urlscan.io logo urlscan.io
SecurityTrails logo

bank.test-benefitpay.bh Open in urlscan Pro
79.171.240.82  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://bank.test-benefitpay.bh/
Effective URL: https://bank.test-benefitpay.bh/auth/login?url=home
Submission: On October 15 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 79.171.240.82, located in Bahrain and belongs to BENEFIT, BH. The main domain is bank.test-benefitpay.bh.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on June 8th 2022. Valid for: a year.
This is the only time bank.test-benefitpay.bh was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 16 79.171.240.82 30882 (BENEFIT)
14 1
Apex Domain
Subdomains		 Transfer
16 test-benefitpay.bh
bank.test-benefitpay.bh
www.test-benefitpay.bh
217 KB
14 1
Domain Requested by
15 bank.test-benefitpay.bh 2 redirects bank.test-benefitpay.bh
1 www.test-benefitpay.bh bank.test-benefitpay.bh
14 2

This site contains no links.

Subject Issuer Validity Valid
*.test-benefitpay.bh
Go Daddy Secure Certificate Authority - G2		 2022-06-08 -
2023-06-06		 a year crt.sh
test-benefitpay.bh
Go Daddy Secure Certificate Authority - G2		 2022-06-09 -
2023-06-07		 a year crt.sh

This page contains 1 frames:

Primary Page: https://bank.test-benefitpay.bh/auth/login?url=home
Frame ID: 10800D15166071783AC9ADFA6958280F
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

BENEFIT

Page URL History Show full URLs

  1. https://bank.test-benefitpay.bh/ HTTP 302
    https://bank.test-benefitpay.bh/home HTTP 302
    https://bank.test-benefitpay.bh/auth/login?url=home Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

1
IPs

1
Countries

212 kB
Transfer

905 kB
Size

9
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://bank.test-benefitpay.bh/ HTTP 302
    https://bank.test-benefitpay.bh/home HTTP 302
    https://bank.test-benefitpay.bh/auth/login?url=home Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login
bank.test-benefitpay.bh/auth/
Redirect Chain
  • https://bank.test-benefitpay.bh/
  • https://bank.test-benefitpay.bh/home
  • https://bank.test-benefitpay.bh/auth/login?url=home
8 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bank.test-benefitpay.bh/auth/login?url=home
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
79.171.240.82 , Bahrain, ASN30882 (BENEFIT, BH),
Reverse DNS
Software
/
Resource Hash
884014f9b61b132ef68bf9eb4a69acb5565a251e5e90da685465a8ae58f69e23
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000 max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
2021
Content-Security-Policy
default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Content-Type
text/html; charset=UTF-8
Date
Sat, 15 Oct 2022 16:37:28 GMT
HTTP_HOST
acquirer.test-benefitpay.bh
Keep-Alive
timeout=5, max=98
Referrer-Policy
no-referrer-when-downgrade
Strict-Transport-Security
max-age=31536000 max-age=31536000
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-Frame-Options
DENY
X-XSS-Protection
1

