URL: https://sg-web.careem-engineering.com/captain_apk
Submission: On May 22 via manual from PK — Scanned from DE

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 34.242.230.12, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is sg-web.careem-engineering.com.
TLS certificate: Issued by Amazon RSA 2048 M01 on February 10th 2023. Valid for: 6 months.
This is the only time sg-web.careem-engineering.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

Size: 98 MB (103034654 bytes, 0% done)
Downloaded from: https://firebasestorage.googleapis.com/v0/b/careem-captain-superapp/o/app-updates%2Fadma-release-no-gms.apk?alt=media

Domain & IP information

IP Address AS Autonomous System
7 34.242.230.12 16509 (AMAZON-02)
2 52.31.127.96 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
10 3
Domain Requested by
7 sg-web.careem-engineering.com sg-web.careem-engineering.com
2 events-collector-edge.careem-engineering.com sg-web.careem-engineering.com
1 firebasestorage.googleapis.com sg-web.careem-engineering.com
10 3

This site contains no links.

Subject Issuer Validity Valid
*.careem.com
Amazon RSA 2048 M01
2023-02-10 -
2023-08-02
6 months crt.sh
careem-engineering.com
Amazon RSA 2048 M02
2023-02-09 -
2024-01-18
a year crt.sh
upload.video.google.com
GTS CA 1C3
2023-04-24 -
2023-07-17
3 months crt.sh

This page contains 1 frames:

Frame: https://firebasestorage.googleapis.com/v0/b/careem-captain-superapp/o/app-updates%2Fadma-release-no-gms.apk?alt=media
Frame ID: 5CB5D90C68C0885A544CE46202EC8256
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Captain App

