URL: https://webinars.oncourselearning.com/BWUpdateProfile?e=dfarlinger%40wintrust.com&elqTrackId=84bc4108669143c6959c45cb696c3269&elq=f6df...
Submission: On September 28 via manual from US

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 8 HTTP transactions. The main IP is 142.0.160.57, located in Ashburn, United States and belongs to NETDYNAMICS, US. The main domain is webinars.oncourselearning.com.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on June 13th 2020. Valid for: 2 years.
This is the only time webinars.oncourselearning.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 142.0.160.57 7160 (NETDYNAMICS)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
1 2a04:4e42:1b:... 54113 (FASTLY)
1 184.86.251.5 20940 (AKAMAI-ASN1)
2 5 142.0.160.53 7160 (NETDYNAMICS)
1 104.103.81.108 16625 (AKAMAI-AS)
8 6
Domain Requested by
5 s1690595433.t.eloqua.com 2 redirects webinars.oncourselearning.com
img.en25.com
1 img.en25.com webinars.oncourselearning.com
1 images.w.oncourselearning.com webinars.oncourselearning.com
1 cdn.jsdelivr.net webinars.oncourselearning.com
1 code.jquery.com webinars.oncourselearning.com
1 webinars.oncourselearning.com
8 6

This site contains no links.

Subject Issuer Validity Valid
webinars.oncourselearning.com
Sectigo RSA Organization Validation Secure Server CA
2020-06-13 -
2022-06-13
2 years crt.sh
jquery.org
COMODO RSA Domain Validation Secure Server CA
2018-10-17 -
2020-10-16
2 years crt.sh
f3.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2020-09-21 -
2021-04-17
7 months crt.sh
images.w.oncourselearning.com
Sectigo RSA Organization Validation Secure Server CA
2020-06-13 -
2022-06-13
2 years crt.sh
*.t.eloqua.com
DigiCert SHA2 Secure Server CA
2020-03-09 -
2022-04-08
2 years crt.sh
*.en25.com
DigiCert SHA2 Secure Server CA
2020-08-13 -
2021-11-12
a year crt.sh

This page contains 1 frames:

Primary Page: https://webinars.oncourselearning.com/BWUpdateProfile?e=dfarlinger%40wintrust.com&elqTrackId=84bc4108669143c6959c45cb696c3269&elq=f6df84e2466c4330852ab32775d0cdb6&elqaid=1216&elqat=1&elqCampaignId=1146
Frame ID: D26FCF03BB865BEBAE4BED224F4365B5
Requests: 8 HTTP requests in this frame

Screenshot


Page Statistics

8
Requests

100 %
HTTPS

33 %
IPv6

5
Domains

6
Subdomains

6
IPs

3
Countries

57 kB
Transfer

181 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3
  • https://s1690595433.t.eloqua.com/visitor/v200/svrGP?pps=60&siteid=1690595433&PURLSiteID=3&optin=disabled&PURLSiteAlternateDNSID=0&LandingPageID=30&PURLRecordID=0&PURLGUID=82EEAD84155149FBB92B42723B436456&UseRelativePath=True&elq={F6DF84E2-466C-4330-852A-B32775D0CDB6}&elq_ck=0&e=dfarlinger%2540wintrust.com&elqTrackId=84bc4108669143c6959c45cb696c3269&elqaid=1216&elqat=1&elqCampaignId=1146 HTTP 302
  • https://s1690595433.t.eloqua.com/visitor/v200/svrGP.aspx?pps=60&siteid=1690595433&PURLSiteID=3&optin=disabled&PURLSiteAlternateDNSID=0&LandingPageID=30&PURLRecordID=0&PURLGUID=82EEAD84155149FBB92B42723B436456&UseRelativePath=True&elq={F6DF84E2-466C-4330-852A-B32775D0CDB6}&elq_ck=0&e=dfarlinger%2540wintrust.com&elqTrackId=84bc4108669143c6959c45cb696c3269&elqaid=1216&elqat=1&elqCampaignId=1146&elqCookie=1 HTTP 302
  • https://s1690595433.t.eloqua.com/eloquaimages/tinydot.gif