Redirect headers

Connection
Keep-Alive
Content-Length
448
Content-Security-Policy
default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Content-Type
text/html; charset=UTF-8
Date
Sat, 15 Oct 2022 16:37:28 GMT
HTTP_HOST
acquirer.test-benefitpay.bh
Keep-Alive
timeout=5, max=99
Location
https://bank.test-benefitpay.bh/auth/login?url=home
Referrer-Policy
no-referrer-when-downgrade
Strict-Transport-Security
max-age=31536000 max-age=31536000
X-Content-Type-Options
nosniff
X-Frame-Options
DENY
X-XSS-Protection
1
font-awesome.min.css
bank.test-benefitpay.bh/assets/fooAssets/loginAssets/font-awesome/css/ 		26 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bank.test-benefitpay.bh/assets/fooAssets/loginAssets/font-awesome/css/font-awesome.min.css
Requested by
Host: bank.test-benefitpay.bh
URL: https://bank.test-benefitpay.bh/auth/login?url=home
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
79.171.240.82 , Bahrain, ASN30882 (BENEFIT, BH),
Reverse DNS
Software
/
Resource Hash
768686e989a8f39ac9cf934d0c967d218feef8319e8cd4b73ad5dc38631a2451
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000, max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bank.test-benefitpay.bh/auth/login?url=home
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Sat, 15 Oct 2022 16:37:29 GMT
Strict-Transport-Security
max-age=31536000, max-age=31536000
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Connection
Keep-Alive
Content-Length
6086
X-XSS-Protection
1
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Wed, 11 Mar 2020 14:34:58 GMT
HTTP_HOST
acquirer.test-benefitpay.bh
Vary
Accept-Encoding
X-Frame-Options
DENY
Content-Type
text/css
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
bootstrap.min.css
bank.test-benefitpay.bh/assets/fooAssets/plugins/bootstrap/css/ 		119 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bank.test-benefitpay.bh/assets/fooAssets/plugins/bootstrap/css/bootstrap.min.css
Requested by
Host: bank.test-benefitpay.bh
URL: https://bank.test-benefitpay.bh/auth/login?url=home
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
79.171.240.82 , Bahrain, ASN30882 (BENEFIT, BH),
Reverse DNS
Software
/
Resource Hash
6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000, max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bank.test-benefitpay.bh/auth/login?url=home
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Sat, 15 Oct 2022 16:37:29 GMT
Strict-Transport-Security
max-age=31536000, max-age=31536000
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Connection
Keep-Alive
Content-Length
19741
X-XSS-Protection
1
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Wed, 17 Feb 2021 07:47:57 GMT
HTTP_HOST
acquirer.test-benefitpay.bh
Vary
Accept-Encoding
X-Frame-Options
DENY
Content-Type
text/css
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
components.min.css
bank.test-benefitpay.bh/assets/fooAssets/loginAssets/css/ 		524 KB
61 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bank.test-benefitpay.bh/assets/fooAssets/loginAssets/css/components.min.css
Requested by
Host: bank.test-benefitpay.bh
URL: https://bank.test-benefitpay.bh/auth/login?url=home
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
79.171.240.82 , Bahrain, ASN30882 (BENEFIT, BH),
Reverse DNS
Software
/
Resource Hash
3460062916560837c84188632afa4dc292ec1cbd7d94756789c0034204ade906
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000, max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bank.test-benefitpay.bh/auth/login?url=home
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Sat, 15 Oct 2022 16:37:29 GMT
Strict-Transport-Security
max-age=31536000, max-age=31536000
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Transfer-Encoding
chunked
Connection
Keep-Alive
X-XSS-Protection
1
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Wed, 11 Mar 2020 14:34:58 GMT
HTTP_HOST
acquirer.test-benefitpay.bh
Vary
Accept-Encoding
X-Frame-Options
DENY
Content-Type
text/css
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
uniform.default.css
bank.test-benefitpay.bh/assets/fooAssets/plugins/uniform/css/ 		11 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bank.test-benefitpay.bh/assets/fooAssets/plugins/uniform/css/uniform.default.css
Requested by
Host: bank.test-benefitpay.bh
URL: https://bank.test-benefitpay.bh/auth/login?url=home
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
79.171.240.82 , Bahrain, ASN30882 (BENEFIT, BH),
Reverse DNS
Software
/
Resource Hash
1d6c681f15750c1eb14c4f76d9adb7c7b51f18c64f8a8ecd5df5073df4d4812b
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000, max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bank.test-benefitpay.bh/auth/login?url=home
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Sat, 15 Oct 2022 16:37:29 GMT
Strict-Transport-Security
max-age=31536000, max-age=31536000
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Connection
Keep-Alive
Content-Length
2250
X-XSS-Protection
1
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Wed, 11 Mar 2020 14:34:58 GMT
HTTP_HOST
acquirer.test-benefitpay.bh
Vary
Accept-Encoding
X-Frame-Options
DENY
Content-Type
text/css
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
login-4.min.css