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

30 %
HTTPS

33 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

153 kB
Transfer

594 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request captain_apk
sg-web.careem-engineering.com/
1 KB
811 B
Document
General
Full URL
https://sg-web.careem-engineering.com/captain_apk?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.242.230.12 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-242-230-12.eu-west-1.compute.amazonaws.com
Software
nginx/1.22.1 / Express
Resource Hash
979c9130d4be76f7cefb9273e0d03387f0b7b4bce2b14f44a21d93fe377b0584
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=86400
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Mon, 22 May 2023 09:00:12 GMT
etag
W/"46b-XsU0EoRMZ/Hqae7u65KiTgMxYSo"
server
nginx/1.22.1
strict-transport-security
max-age=2592000; includeSubDomains; preload
vary
Accept-Encoding
x-content-type-options
nosniff
x-powered-by
Express
bootstrap.min.css
sg-web.careem-engineering.com/css/
118 KB
20 KB
Stylesheet
General
Full URL
https://sg-web.careem-engineering.com/css/bootstrap.min.css
Requested by
Host: sg-web.careem-engineering.com
URL: https://sg-web.careem-engineering.com/captain_apk?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.242.230.12 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-242-230-12.eu-west-1.compute.amazonaws.com
Software
nginx/1.22.1 / Express
Resource Hash
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sg-web.careem-engineering.com/captain_apk?
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Mon, 22 May 2023 09:00:12 GMT
strict-transport-security
max-age=2592000; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Fri, 19 May 2023 10:16:14 GMT
server
nginx/1.22.1
content-encoding
gzip
x-powered-by
Express
etag
W/"1d970-18833828db0"
vary
Accept-Encoding
content-type
text/css; charset=UTF-8
cache-control
max-age=86400
accept-ranges
bytes
style.css
sg-web.careem-engineering.com/css/
78 KB
12 KB
Stylesheet
General
Full URL
https://sg-web.careem-engineering.com/css/style.css
Requested by
Host: sg-web.careem-engineering.com
URL: https://sg-web.careem-engineering.com/captain_apk?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.242.230.12 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-242-230-12.eu-west-1.compute.amazonaws.com
Software
nginx/1.22.1 / Express
Resource Hash
5a18803810c534ba9aee4aca612735f9e442cca627a35d05332d28d99073cfec
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sg-web.careem-engineering.com/captain_apk?
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Mon, 22 May 2023 09:00:12 GMT
strict-transport-security
max-age=2592000; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Fri, 19 May 2023 10:16:14 GMT
server
nginx/1.22.1
content-encoding
gzip
x-powered-by
Express
etag
W/"137b3-18833828db0"
vary
Accept-Encoding
content-type
text/css; charset=UTF-8
cache-control
max-age=86400
accept-ranges
bytes
sg-download-captain-app-apk.js
sg-web.careem-engineering.com/scripts/
105 KB
37 KB
Script
General
Full URL
https://sg-web.careem-engineering.com/scripts/sg-download-captain-app-apk.js
Requested by
Host: sg-web.careem-engineering.com
URL: https://sg-web.careem-engineering.com/captain_apk?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.242.230.12 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-242-230-12.eu-west-1.compute.amazonaws.com
Software
nginx/1.22.1 / Express
Resource Hash
6f20244c918f1d3bd3985f0d48c8e133866e0bfa1c3081230c6797a85ab417d7
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sg-web.careem-engineering.com/captain_apk?
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Mon, 22 May 2023 09:00:12 GMT
strict-transport-security
max-age=2592000; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Fri, 19 May 2023 10:16:14 GMT
server
nginx/1.22.1
content-encoding
gzip
x-powered-by
Express
etag
W/"1a271-18833828db0"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
max-age=86400
accept-ranges
bytes
jquery.min.js
sg-web.careem-engineering.com/scripts/
85 KB
30 KB
Script
General
Full URL
https://sg-web.careem-engineering.com/scripts/jquery.min.js
Requested by
Host: sg-web.careem-engineering.com
URL: https://sg-web.careem-engineering.com/captain_apk?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.242.230.12 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-242-230-12.eu-west-1.compute.amazonaws.com
Software
nginx/1.22.1 / Express
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sg-web.careem-engineering.com/captain_apk?
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Mon, 22 May 2023 09:00:12 GMT
strict-transport-security
max-age=2592000; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Fri, 19 May 2023 10:16:14 GMT
server
nginx/1.22.1
content-encoding
gzip
x-powered-by
Express
etag
W/"1538f-18833828db0"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
max-age=86400
accept-ranges
bytes
bootstrap.min.js
sg-web.careem-engineering.com/scripts/
36 KB
10 KB
Script
General
Full URL
https://sg-web.careem-engineering.com/scripts/bootstrap.min.js
Requested by
Host: sg-web.careem-engineering.com
URL: https://sg-web.careem-engineering.com/captain_apk?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.242.230.12 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-242-230-12.eu-west-1.compute.amazonaws.com
Software
nginx/1.22.1 / Express
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sg-web.careem-engineering.com/captain_apk?
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Mon, 22 May 2023 09:00:12 GMT
strict-transport-security
max-age=2592000; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Fri, 19 May 2023 10:16:14 GMT
server
nginx/1.22.1
content-encoding
gzip
x-powered-by
Express
etag
W/"90b5-18833828db0"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
max-age=86400
accept-ranges
bytes
openidconnect.js
sg-web.careem-engineering.com/scripts/
171 KB
44 KB
Script
General
Full URL
https://sg-web.careem-engineering.com/scripts/openidconnect.js
Requested by
Host: sg-web.careem-engineering.com
URL: https://sg-web.careem-engineering.com/captain_apk?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.242.230.12 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-242-230-12.eu-west-1.compute.amazonaws.com
Software
nginx/1.22.1 / Express
Resource Hash
eed722048b0af8ac6d7f4cf7ae2648ba91a074f4da06fb2629d6fd0d243abf99
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sg-web.careem-engineering.com/captain_apk?
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Mon, 22 May 2023 09:00:12 GMT
strict-transport-security
max-age=2592000; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Fri, 19 May 2023 10:16:14 GMT
server
nginx/1.22.1
content-encoding
gzip
x-powered-by
Express
etag
W/"2ab4c-18833828db0"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
max-age=86400
accept-ranges
bytes
publish-event
events-collector-edge.careem-engineering.com/v3/
0
0
Preflight
General
Full URL
https://events-collector-edge.careem-engineering.com/v3/publish-event
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.127.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-31-127-96.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
api-key,content-type,event-source
Access-Control-Request-Method
POST
Origin
https://sg-web.careem-engineering.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

