode=block
styles.css
login.stage.contactify.app/ 		1006 B
554 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login.stage.contactify.app/styles.css
Requested by
Host: login.stage.contactify.app
URL: https://login.stage.contactify.app/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.208.5.32 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e0eb8a35f71c1089783dcaa3d0126217f8d4c8641e52d3fb784f753169ec677b
Security Headers
Name Value
Content-Security-Policy default-src 'self'; font-src 'self'; connect-src 'self' https://*.applicationinsights.azure.com https://*.livediagnostics.monitor.azure.com; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' https://js.monitor.azure.com/scripts/b/ai.2.min.js; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; form-action 'self'; frame-ancestors https: http://localhost:*; frame-src 'none'; upgrade-insecure-requests; media-src 'self' blob: data:; manifest-src 'none'; worker-src 'none'; object-src 'none'; child-src 'self'; base-uri 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://login.stage.contactify.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 27 Dec 2023 15:53:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Fri, 22 Dec 2023 13:24:17 GMT
server
nginx
content-security-policy
default-src 'self'; font-src 'self'; connect-src 'self' https://*.applicationinsights.azure.com https://*.livediagnostics.monitor.azure.com; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' https://js.monitor.azure.com/scripts/b/ai.2.min.js; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; form-action 'self'; frame-ancestors https: http://localhost:*; frame-src 'none'; upgrade-insecure-requests; media-src 'self' blob: data:; manifest-src 'none'; worker-src 'none'; object-src 'none'; child-src 'self'; base-uri 'self';
etag
W/"65858e01-3ee"
x-frame-options
DENY
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version
x-xss-protection
1; mode=block
app-insights.js
login.stage.contactify.app/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://login.stage.contactify.app/app-insights.js
Requested by
Host: login.stage.contactify.app
URL: https://login.stage.contactify.app/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.208.5.32 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
1051e90b79d83829467bad6b0dd6734f2aff2d6ea9ce2ad42020ee4fe7ef5c0d
Security Headers
Name Value
Content-Security-Policy default-src 'self'; font-src 'self'; connect-src 'self' https://*.applicationinsights.azure.com https://*.livediagnostics.monitor.azure.com; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' https://js.monitor.azure.com/scripts/b/ai.2.min.js; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; form-action 'self'; frame-ancestors https: http://localhost:*; frame-src 'none'; upgrade-insecure-requests; media-src 'self' blob: data:; manifest-src 'none'; worker-src 'none'; object-src 'none'; child-src 'self'; base-uri 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://login.stage.contactify.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 27 Dec 2023 15:53:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Fri, 22 Dec 2023 13:24:17 GMT
server
nginx
content-security-policy
default-src 'self'; font-src 'self'; connect-src 'self' https://*.applicationinsights.azure.com https://*.livediagnostics.monitor.azure.com; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' https://js.monitor.azure.com/scripts/b/ai.2.min.js; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; form-action 'self'; frame-ancestors https: http://localhost:*; frame-src 'none'; upgrade-insecure-requests; media-src 'self' blob: data:; manifest-src 'none'; worker-src 'none'; object-src 'none'; child-src 'self'; base-uri 'self';
etag
W/"65858e01-3a51"
x-frame-options
DENY
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version
x-xss-protection
1; mode=block
ai.2.min.js
js.monitor.azure.com/scripts/b/ 		120 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.monitor.azure.com/scripts/b/ai.2.min.js
Requested by
Host: login.stage.contactify.app
URL: https://login.stage.contactify.app/app-insights.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:46::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
6c14d731b13bcdec4325028eb0d8d2cb0190b3b1e65e0fcb52907fe6f55c2707

Request headers

Referer
https://login.stage.contactify.app/
Origin
https://login.stage.contactify.app
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 27 Dec 2023 15:53:16 GMT
content-encoding
br
last-modified
Wed, 20 Sep 2023 16:12:29 GMT
x-ms-meta-aijssdkver
2.8.16
vary
Accept-Encoding
x-azure-ref
20231227T155316Z-gd0hgr6ke97bp4t335bkr4hnu4000000039g000000009z8u
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
x-ms-request-id
d5b0d614-301e-00ad-637b-3681f6000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,x-ms-meta-aijssdksrc,x-ms-meta-aijssdkver,x-ms-meta-lastmodified,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=1800, immutable, no-transform
x-cache
TCP_HIT
x-ms-version
2009-09-19
x-ms-meta-aijssdksrc
[cdn]/scripts/b/ai.2.8.16.min.js
track
switzerlandnorth-0.in.applicationinsights.azure.com//v2/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://switzerlandnorth-0.in.applicationinsights.azure.com//v2/track
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.107.48.68 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://login.stage.contactify.app
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-headers
Origin,X-Requested-With,Content-Name,Content-Type,Accept,Cache-Control,Sdk-Context
access-control-allow-methods
POST
access-control-allow-origin
*
access-control-max-age
3600
date
Wed, 27 Dec 2023 15:53:16 GMT
server
Microsoft-HTTPAPI/2.0
strict-transport-security
max-age=31536000
track
switzerlandnorth-0.in.applicationinsights.azure.com//v2/ 		255 B
364 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://switzerlandnorth-0.in.applicationinsights.azure.com//v2/track
Requested by
Host: js.monitor.azure.com
URL: https://js.monitor.azure.com/scripts/b/ai.2.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.107.48.68 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 /
Resource Hash
59572c6bb12b52e4bebb9dd39214dc02b89695d5dd63d288b8b062652195b78b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://login.stage.contactify.app/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-type
application/json