bank.test-benefitpay.bh/assets/bankAssets/css/ 		3 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bank.test-benefitpay.bh/assets/bankAssets/css/login-4.min.css
Requested by
Host: bank.test-benefitpay.bh
URL: https://bank.test-benefitpay.bh/auth/login?url=home
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
79.171.240.82 , Bahrain, ASN30882 (BENEFIT, BH),
Reverse DNS
Software
/
Resource Hash
83c20a06605ecb827e5378173418d967ff65ca9e0abb8b1d4fc7d4ccb9b82382
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000, max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bank.test-benefitpay.bh/auth/login?url=home
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Sat, 15 Oct 2022 16:37:29 GMT
Strict-Transport-Security
max-age=31536000, max-age=31536000
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Connection
Keep-Alive
Content-Length
974
X-XSS-Protection
1
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Wed, 11 Mar 2020 14:34:58 GMT
HTTP_HOST
acquirer.test-benefitpay.bh
Vary
Accept-Encoding
X-Frame-Options
DENY
Content-Type
text/css
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
image
www.test-benefitpay.bh/app/web/v1/media/ 		18 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.test-benefitpay.bh/app/web/v1/media/image?name=benefitpay-logo_1.png
Requested by
Host: bank.test-benefitpay.bh
URL: https://bank.test-benefitpay.bh/auth/login?url=home
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
79.171.240.82 , Bahrain, ASN30882 (BENEFIT, BH),
Reverse DNS
Software
/
Resource Hash
0b079473799ac8d3fa548c1bcf32c59a2a83218b901e91f11f041f36c7412859
Security Headers
Name Value
Content-Security-Policy default-src 'self' https:; img-src data:*; script-src 'unsafe-inline' 'unsafe-eval' https:; style-src 'unsafe-inline' https:;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bank.test-benefitpay.bh/auth/login?url=home
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 15 Oct 2022 16:37:29 GMT
Strict-Transport-Security
max-age=31536000
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src 'self' https:; img-src data:*; script-src 'unsafe-inline' 'unsafe-eval' https:; style-src 'unsafe-inline' https:;
HTTP_HOST
acquirer.test-benefitpay.bh
Referrer-Policy
no-referrer-when-downgrade
X-Frame-Options
DENY
Transfer-Encoding
chunked
Content-Type
image/png
Cache-Control
no-store
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
X-XSS-Protection
1
jquery.js
bank.test-benefitpay.bh/assets/fooAssets/plugins/jquery/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bank.test-benefitpay.bh/assets/fooAssets/plugins/jquery/jquery.js
Requested by
Host: bank.test-benefitpay.bh
URL: https://bank.test-benefitpay.bh/auth/login?url=home
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
79.171.240.82 , Bahrain, ASN30882 (BENEFIT, BH),
Reverse DNS
Software
/
Resource Hash
6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000, max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bank.test-benefitpay.bh/auth/login?url=home
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Sat, 15 Oct 2022 16:37:29 GMT
Strict-Transport-Security
max-age=31536000, max-age=31536000
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Connection
Keep-Alive
Content-Length
30908
X-XSS-Protection
1
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Wed, 17 Feb 2021 07:47:57 GMT
HTTP_HOST
acquirer.test-benefitpay.bh
Vary
Accept-Encoding
X-Frame-Options
DENY
Content-Type
application/javascript
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
jquery.validate.min.js
bank.test-benefitpay.bh/assets/fooAssets/plugins/jquery-validation/js/ 		24 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bank.test-benefitpay.bh/assets/fooAssets/plugins/jquery-validation/js/jquery.validate.min.js
Requested by
Host: bank.test-benefitpay.bh
URL: https://bank.test-benefitpay.bh/auth/login?url=home
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
79.171.240.82 , Bahrain, ASN30882 (BENEFIT, BH),
Reverse DNS
Software
/
Resource Hash
4c0cc637858d6503cba9262f8be75740c29e853605a153a7bde46a6e2e367eb0
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000, max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bank.test-benefitpay.bh/auth/login?url=home
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Sat, 15 Oct 2022 16:37:30 GMT
Strict-Transport-Security
max-age=31536000, max-age=31536000
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Connection
Keep-Alive
Content-Length
7849
X-XSS-Protection
1
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Wed, 31 Mar 2021 14:11:18 GMT
HTTP_HOST
acquirer.test-benefitpay.bh
Vary
Accept-Encoding
X-Frame-Options
DENY
Content-Type
application/javascript
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
additional-methods.min.js
bank.test-benefitpay.bh/assets/fooAssets/plugins/jquery-validation/js/ 		22 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bank.test-benefitpay.bh/assets/fooAssets/plugins/jquery-validation/js/additional-methods.min.js
Requested by
Host: bank.test-benefitpay.bh
URL: https://bank.test-benefitpay.bh/auth/login?url=home
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
79.171.240.82 , Bahrain, ASN30882 (BENEFIT, BH),
Reverse DNS
Software
/
Resource Hash
f8d3e2d9178ac88eb284d0a527bf094b36cc9a286aeca8e697ce0bc11eb7d613