access-control-allow-headers
api-key, content-type, event-source
access-control-allow-methods
POST,GET
access-control-allow-origin
*
access-control-max-age
1800
allow
GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-length
0
date
Mon, 22 May 2023 09:00:12 GMT
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
via
kong/3.0.0
x-kong-proxy-latency
0
x-kong-upstream-latency
1
publish-event
events-collector-edge.careem-engineering.com/v3/
0
182 B
XHR
General
Full URL
https://events-collector-edge.careem-engineering.com/v3/publish-event
Requested by
Host: sg-web.careem-engineering.com
URL: https://sg-web.careem-engineering.com/scripts/jquery.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.127.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-31-127-96.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/json, text/javascript, */*; q=0.01
event-source
sg_frontend_console
Referer
https://sg-web.careem-engineering.com/
api-key
rths8bZ7Tk7JqF24iQW8aa6LDupuRYdkl7LUtOUi
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type
application/json

Response headers

access-control-allow-origin
*
x-kong-upstream-latency
2
date
Mon, 22 May 2023 09:00:12 GMT
via
kong/3.0.0
x-kong-proxy-latency
0
content-length
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
app-updates%2Fadma-release-no-gms.apk
firebasestorage.googleapis.com/v0/b/careem-captain-superapp/o/
0
0
Document
General
Full URL
https://firebasestorage.googleapis.com/v0/b/careem-captain-superapp/o/app-updates%2Fadma-release-no-gms.apk?alt=media
Requested by
Host: sg-web.careem-engineering.com
URL: https://sg-web.careem-engineering.com/scripts/sg-download-captain-app-apk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash

Request headers

Referer
https://sg-web.careem-engineering.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-length
103034654
content-type
application/vnd.android.package-archive
date
Mon, 22 May 2023 09:00:14 GMT
etag
"aaa101578bfb246d36e5b0f7c543c654"
expires
Mon, 22 May 2023 09:00:14 GMT
last-modified
Tue, 09 May 2023 07:27:17 GMT
server
UploadServer
x-goog-generation
1683617236927386
x-goog-hash
crc32c=KQy4zA== md5=qqEBV4v7JG025bD3xUPGVA==
x-goog-metageneration
1
x-goog-storage-class
MULTI_REGIONAL
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
103034654
x-guploader-uploadid
ADPycdv33w-L9hyUadAG5iz1U6uqHacNY4NgMEMTZ8swhp-WpASNd7uMtksPnhI0LjajXGL7S0b0h09ApZgRNMP6ADMzVw

