urlscan.io logo urlscan.io
SecurityTrails logo

amnic.hsbc.com.mx Open in urlscan Pro
200.16.41.21  Public Scan

Go To Rescan Add Verdict Report
URL: https://amnic.hsbc.com.mx/
Submission Tags: @phishunt_io
Submission: On September 13 via api from ES
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 200.16.41.21, located in Mexico and belongs to HSBC Mexico, S.A., Institucion de Banca Multiple, Grupo Financiero HSBC, MX. The main domain is amnic.hsbc.com.mx.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on August 21st 2020. Valid for: a year.
This is the only time amnic.hsbc.com.mx was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
10 200.16.41.21 6495 (HSBC Mexico)
10 1
Apex Domain
Subdomains		 Transfer
10 hsbc.com.mx
amnic.hsbc.com.mx
375 KB
10 1
Domain Requested by
10 amnic.hsbc.com.mx amnic.hsbc.com.mx
10 1

This site contains no links.

Subject Issuer Validity Valid
amnic.hsbc.com.mx
DigiCert SHA2 Secure Server CA		 2020-08-21 -
2021-09-12		 a year crt.sh

This page contains 1 frames:

Primary Page: https://amnic.hsbc.com.mx/
Frame ID: 5F1254F038D3BEB998E82C070D0F28BF
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 50%
Detected patterns
  • html /<input[^>]+name="__VIEWSTATE/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • html /<input[^>]+name="__VIEWSTATE/i
Overall confidence: 50%
Detected patterns
  • html /<input[^>]+name="__VIEWSTATE/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

