URL: https://dev.clubcaddie.online/
Submission: On January 13 via api from US — Scanned from US

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 9 HTTP transactions. The main IP is 164.52.194.16, located in India and belongs to E2E-NETWORKS-IN 282, Sector 19, IN. The main domain is dev.clubcaddie.online.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 27th 2023. Valid for: a year.
This is the only time dev.clubcaddie.online was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
5 164.52.194.16 132420 (E2E-NETWO...)
1 151.101.194.137 54113 (FASTLY)
3 162.247.241.14 23467 (NEWRELIC-...)
9 3
Apex Domain
Subdomains
Transfer
3 nr-data.net
bam.nr-data.net — Cisco Umbrella Rank: 236
1 KB
3 clubcaddie.online
dev.clubcaddie.online
197 KB
2 clubcaddie.com
apimanager-ccdemo.clubcaddie.com
139 KB
1 newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 600
29 KB
9 4
Domain Requested by
3 bam.nr-data.net dev.clubcaddie.online
3 dev.clubcaddie.online dev.clubcaddie.online
2 apimanager-ccdemo.clubcaddie.com dev.clubcaddie.online
1 js-agent.newrelic.com dev.clubcaddie.online
9 4

This site contains links to these domains. Also see Links.

Domain
clubcaddie.com
Subject Issuer Validity Valid
*.clubcaddie.com
Sectigo RSA Domain Validation Secure Server CA
2023-03-27 -
2024-04-11
a year crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA 2023 Q2
2023-04-13 -
2024-05-14
a year crt.sh
*.nr-data.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-09-29 -
2024-10-01
a year crt.sh

This page contains 1 frames:

Primary Page: https://dev.clubcaddie.online/
Frame ID: A25FCD43648FA5AD716C1F1744BB539E
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Club Caddie Inc.