Verdicts & Comments Add Verdict or Comment

226 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery object| OIDC function| JSONObjToHTMLTable function| OidcException function| namespace object| CryptoJS string| b64map string| b64pad function| hex2b64 function| b64tohex function| b64toBA number| dbits number| canary boolean| j_lm function| BigInteger function| nbi function| am1 function| am2 function| am3 number| BI_FP string| BI_RM object| BI_RC number| rr number| vv function| int2char function| intAt function| bnpCopyTo function| bnpFromInt function| nbv function| bnpFromString function| bnpClamp function| bnToString function| bnNegate function| bnAbs function| bnCompareTo function| nbits function| bnBitLength function| bnpDLShiftTo function| bnpDRShiftTo function| bnpLShiftTo function| bnpRShiftTo function| bnpSubTo function| bnpMultiplyTo function| bnpSquareTo function| bnpDivRemTo function| bnMod function| Classic function| cConvert function| cRevert function| cReduce function| cMulTo function| cSqrTo function| bnpInvDigit function| Montgomery function| montConvert function| montRevert function| montReduce function| montSqrTo function| montMulTo function| bnpIsEven function| bnpExp function| bnModPowInt function| bnClone function| bnIntValue function| bnByteValue function| bnShortValue function| bnpChunkSize function| bnSigNum function| bnpToRadix function| bnpFromRadix function| bnpFromNumber function| bnToByteArray function| bnEquals function| bnMin function| bnMax function| bnpBitwiseTo function| op_and function| bnAnd function| op_or function| bnOr function| op_xor function| bnXor function| op_andnot function| bnAndNot function| bnNot function| bnShiftLeft function| bnShiftRight function| lbit function| bnGetLowestSetBit function| cbit function| bnBitCount function| bnTestBit function| bnpChangeBit function| bnSetBit function| bnClearBit function| bnFlipBit function| bnpAddTo function| bnAdd function| bnSubtract function| bnMultiply function| bnSquare function| bnDivide function| bnRemainder function| bnDivideAndRemainder function| bnpDMultiply function| bnpDAddOffset function| NullExp function| nNop function| nMulTo function| nSqrTo function| bnPow function| bnpMultiplyLowerTo function| bnpMultiplyUpperTo function| Barrett function| barrettConvert function| barrettRevert function| barrettReduce function| barrettSqrTo function| barrettMulTo function| bnModPow function| bnGCD function| bnpModInt function| bnModInverse object| lowprimes number| lplim function| bnIsProbablePrime function| bnpMillerRabin function| parseBigInt function| linebrk function| byte2Hex function| pkcs1pad2 function| oaep_mgf1_arr number| SHA1_SIZE function| oaep_pad function| RSAKey function| RSASetPublic function| RSADoPublic function| RSAEncrypt function| RSAEncryptOAEP function| pkcs1unpad2 function| oaep_mgf1_str function| oaep_unpad function| RSASetPrivate function| RSASetPrivateEx function| RSAGenerate function| RSADoPrivate function| RSADecrypt function| RSADecryptOAEP function| _rsapem_pemToBase64 function| _rsapem_getPosArrayOfChildrenFromHex function| _rsapem_getHexValueArrayOfChildrenFromHex function| _rsapem_readPrivateKeyFromASN1HexString function| _rsapem_readPrivateKeyFromPEMString object| _RE_HEXDECONLY function| _rsasign_getHexPaddedDigestInfoForString function| _zeroPaddingOfSignature function| _rsasign_signString function| _rsasign_signWithMessageHash function| _rsasign_signStringWithSHA1 function| _rsasign_signStringWithSHA256 function| pss_mgf1_str function| _rsasign_signStringPSS function| _rsasign_signWithMessageHashPSS function| _rsasign_getDecryptSignatureBI function| _rsasign_getHexDigestInfoFromSig function| _rsasign_getAlgNameAndHashFromHexDisgestInfo function| _rsasign_verifySignatureWithArgs function| _rsasign_verifyHexSignatureForMessage function| _rsasign_verifyString function| _rsasign_verifyWithMessageHash function| _rsasign_verifyStringPSS function| _rsasign_verifyWithMessageHashPSS object| ASN1HEX function| X509 object| KJUR function| Base64x function| stoBA function| BAtos function| BAtohex function| stohex function| stob64 function| stob64u function| b64utos function| b64tob64u function| b64utob64 function| hextob64u function| b64utohex function| utf8tob64u function| b64utoutf8 function| utf8tob64 function| b64toutf8 function| utf8tohex function| hextoutf8 function| hextorstr function| rstrtohex function| hextob64 function| hextob64nl function| b64nltohex function| hextoArrayBuffer function| ArrayBuffertohex function| uricmptohex function| hextouricmp function| encodeURIComponentAll function| newline_toUnix function| newline_toDos function| intarystrtohex function| strdiffidx function| Arcfour function| ARC4init function| ARC4next function| prng_newstate number| rng_psize undefined| rng_state object| rng_pool number| rng_pptr function| rng_seed_int function| rng_seed_time number| t undefined| z function| rng_get_byte function| rng_get_bytes function| SecureRandom function| jsonParse object| KEYUTIL

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=2592000; includeSubDomains; preload
X-Content-Type-Options nosniff