375 kB
Transfer

374 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
amnic.hsbc.com.mx/ 		21 KB
21 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://amnic.hsbc.com.mx/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
200.16.41.21 , Mexico, ASN6495 (HSBC Mexico, S.A., Institucion de Banca Multiple, Grupo Financiero HSBC, MX),
Reverse DNS
amnicmobile.hsbc.com.mx
Software
/
Resource Hash
485ae47d2d159ce958da3913c2bb81c228fd99c83f47a8724470a2b17f428eec
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
amnic.hsbc.com.mx
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
cache-control
private
content-type
text/html; charset=utf-8
x-ua-compatible
IE=edge
x-xss-protection
1; mode=block
strict-transport-security
max-age=31536000; includeSubDomains
x-frame-options
SAMEORIGIN
x-content-type-options
nosniff
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
date
Sun, 13 Sep 2020 04:08:28 GMT
content-length
21376
Estilos.css
amnic.hsbc.com.mx/Estilos/ 		5 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://amnic.hsbc.com.mx/Estilos/Estilos.css
Requested by
Host: amnic.hsbc.com.mx
URL: https://amnic.hsbc.com.mx/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
200.16.41.21 , Mexico, ASN6495 (HSBC Mexico, S.A., Institucion de Banca Multiple, Grupo Financiero HSBC, MX),
Reverse DNS
amnicmobile.hsbc.com.mx
Software
/
Resource Hash
3c24976ebc1490f610c2e5b7c99d8ef477cb174695f2337567c24c37c1c237ba
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://amnic.hsbc.com.mx/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 18 Jun 2020 16:42:38 GMT
etag
"013cb798f45d61:0"
x-frame-options
SAMEORIGIN
content-type
text/css
status
200
date
Sun, 13 Sep 2020 04:08:28 GMT
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
accept-ranges
bytes
content-length
4837
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
Style.css
amnic.hsbc.com.mx/Estilos/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://amnic.hsbc.com.mx/Estilos/Style.css
Requested by
Host: amnic.hsbc.com.mx
URL: https://amnic.hsbc.com.mx/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
200.16.41.21 , Mexico, ASN6495 (HSBC Mexico, S.A., Institucion de Banca Multiple, Grupo Financiero HSBC, MX),
Reverse DNS
amnicmobile.hsbc.com.mx
Software
/
Resource Hash
05abeb5cd14b822255e44bd53ec2fb8146c919cad6740030f0c827b56397dffd
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://amnic.hsbc.com.mx/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Mon, 03 Jun 2019 21:43:36 GMT
etag
"074d065551ad51:0"
x-frame-options
SAMEORIGIN
content-type
text/css
status
200
date
Sun, 13 Sep 2020 04:08:28 GMT
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
accept-ranges
bytes
content-length
2023
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
bootstrap.min.css
amnic.hsbc.com.mx/bootstrap/css/ 		156 KB
156 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://amnic.hsbc.com.mx/bootstrap/css/bootstrap.min.css
Requested by
Host: amnic.hsbc.com.mx
URL: https://amnic.hsbc.com.mx/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
200.16.41.21 , Mexico, ASN6495 (HSBC Mexico, S.A., Institucion de Banca Multiple, Grupo Financiero HSBC, MX),
Reverse DNS
amnicmobile.hsbc.com.mx
Software
/
Resource Hash
2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://amnic.hsbc.com.mx/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 28 Nov 2019 13:38:56 GMT
etag
"018502ef1a5d51:0"
x-frame-options
SAMEORIGIN
content-type
text/css
status
200
date
Sun, 13 Sep 2020 04:08:28 GMT
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
accept-ranges
bytes
content-length
159515
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
jquery-3.4.1.min.js
amnic.hsbc.com.mx/Script/ 		86 KB
86 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://amnic.hsbc.com.mx/Script/jquery-3.4.1.min.js
Requested by
Host: amnic.hsbc.com.mx
URL: https://amnic.hsbc.com.mx/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
200.16.41.21 , Mexico, ASN6495 (HSBC Mexico, S.A., Institucion de Banca Multiple, Grupo Financiero HSBC, MX),
Reverse DNS
amnicmobile.hsbc.com.mx
Software
/
Resource Hash
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://amnic.hsbc.com.mx/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Tue, 17 Mar 2020 22:36:16 GMT
etag
"0304a78acfcd51:0"
x-frame-options
SAMEORIGIN
content-type
application/javascript
status
200
date
Sun, 13 Sep 2020 04:08:28 GMT
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
accept-ranges
bytes
content-length
88145
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
webButton.js
amnic.hsbc.com.mx/webcontrols/ 		400 B
503 B 		Script
General
Check archive.org
Download Go to
Full URL
https://amnic.hsbc.com.mx/webcontrols/webButton.js
Requested by
Host: amnic.hsbc.com.mx
URL: https://amnic.hsbc.com.mx/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
200.16.41.21 , Mexico, ASN6495 (HSBC Mexico, S.A., Institucion de Banca Multiple, Grupo Financiero HSBC, MX),
Reverse DNS
amnicmobile.hsbc.com.mx
Software
/
Resource Hash
dc4cf4122c095ad7cb3ff1ee9228dba3cad01414d1d2feb31a7d4dcc363fb0c8
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://amnic.hsbc.com.mx/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Tue, 07 Aug 2012 17:16:46 GMT
etag
"0131d6cc074cd1:0"
x-frame-options
SAMEORIGIN
content-type
application/javascript
status
200
date
Sun, 13 Sep 2020 04:08:28 GMT
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
accept-ranges
bytes
content-length
400
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
Logo_hsbc.png
amnic.hsbc.com.mx/Imagenes/ 		44 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://amnic.hsbc.com.mx/Imagenes/Logo_hsbc.png
Requested by
Host: amnic.hsbc.com.mx
URL: https://amnic.hsbc.com.mx/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
200.16.41.21 , Mexico, ASN6495 (HSBC Mexico, S.A., Institucion de Banca Multiple, Grupo Financiero HSBC, MX),
Reverse DNS
amnicmobile.hsbc.com.mx
Software
/
Resource Hash
75ab5a6dce3235ed86d475a546d268d5ea544a2c7c7d5645235ac30c01e8f2a2
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://amnic.hsbc.com.mx/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Mon, 03 Jun 2019 22:03:30 GMT
etag
"0657e2d581ad51:0"
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
date
Sun, 13 Sep 2020 04:08:28 GMT
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
accept-ranges
bytes
content-length
45338
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
CFS.js
amnic.hsbc.com.mx/script/ 		185 B
267 B 		Script
General
Check archive.org
Download Go to
Full URL
https://amnic.hsbc.com.mx/script/CFS.js
Requested by
Host: amnic.hsbc.com.mx
URL: https://amnic.hsbc.com.mx/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
200.16.41.21 , Mexico, ASN6495 (HSBC Mexico, S.A., Institucion de Banca Multiple, Grupo Financiero HSBC, MX),
Reverse DNS
amnicmobile.hsbc.com.mx
Software
/
Resource Hash
72681cdd29df280d9b160de1d38320e3757ef8554a89a70cbd044cfef374f2ee
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://amnic.hsbc.com.mx/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Fri, 05 Apr 2013 00:33:36 GMT
etag
"0b0a1359531ce1:0"
x-frame-options
SAMEORIGIN
content-type
application/javascript
status
200
date
Sun, 13 Sep 2020 04:08:28 GMT
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
accept-ranges
bytes
content-length
185
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
bootstrap.min.js
amnic.hsbc.com.mx/bootstrap/js/ 		59 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://amnic.hsbc.com.mx/bootstrap/js/bootstrap.min.js
Requested by
Host: amnic.hsbc.com.mx
URL: https://amnic.hsbc.com.mx/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
200.16.41.21 , Mexico, ASN6495 (HSBC Mexico, S.A., Institucion de Banca Multiple, Grupo Financiero HSBC, MX),
Reverse DNS
amnicmobile.hsbc.com.mx
Software
/
Resource Hash
5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://amnic.hsbc.com.mx/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 28 Nov 2019 13:38:56 GMT
etag
"018502ef1a5d51:0"
x-frame-options
SAMEORIGIN
content-type
application/javascript
status
200
date
Sun, 13 Sep 2020 04:08:28 GMT
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
accept-ranges
bytes
content-length
60010
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
BarraRojo20.jpg
amnic.hsbc.com.mx/Imagenes/ 		661 B
751 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://amnic.hsbc.com.mx/Imagenes/BarraRojo20.jpg
Requested by
Host: amnic.hsbc.com.mx
URL: https://amnic.hsbc.com.mx/Estilos/Estilos.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
200.16.41.21 , Mexico, ASN6495 (HSBC Mexico, S.A., Institucion de Banca Multiple, Grupo Financiero HSBC, MX),
Reverse DNS
amnicmobile.hsbc.com.mx
Software
/
Resource Hash
eb08dff245732d6eef6b4626e5f7fc0311f87094cbdfc55e1c45ff069354fa79
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://amnic.hsbc.com.mx/Estilos/Estilos.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Tue, 21 Nov 2006 19:13:04 GMT
etag
"0e0a011a1dc71:0"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
status
200
date
Sun, 13 Sep 2020 04:08:28 GMT
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
accept-ranges
bytes
content-length
661
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| $ function| jQuery function| deshabilitaRetroceso function| Dsb function| ValidaTxt function| CallPageMethod function| CallPageMethodVal function| EntClick function| ValidaOK function| ValidaError function| CloseIE function| DetectIE string| url function| FnAvisoPriv function| popupwindow function| Enter object| bootstrap

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' https://amnic.hsbc.com.mx:* https://amnicoat.hsbc.com.mx:*;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block