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Page Statistics

9
Requests

67 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

366 kB
Transfer

418 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
dev.clubcaddie.online/
57 KB
58 KB
Document
General
Full URL
https://dev.clubcaddie.online/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
164.52.194.16 , India, ASN132420 (E2E-NETWORKS-IN 282, Sector 19, IN),
Reverse DNS
e2e-62-16.ssdcloudindia.net
Software
nginx/1.17.3 / PHP/7.3.33
Resource Hash
cb571ef25e9cc8fa548d8fb3fcaf1cbb668cc193256380a4d1bdd85486ea9021
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; font-src *; object-src 'none'; base-uri 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://ajax.googleapis.com https://js-agent.newrelic.com https://core.spreedly.com https://www.google.com https://code.jquery.com https://bam.nr-data.net https://www.gstatic.com ; media-src * data:;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Security-Policy
frame-ancestors 'self'; font-src *; object-src 'none'; base-uri 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://ajax.googleapis.com https://js-agent.newrelic.com https://core.spreedly.com https://www.google.com https://code.jquery.com https://bam.nr-data.net https://www.gstatic.com ; media-src * data:;
Content-Type
text/html; charset=UTF-8
Date
Sat, 13 Jan 2024 21:56:21 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Pragma
no-cache
Server
nginx/1.17.3
Strict-Transport-Security
max-age=31536000; includeSubDomains
Transfer-Encoding
chunked
X-Content-Type-Options
nosniff
X-Powered-By
PHP/7.3.33
X-XSS-Protection
1; mode=block
bootstrap.min.css
dev.clubcaddie.online/assets/plugins/bootstrap/css/
118 KB
119 KB
Stylesheet
General
Full URL
https://dev.clubcaddie.online/assets/plugins/bootstrap/css/bootstrap.min.css
Requested by
Host: dev.clubcaddie.online
URL: https://dev.clubcaddie.online/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
164.52.194.16 , India, ASN132420 (E2E-NETWORKS-IN 282, Sector 19, IN),
Reverse DNS
e2e-62-16.ssdcloudindia.net
Software
nginx/1.17.3 /
Resource Hash
eece6e0c65b7007ab0eb1b4998d36dafe381449525824349128efc3f86f4c91c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; font-src *; object-src 'none'; base-uri 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://ajax.googleapis.com https://js-agent.newrelic.com https://core.spreedly.com https://www.google.com https://code.jquery.com https://bam.nr-data.net https://www.gstatic.com ; media-src * data:;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://dev.clubcaddie.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date
Sat, 13 Jan 2024 21:56:22 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self'; font-src *; object-src 'none'; base-uri 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://ajax.googleapis.com https://js-agent.newrelic.com https://core.spreedly.com https://www.google.com https://code.jquery.com https://bam.nr-data.net https://www.gstatic.com ; media-src * data:;
Last-Modified
Tue, 27 Apr 2021 16:54:15 GMT
Server
nginx/1.17.3
ETag
"608841b7-1d9ac"
Content-Type
text/css
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
121260
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
clubcaddie.png
dev.clubcaddie.online/assets/images/
19 KB
20 KB
Image
General
Full URL
https://dev.clubcaddie.online/assets/images/clubcaddie.png
Requested by
Host: dev.clubcaddie.online
URL: https://dev.clubcaddie.online/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
164.52.194.16 , India, ASN132420 (E2E-NETWORKS-IN 282, Sector 19, IN),
Reverse DNS
e2e-62-16.ssdcloudindia.net
Software
nginx/1.17.3 /
Resource Hash
235e1486d0e9d289ec45b32bf604592aecd5a4398eed7f1beb3fdff114fd961d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; font-src *; object-src 'none'; base-uri 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://ajax.googleapis.com https://js-agent.newrelic.com https://core.spreedly.com https://www.google.com https://code.jquery.com https://bam.nr-data.net https://www.gstatic.com ; media-src * data:;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://dev.clubcaddie.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date
Sat, 13 Jan 2024 21:56:22 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self'; font-src *; object-src 'none'; base-uri 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://ajax.googleapis.com https://js-agent.newrelic.com https://core.spreedly.com https://www.google.com https://code.jquery.com https://bam.nr-data.net https://www.gstatic.com ; media-src * data:;
Last-Modified
Tue, 27 Apr 2021 16:54:15 GMT
Server
nginx/1.17.3
ETag
"608841b7-4b93"
Content-Type
image/png
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
19347
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
bootstrap.min.css
apimanager-ccdemo.clubcaddie.com/assets/plugins/bootstrap/css/
118 KB
119 KB
Stylesheet
General
Full URL
https://apimanager-ccdemo.clubcaddie.com/assets/plugins/bootstrap/css/bootstrap.min.css
Requested by
Host: dev.clubcaddie.online
URL: https://dev.clubcaddie.online/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
164.52.194.16 , India, ASN132420 (E2E-NETWORKS-IN 282, Sector 19, IN),
Reverse DNS
e2e-62-16.ssdcloudindia.net
Software
nginx/1.17.3 /
Resource Hash
eece6e0c65b7007ab0eb1b4998d36dafe381449525824349128efc3f86f4c91c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; font-src *; object-src 'none'; base-uri 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://ajax.googleapis.com https://js-agent.newrelic.com https://core.spreedly.com https://www.google.com https://code.jquery.com https://bam.nr-data.net https://www.gstatic.com ; media-src * data:;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://dev.clubcaddie.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date
Sat, 13 Jan 2024 21:56:22 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self'; font-src *; object-src 'none'; base-uri 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://ajax.googleapis.com https://js-agent.newrelic.com https://core.spreedly.com https://www.google.com https://code.jquery.com https://bam.nr-data.net https://www.gstatic.com ; media-src * data:;
Last-Modified
Tue, 27 Apr 2021 16:54:15 GMT
Server
nginx/1.17.3
ETag
"608841b7-1d9ac"
Content-Type
text/css
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
121260
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
clubcaddie.png
apimanager-ccdemo.clubcaddie.com/assets/images/
19 KB
20 KB
Image
General
Full URL
https://apimanager-ccdemo.clubcaddie.com/assets/images/clubcaddie.png
Requested by
Host: dev.clubcaddie.online
URL: https://dev.clubcaddie.online/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
164.52.194.16 , India, ASN132420 (E2E-NETWORKS-IN 282, Sector 19, IN),
Reverse DNS
e2e-62-16.ssdcloudindia.net
Software
nginx/1.17.3 /
Resource Hash
235e1486d0e9d289ec45b32bf604592aecd5a4398eed7f1beb3fdff114fd961d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; font-src *; object-src 'none'; base-uri 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://ajax.googleapis.com https://js-agent.newrelic.com https://core.spreedly.com https://www.google.com https://code.jquery.com https://bam.nr-data.net https://www.gstatic.com ; media-src * data:;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://dev.clubcaddie.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date
Sat, 13 Jan 2024 21:56:22 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self'; font-src *; object-src 'none'; base-uri 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://ajax.googleapis.com https://js-agent.newrelic.com https://core.spreedly.com https://www.google.com https://code.jquery.com https://bam.nr-data.net https://www.gstatic.com ; media-src * data:;
Last-Modified
Tue, 27 Apr 2021 16:54:15 GMT
Server
nginx/1.17.3
ETag
"608841b7-4b93"
Content-Type
image/png
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
19347
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
nr-spa-1.250.0.min.js
js-agent.newrelic.com/
86 KB
29 KB
Script
General
Full URL
https://js-agent.newrelic.com/nr-spa-1.250.0.min.js
Requested by
Host: dev.clubcaddie.online
URL: https://dev.clubcaddie.online/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8aaf0af04baf8eaa35b1ac46ed02d131a8d3c44896b92a45fa1555c70ebc94c9
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