Response headers

access-control-allow-origin
*
strict-transport-security
max-age=31536000
date
Wed, 27 Dec 2023 15:53:17 GMT
x-content-type-options
nosniff
server
Microsoft-HTTPAPI/2.0
content-length
255
content-type
application/json; charset=utf-8
contactify_logo_color.svg
login.stage.contactify.app/assets/images/ 		8 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.stage.contactify.app/assets/images/contactify_logo_color.svg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.208.5.32 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
79e6e0ae2bdb830cc0957b6b43559aa10fc10e7ad05a7e148ff96d70b88b3ec7
Security Headers
Name Value
Content-Security-Policy default-src 'self'; font-src 'self'; connect-src 'self' https://*.applicationinsights.azure.com https://*.livediagnostics.monitor.azure.com; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' https://js.monitor.azure.com/scripts/b/ai.2.min.js; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; form-action 'self'; frame-ancestors https: http://localhost:*; frame-src 'none'; upgrade-insecure-requests; media-src 'self' blob: data:; manifest-src 'none'; worker-src 'none'; object-src 'none'; child-src 'self'; base-uri 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://login.stage.contactify.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 27 Dec 2023 15:53:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Fri, 22 Dec 2023 13:24:17 GMT
server
nginx
content-security-policy
default-src 'self'; font-src 'self'; connect-src 'self' https://*.applicationinsights.azure.com https://*.livediagnostics.monitor.azure.com; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' https://js.monitor.azure.com/scripts/b/ai.2.min.js; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; form-action 'self'; frame-ancestors https: http://localhost:*; frame-src 'none'; upgrade-insecure-requests; media-src 'self' blob: data:; manifest-src 'none'; worker-src 'none'; object-src 'none'; child-src 'self'; base-uri 'self';
etag
W/"65858e01-2057"
x-frame-options
DENY
access-control-allow-methods
GET
content-type
image/svg+xml
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version
x-xss-protection
1; mode=block
Moderat-Medium.woff2
login.stage.contactify.app/assets/fonts/ 		55 KB
55 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://login.stage.contactify.app/assets/fonts/Moderat-Medium.woff2
Requested by
Host: login.stage.contactify.app
URL: https://login.stage.contactify.app/styles.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.208.5.32 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
91e9b71a482ff792d7b93aff997c3b8962e3b2c50acc4b6fee140a317655c40c
Security Headers
Name Value
Content-Security-Policy default-src 'self'; font-src 'self'; connect-src 'self' https://*.applicationinsights.azure.com https://*.livediagnostics.monitor.azure.com; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' https://js.monitor.azure.com/scripts/b/ai.2.min.js; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; form-action 'self'; frame-ancestors https: http://localhost:*; frame-src 'none'; upgrade-insecure-requests; media-src 'self' blob: data:; manifest-src 'none'; worker-src 'none'; object-src 'none'; child-src 'self'; base-uri 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://login.stage.contactify.app/styles.css
Origin
https://login.stage.contactify.app
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 27 Dec 2023 15:53:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Fri, 22 Dec 2023 13:24:17 GMT
server
nginx
content-security-policy
default-src 'self'; font-src 'self'; connect-src 'self' https://*.applicationinsights.azure.com https://*.livediagnostics.monitor.azure.com; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' https://js.monitor.azure.com/scripts/b/ai.2.min.js; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; form-action 'self'; frame-ancestors https: http://localhost:*; frame-src 'none'; upgrade-insecure-requests; media-src 'self' blob: data:; manifest-src 'none'; worker-src 'none'; object-src 'none'; child-src 'self'; base-uri 'self';
etag
W/"65858e01-da8c"
x-frame-options
DENY
access-control-allow-methods
GET
content-type
font/woff2
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| getStateString function| handleRedirectPromise function| displayAppropriateButton function| showContent function| goToLogin function| openHelpCenterUrl string| appInsightsSDK object| appInsights object| Microsoft object| __dynProto$Gbl

2 Cookies

Domain/Path Name / Value
login.stage.contactify.app/ Name: ai_user
Value: yQWEFAd2hpUYQ04AZ1cGaZ|2023-12-27T15:53:16.729Z
login.stage.contactify.app/ Name: ai_session
Value: oYXMn0e3yOwgM0luq2WGya|1703692396733|1703692396733

1 Console Messages

Source Level URL
Text
network error URL: https://switzerlandnorth-0.in.applicationinsights.azure.com//v2/track
Message:
Failed to load resource: the server responded with a status of 400 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; font-src 'self'; connect-src 'self' https://*.applicationinsights.azure.com https://*.livediagnostics.monitor.azure.com; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' https://js.monitor.azure.com/scripts/b/ai.2.min.js; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; form-action 'self'; frame-ancestors https: http://localhost:*; frame-src 'none'; upgrade-insecure-requests; media-src 'self' blob: data:; manifest-src 'none'; worker-src 'none'; object-src 'none'; child-src 'self'; base-uri 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block