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set BWUpdateProfile
webinars.oncourselearning.com/
73 KB
11 KB
Document
General
Full URL
https://webinars.oncourselearning.com/BWUpdateProfile?e=dfarlinger%40wintrust.com&elqTrackId=84bc4108669143c6959c45cb696c3269&elq=f6df84e2466c4330852ab32775d0cdb6&elqaid=1216&elqat=1&elqCampaignId=1146
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
142.0.160.57 Ashburn, United States, ASN7160 (NETDYNAMICS, US),
Reverse DNS
mail01.academic.hbsp.harvard.edu
Software
/
Resource Hash
6a3d4a0b0f1c0528e1793750ac4f747cb55a8ae0d52515dd95110044c31fb6b1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
webinars.oncourselearning.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Cache-Control
private,no-cache, no-store
Pragma
no-cache
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Expires
-1
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000
X-Xss-Protection
1; mode=block
Set-Cookie
ELOQUA=GUID=82EEAD84155149FBB92B42723B436456; domain=webinars.oncourselearning.com; expires=Thu, 28-Oct-2021 17:29:34 GMT; path=/;SameSite=None; secure; HttpOnly
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
X-Content-Type-Options
nosniff
Date
Mon, 28 Sep 2020 17:29:33 GMT
Content-Length
10301
jquery-3.3.1.slim.min.js
code.jquery.com/
68 KB
24 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.3.1.slim.min.js
Requested by
Host: webinars.oncourselearning.com
URL: https://webinars.oncourselearning.com/BWUpdateProfile?e=dfarlinger%40wintrust.com&elqTrackId=84bc4108669143c6959c45cb696c3269&elq=f6df84e2466c4330852ab32775d0cdb6&elqaid=1216&elqat=1&elqCampaignId=1146
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1