Referer
https://dev.clubcaddie.online/
Origin
https://dev.clubcaddie.online
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

x-amz-version-id
9CPSHfU_b43id9HPDI1ELov4Sz01U0Ym
content-encoding
br
via
1.1 varnish
date
Sat, 13 Jan 2024 21:56:23 GMT
strict-transport-security
max-age=300
x-amz-request-id
T7C1RM1AKDF7J0QS
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
28786
x-amz-id-2
AzaCkxotBepTr2xkKseUR3UGuOFu77UeuBqVb88b3Z+0fLfxyEq83dk0F6rhEAvYG6SLSCsvUdM=
x-served-by
cache-lga21961-LGA
last-modified
Tue, 09 Jan 2024 19:15:56 GMT
server
AmazonS3
x-timer
S1705182984.771303,VS0,VE0
etag
"6e3b65f7f44fa4b3bf86d1f0187490ce"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges
bytes
x-cache-hits
127888
afe767aa21
bam.nr-data.net/1/
40 B
470 B
XHR
General
Full URL
https://bam.nr-data.net/1/afe767aa21?a=761141350&v=1.250.0&to=YlQHZUsDV0QAUUcPCVseJFJNC1ZZTmVWCgVaXAAeUAxdUhk%3D&rst=3616&ck=0&s=1747b62cc812eeb9&ref=https://dev.clubcaddie.online/&hr=0&af=err,xhr,stn,ins,spa&ap=12&be=1275&fe=2215&dc=1459&at=ThMEEwMZREo%3D&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1705182980206,%22n%22:0,%22dn%22:17,%22dne%22:17,%22c%22:17,%22s%22:292,%22ce%22:963,%22rq%22:963,%22rp%22:1276,%22rpe%22:1819,%22di%22:2734,%22ds%22:2734,%22de%22:2734,%22dc%22:3487,%22l%22:3487,%22le%22:3490%7D,%22navigation%22:%7B%7D%7D&fp=2762&fcp=2762
Requested by
Host: dev.clubcaddie.online
URL: https://dev.clubcaddie.online/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.241.14 , United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software
cloudflare /
Resource Hash
24c98b3653a1a89489a370d23ab35375bba6bf386f5c2cf8a34f59f1ee7ab2ee

Request headers

Referer
https://dev.clubcaddie.online/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
content-type
text/plain

Response headers

Date
Sat, 13 Jan 2024 21:56:24 GMT
CF-Cache-Status
DYNAMIC
Server
cloudflare
Vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
Content-Type
text/plain
Access-Control-Allow-Origin
https://dev.clubcaddie.online
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
Connection
keep-alive
CF-Ray
8450e391b8170f65-EWR
Content-Length
40
afe767aa21
bam.nr-data.net/resources/1/
36 B
422 B
XHR
General
Full URL
https://bam.nr-data.net/resources/1/afe767aa21?a=761141350&v=1.250.0&to=YlQHZUsDV0QAUUcPCVseJFJNC1ZZTmVWCgVaXAAeUAxdUhk%3D&rst=3838&ck=0&s=1747b62cc812eeb9&ref=https://dev.clubcaddie.online/&st=1705182980206&hr=0&fts=1705182980206&n=26&fsh=1
Requested by
Host: dev.clubcaddie.online
URL: https://dev.clubcaddie.online/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.241.14 , United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f5eb54c6c43b0b7f9d40318c3f528c061d4fbd4d27d9ccc2d300c18208192c15

Request headers

Referer
https://dev.clubcaddie.online/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
content-type
text/plain

Response headers

Date
Sat, 13 Jan 2024 21:56:24 GMT
CF-Cache-Status
DYNAMIC
Server
cloudflare
Vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
Content-Type
text/plain
Access-Control-Allow-Origin
https://dev.clubcaddie.online
access-control-allow-credentials
true
Connection
keep-alive
CF-Ray
8450e39258ec0f65-EWR
Content-Length
36
afe767aa21
bam.nr-data.net/events/1/
24 B
409 B
XHR
General
Full URL
https://bam.nr-data.net/events/1/afe767aa21?a=761141350&v=1.250.0&to=YlQHZUsDV0QAUUcPCVseJFJNC1ZZTmVWCgVaXAAeUAxdUhk%3D&rst=3946&ck=0&s=1747b62cc812eeb9&ref=https://dev.clubcaddie.online/&ptid=83ab7762-0001-b68b-6fd5-018d04d377b1&hr=0
Requested by
Host: dev.clubcaddie.online
URL: https://dev.clubcaddie.online/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.241.14 , United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer
https://dev.clubcaddie.online/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
content-type
text/plain

Response headers

Date
Sat, 13 Jan 2024 21:56:24 GMT
CF-Cache-Status
DYNAMIC
Server
cloudflare
Vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
https://dev.clubcaddie.online
access-control-allow-credentials
true
Connection
keep-alive
CF-Ray
8450e39309810f65-EWR
Content-Length
24

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| NREUM object| webpackChunk:NRBA-1.250.0.PROD object| newrelic

1 Cookies

Domain/Path Name / Value
dev.clubcaddie.online/ Name: PHPSESSID
Value: pkga7dk2ujnaemrntnmfsovv62

1 Console Messages

Source Level URL
Text
security error URL: https://dev.clubcaddie.online/(Line 14)
Message:
Refused to set the document's base URI to 'https://apimanager-ccdemo.clubcaddie.com/' because it violates the following Content Security Policy directive: "base-uri 'self'".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self'; font-src *; object-src 'none'; base-uri 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://ajax.googleapis.com https://js-agent.newrelic.com https://core.spreedly.com https://www.google.com https://code.jquery.com https://bam.nr-data.net https://www.gstatic.com ; media-src * data:;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block