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000, max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bank.test-benefitpay.bh/auth/login?url=home
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Sat, 15 Oct 2022 16:37:29 GMT
Strict-Transport-Security
max-age=31536000, max-age=31536000
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Connection
Keep-Alive
Content-Length
6398
X-XSS-Protection
1
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Wed, 31 Mar 2021 14:11:18 GMT
HTTP_HOST
acquirer.test-benefitpay.bh
Vary
Accept-Encoding
X-Frame-Options
DENY
Content-Type
application/javascript
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
jquery.uniform.min.js
bank.test-benefitpay.bh/assets/fooAssets/plugins/uniform/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bank.test-benefitpay.bh/assets/fooAssets/plugins/uniform/jquery.uniform.min.js
Requested by
Host: bank.test-benefitpay.bh
URL: https://bank.test-benefitpay.bh/auth/login?url=home
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
79.171.240.82 , Bahrain, ASN30882 (BENEFIT, BH),
Reverse DNS
Software
/
Resource Hash
8a41d60f7762f2db0792fd909c3c09725f93d8fe1e94efcb2ca04293921e277a
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000, max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bank.test-benefitpay.bh/auth/login?url=home
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Sat, 15 Oct 2022 16:37:29 GMT
Strict-Transport-Security
max-age=31536000, max-age=31536000
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Connection
Keep-Alive
Content-Length
3035
X-XSS-Protection
1
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Wed, 11 Mar 2020 14:34:58 GMT
HTTP_HOST
acquirer.test-benefitpay.bh
Vary
Accept-Encoding
X-Frame-Options
DENY
Content-Type
application/javascript
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
login-4.min.js
bank.test-benefitpay.bh/assets/bankAssets/js/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bank.test-benefitpay.bh/assets/bankAssets/js/login-4.min.js
Requested by
Host: bank.test-benefitpay.bh
URL: https://bank.test-benefitpay.bh/auth/login?url=home
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
79.171.240.82 , Bahrain, ASN30882 (BENEFIT, BH),
Reverse DNS
Software
/
Resource Hash
19c6ce877c2a72d2d8d3249415b428aa3d70673d08f5d133c2ba462177bbc002
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000, max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bank.test-benefitpay.bh/auth/login?url=home
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Sat, 15 Oct 2022 16:37:29 GMT
Strict-Transport-Security
max-age=31536000, max-age=31536000
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Connection
Keep-Alive
Content-Length
1426
X-XSS-Protection
1
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Wed, 31 Mar 2021 14:11:18 GMT
HTTP_HOST
acquirer.test-benefitpay.bh
Vary
Accept-Encoding
X-Frame-Options
DENY
Content-Type
application/javascript
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
aes.js
bank.test-benefitpay.bh/assets/bankAssets/js/ 		13 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bank.test-benefitpay.bh/assets/bankAssets/js/aes.js
Requested by
Host: bank.test-benefitpay.bh
URL: https://bank.test-benefitpay.bh/auth/login?url=home
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
79.171.240.82 , Bahrain, ASN30882 (BENEFIT, BH),
Reverse DNS
Software
/
Resource Hash
a0a28d71883d6791d7feb6c8ba3ca3fb089994f4cf111a34ed78ae803a638c3b
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000, max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bank.test-benefitpay.bh/auth/login?url=home
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Sat, 15 Oct 2022 16:37:29 GMT
Strict-Transport-Security
max-age=31536000, max-age=31536000
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Connection
Keep-Alive
Content-Length
4937
X-XSS-Protection
1
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Wed, 11 Mar 2020 14:34:58 GMT
HTTP_HOST
acquirer.test-benefitpay.bh
Vary
Accept-Encoding
X-Frame-Options
DENY
Content-Type
application/javascript
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=94
background-login.jpg
bank.test-benefitpay.bh/assets/bankAssets/img/ 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bank.test-benefitpay.bh/assets/bankAssets/img/background-login.jpg
Requested by
Host: bank.test-benefitpay.bh
URL: https://bank.test-benefitpay.bh/assets/bankAssets/css/login-4.min.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
79.171.240.82 , Bahrain, ASN30882 (BENEFIT, BH),
Reverse DNS
Software
/
Resource Hash
ba8db421adf493df3c60d2eb0dbd99b9712709c3fcbaa2ac1abe224ffc180b98
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000, max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bank.test-benefitpay.bh/assets/bankAssets/css/login-4.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Sat, 15 Oct 2022 16:37:30 GMT
Strict-Transport-Security
max-age=31536000, max-age=31536000
X-Content-Type-Options
nosniff
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Wed, 11 Mar 2020 14:34:58 GMT
HTTP_HOST
acquirer.test-benefitpay.bh
Content-Security-Policy
default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
X-Frame-Options
DENY
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
36353
X-XSS-Protection
1