Request headers

Origin
https://webinars.oncourselearning.com
Referer
https://webinars.oncourselearning.com/BWUpdateProfile?e=dfarlinger%40wintrust.com&elqTrackId=84bc4108669143c6959c45cb696c3269&elq=f6df84e2466c4330852ab32775d0cdb6&elqaid=1216&elqat=1&elqCampaignId=1146
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 28 Sep 2020 17:29:34 GMT
content-encoding
gzip
last-modified
Sat, 20 Jan 2018 17:26:44 GMT
server
nginx
status
200
etag
W/"5a637bd4-1111d"
vary
Accept-Encoding
x-hw
1601314174.dop245.fr8.t,1601314174.cds263.fr8.hn,1601314174.cds274.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
24038
jquery.validate.min.js
cdn.jsdelivr.net/npm/jquery-validation@1.19.2/dist/
24 KB
8 KB
Script
General
Full URL
https://cdn.jsdelivr.net/npm/jquery-validation@1.19.2/dist/jquery.validate.min.js
Requested by
Host: webinars.oncourselearning.com
URL: https://webinars.oncourselearning.com/BWUpdateProfile?e=dfarlinger%40wintrust.com&elqTrackId=84bc4108669143c6959c45cb696c3269&elq=f6df84e2466c4330852ab32775d0cdb6&elqaid=1216&elqat=1&elqCampaignId=1146
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f8110a988bd0e88b0bf2c1dcbe276d0eb34e7593b70bd2ed14fb45d87d1d3872
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://webinars.oncourselearning.com/BWUpdateProfile?e=dfarlinger%40wintrust.com&elqTrackId=84bc4108669143c6959c45cb696c3269&elq=f6df84e2466c4330852ab32775d0cdb6&elqaid=1216&elqat=1&elqCampaignId=1146
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
age
5279258
x-cache
HIT, HIT
status
200
content-length
7849
etag
W/"5f7b-4cmzVksmdpZ8smY/JQu65FkNb+k"
x-served-by
cache-fra19141-FRA, cache-hhn4068-HHN
date
Mon, 28 Sep 2020 17:29:34 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
%7B75401b28-573c-4a6d-b256-627047eebbe9%7D_BW_Subscription_Header_from_site.png
images.w.oncourselearning.com/EloquaImages/clients/OCLWebinars/
10 KB
11 KB
Image
General
Full URL
https://images.w.oncourselearning.com/EloquaImages/clients/OCLWebinars/%7B75401b28-573c-4a6d-b256-627047eebbe9%7D_BW_Subscription_Header_from_site.png
Requested by
Host: webinars.oncourselearning.com
URL: https://webinars.oncourselearning.com/BWUpdateProfile?e=dfarlinger%40wintrust.com&elqTrackId=84bc4108669143c6959c45cb696c3269&elq=f6df84e2466c4330852ab32775d0cdb6&elqaid=1216&elqat=1&elqCampaignId=1146
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.86.251.5 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a184-86-251-5.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
dbadee25f5b6af2f561694b3800cc4c12eefeb3aea09f78569eab49af5d147c8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://webinars.oncourselearning.com/BWUpdateProfile?e=dfarlinger%40wintrust.com&elqTrackId=84bc4108669143c6959c45cb696c3269&elq=f6df84e2466c4330852ab32775d0cdb6&elqaid=1216&elqat=1&elqCampaignId=1146
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Thu, 13 Aug 2020 15:32:17 GMT
ETag
"63242fed8671d61:0"
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control
no-cache, no-store
Date
Mon, 28 Sep 2020 17:29:34 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/png
Content-Length
10507
X-XSS-Protection
1; mode=block
Expires
Mon, 28 Sep 2020 17:29:34 GMT
tinydot.gif
s1690595433.t.eloqua.com/eloquaimages/
Redirect Chain
  • https://s1690595433.t.eloqua.com/visitor/v200/svrGP?pps=60&siteid=1690595433&PURLSiteID=3&optin=disabled&PURLSiteAlternateDNSID=0&LandingPageID=30&PURLRecordID=0&PURLGUID=82EEAD84155149FBB92B42723B...
  • https://s1690595433.t.eloqua.com/visitor/v200/svrGP.aspx?pps=60&siteid=1690595433&PURLSiteID=3&optin=disabled&PURLSiteAlternateDNSID=0&LandingPageID=30&PURLRecordID=0&PURLGUID=82EEAD84155149FBB92B4...
  • https://s1690595433.t.eloqua.com/eloquaimages/tinydot.gif
49 B
520 B
Image
General
Full URL
https://s1690595433.t.eloqua.com/eloquaimages/tinydot.gif
Requested by
Host: webinars.oncourselearning.com
URL: https://webinars.oncourselearning.com/BWUpdateProfile?e=dfarlinger%40wintrust.com&elqTrackId=84bc4108669143c6959c45cb696c3269&elq=f6df84e2466c4330852ab32775d0cdb6&elqaid=1216&elqat=1&elqCampaignId=1146
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
142.0.160.53 Ashburn, United States, ASN7160 (NETDYNAMICS, US),
Reverse DNS
Software
/
Resource Hash
f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://webinars.oncourselearning.com/BWUpdateProfile?e=dfarlinger%40wintrust.com&elqTrackId=84bc4108669143c6959c45cb696c3269&elq=f6df84e2466c4330852ab32775d0cdb6&elqaid=1216&elqat=1&elqCampaignId=1146
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Fri, 17 Jul 2020 18:55:07 GMT
ETag
"d47312ca6b5cd61:0"
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control
no-cache, no-store
Date
Mon, 28 Sep 2020 17:29:34 GMT
Accept-Ranges
bytes
Content-Type
image/gif
Content-Length
49
X-XSS-Protection
1; mode=block
Expires
-1