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery object| Login object| CryptoJS function| handleUniform object| urlParts

9 Cookies

Domain/Path Name / Value
www.test-benefitpay.bh/app/web/v1/media Name: f5avraaaaaaaaaaaaaaaa_session_
Value: EKBLFHFDPIFCBOCPHMPIJKNHNIPLANEMPBKCMDNHMDOFIALDHKIEGLOKLHNAFGPIGEIDAOGPGBLLEANKENDACCGPJOPNDBMNEBLBEJIAMGFEGBMPJBPAMOKIFIILOINL
bank.test-benefitpay.bh/ Name: language
Value: eyJpdiI6Im1YMWtjYkRibFBoOEFvaHRcL3JQdnp3PT0iLCJ2YWx1ZSI6InB1YWdsU3p6Umg5Nlp2V0dyd2JTMlE9PSIsIm1hYyI6IjU0Y2JiYmFlYWRiMmYyM2QxNjFmYTQ4ZGNkOTlmMTBjMmI3ZDBjYzkzMTJkZWNhNzRkZjZmM2U0Njg4M2FiMTcifQ%3D%3D
bank.test-benefitpay.bh/ Name: BPAY-Cookies
Value: !lzxsRDM3NPYFSqFlfpEwE/2JGTRm0YnyCraQ3tqsWt9ab8IdUnpjySXmLo+g7pqAMdFGKG3UhH2TtQ==
bank.test-benefitpay.bh/ Name: f5avraaaaaaaaaaaaaaaa_session_
Value: PMIBBDHAKDFEFLBHHDBJLLJAGIFALCLLCPBFMLOEGDKDEGEJBCHKJDAIAFLNBAFMMACDINODFBNGDLGCOGKALCHCJOGAPDFHIOGEJFIPIDCNJHHFAILKMMCMBOKCOPDI
bank.test-benefitpay.bh/ Name: XSRF-TOKEN
Value: eyJpdiI6ImZHSzVKUDJmYWJERENvZ2ZjdUdENFE9PSIsInZhbHVlIjoiUSt4MklPSGVmUVYzcjZzdzJ6VlpHQmkxUUUxM09wWFcyZkJkaFwvbDdWWVI5d1FuWDJmNHFuZjZVNk4zMmRvMjJWM081TGkzbFdTcFdHXC9cL0ZFWDgwVEE9PSIsIm1hYyI6ImEyZTVjM2I3OWUyNzBlYmQ5MzNlOGM5NGJiMDFiY2M5ZmYzMmE2ZTZkZWRmNDQ2NDcwNzBiNjBjMzBkYzIyNzMifQ%3D%3D
bank.test-benefitpay.bh/ Name: laravel_session
Value: eyJpdiI6IlIzbUUyT2s1ZEtrQWR6XC9MaTNWaVJnPT0iLCJ2YWx1ZSI6IjY2bktya0JhU2VSaElKNVVxd2Z6MUNKUExSUEFaWGZBektJSkZpdnFZNzZiSjMyNVwvbTVuQXRNUE5PVmp0WG4yOVlwb0VJVEs1VkVnK1dwOGFpa3dPUT09IiwibWFjIjoiMjQwYmMzOWMwOTMzZjljZDU2ZmZkMmI3MjQ4NWQwOGQzMTVkOThiOGIxNzNkYTQ5YmNiYjg4ZWIwNzE0Njg5ZSJ9
.bank.test-benefitpay.bh/ Name: TS01273b71
Value: 01d85abbe5e109c46d66c0f1890295acea20326a33ede2fb4ce19b6cac80eb0d167593e3bdfc185c7fad24e491a58eeeedaeb5a61506571857805efa69cc154ac226b27f5d6fee650e24547f06fd4d174d5df89dbd6f5e418f6369a345542a02d9cc42c0ae7dca235b98af71302e992d1e45980d0cbfc5a73ae11443938edae54ad135526c
www.test-benefitpay.bh/ Name: BPAY-Cookies
Value: !6lFmJ2B0VfMcQrFlfpEwE/2JGTRm0RPZC05a3zGaToKwTsSoaJnLkRwN++rvVzzOLIEOaenw3MfXWw==
.www.test-benefitpay.bh/ Name: TS01c518df
Value: 01d85abbe5da42a405b3407ea584b5bef7f557f8687531c0311946e0ec9f1976116cf37dcbd1586ecc1ae4d919242f21d509af52d2cea7577f00f498cc79474fe9dc7936e3b1aafa38e945ddf583061e160b300e0d

1 Console Messages

Source Level URL
Text
security error URL: https://bank.test-benefitpay.bh/auth/login?url=home(Line 16)
Message:
Refused to load the image 'https://benefit-acquirer-api.foo-apps.net/web/v1/media/image?name=app-1-benefit-aquirer-fav-45x45.png' because it violates the following Content Security Policy directive: "img-src https://*.test-benefitpay.bh data:".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; img-src https://*.test-benefitpay.bh data:; script-src 'unsafe-inline' https://www.google.com; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src 'unsafe-inline' 'self' https://fonts.gstatic.com data:; script-src-elem 'unsafe-inline' 'self' https://maps.googleapis.com https://www.google.com; style-src-elem 'unsafe-inline' 'self'; connect-src 'self' https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000 max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1