Redirect headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000;
X-Content-Type-Options
nosniff
Date
Mon, 28 Sep 2020 17:29:34 GMT
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Location
/eloquaimages/tinydot.gif
Cache-Control
private,no-cache, no-store
Content-Type
text/html; charset=utf-8
Content-Length
142
X-XSS-Protection
1; mode=block
Expires
-1
elqCfg.min.js
img.en25.com/i/
6 KB
3 KB
Script
General
Full URL
https://img.en25.com/i/elqCfg.min.js
Requested by
Host: webinars.oncourselearning.com
URL: https://webinars.oncourselearning.com/BWUpdateProfile?e=dfarlinger%40wintrust.com&elqTrackId=84bc4108669143c6959c45cb696c3269&elq=f6df84e2466c4330852ab32775d0cdb6&elqaid=1216&elqat=1&elqCampaignId=1146
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.103.81.108 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-81-108.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6b4ebd6049c806e3eef1bd770b2d8b4fdd75803861ead3584ee753e41988efae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://webinars.oncourselearning.com/BWUpdateProfile?e=dfarlinger%40wintrust.com&elqTrackId=84bc4108669143c6959c45cb696c3269&elq=f6df84e2466c4330852ab32775d0cdb6&elqaid=1216&elqat=1&elqCampaignId=1146
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Connection
keep-alive
Content-Length
2115
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Fri, 17 Jul 2020 18:55:09 GMT
Date
Mon, 28 Sep 2020 17:29:34 GMT
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
no-cache, no-store
ETag
"8bc15cb6b5cd61:0"
Accept-Ranges
bytes
Expires
Mon, 28 Sep 2020 17:29:34 GMT
svrGP
s1690595433.t.eloqua.com/visitor/v200/
0
369 B
Script
General
Full URL
https://s1690595433.t.eloqua.com/visitor/v200/svrGP?pps=50&siteid=1690595433&DLKey=8cfed3442fdb4c938d52cfbd4c6ff34b&DLLookup=%3CEmail_Address1%3Edfarlinger%40wintrust.com%3C%2FEmail_Address1%3E&ms=536
Requested by
Host: img.en25.com
URL: https://img.en25.com/i/elqCfg.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
142.0.160.53 Ashburn, United States, ASN7160 (NETDYNAMICS, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://webinars.oncourselearning.com/BWUpdateProfile?e=dfarlinger%40wintrust.com&elqTrackId=84bc4108669143c6959c45cb696c3269&elq=f6df84e2466c4330852ab32775d0cdb6&elqaid=1216&elqat=1&elqCampaignId=1146
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000;
X-Content-Type-Options
nosniff
Date
Mon, 28 Sep 2020 17:29:34 GMT
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control
private,no-cache, no-store
Content-Type
application/javascript
Content-Length
0
X-XSS-Protection
1; mode=block
Expires
-1
svrGP
s1690595433.t.eloqua.com/visitor/v200/
49 B
406 B
Image
General
Full URL
https://s1690595433.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=1690595433&ref2=elqNone&tzo=-60&ms=536&optin=disabled
Requested by
Host: webinars.oncourselearning.com
URL: https://webinars.oncourselearning.com/BWUpdateProfile?e=dfarlinger%40wintrust.com&elqTrackId=84bc4108669143c6959c45cb696c3269&elq=f6df84e2466c4330852ab32775d0cdb6&elqaid=1216&elqat=1&elqCampaignId=1146
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
142.0.160.53 Ashburn, United States, ASN7160 (NETDYNAMICS, US),
Reverse DNS
Software
/
Resource Hash
f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://webinars.oncourselearning.com/BWUpdateProfile?e=dfarlinger%40wintrust.com&elqTrackId=84bc4108669143c6959c45cb696c3269&elq=f6df84e2466c4330852ab32775d0cdb6&elqaid=1216&elqat=1&elqCampaignId=1146
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000;
X-Content-Type-Options
nosniff
Date
Mon, 28 Sep 2020 17:29:34 GMT
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control
private,no-cache, no-store
Content-Type
image/gif
Content-Length
49
X-XSS-Protection
1; mode=block
Expires
-1

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| $ function| jQuery object| _elqQ function| getUrlParameter string| qs_email function| setFormFieldValue function| SetElqContent object| _elq

1 Cookies

Domain/Path Name / Value
.webinars.oncourselearning.com/ Name: ELOQUA
Value: GUID=82EEAD84155149FBB92B42723B436456

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block