URL: https://www.zahlentaucher.mavobiz.de/
Submission: On September 08 via automatic, source certstream-suspicious

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 51.4.230.109, located in Frankfurt am Main, Germany and belongs to MS-DEUTSCHLAND, DE. The main domain is www.zahlentaucher.mavobiz.de.
TLS certificate: Issued by R3 on July 10th 2021. Valid for: 3 months.
This is the only time www.zahlentaucher.mavobiz.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
8 51.4.230.109 200517 (MS-DEUTSC...)
8 1
Apex Domain
Subdomains
Transfer
8 mavobiz.de
www.zahlentaucher.mavobiz.de
1 MB
8 1
Domain Requested by
8 www.zahlentaucher.mavobiz.de www.zahlentaucher.mavobiz.de
8 1

This site contains links to these domains. Also see Links.

Domain
www.google.com
www.getfirefox.com
www.zahlentaucher.de
www.mavobiz.de
Subject Issuer Validity Valid
zahlentaucher.mavobiz.de
R3
2021-07-10 -
2021-10-08
3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.zahlentaucher.mavobiz.de/
Frame ID: EBF137F0799111E8C5CB951716A59821
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

ZAHLENTAUCHER Yvonne Luhmer | MavoBIZ

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<div[^>]+class="[^"]*glyphicon glyphicon-/i

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1373 kB
Transfer

4299 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set /
www.zahlentaucher.mavobiz.de/
13 KB
14 KB
Document
General
Full URL
https://www.zahlentaucher.mavobiz.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.4.230.109 Frankfurt am Main, Germany, ASN200517 (MS-DEUTSCHLAND, DE),
Reverse DNS
Software
nginx /
Resource Hash
d490bd11adbe04acb3e3a6c474cf87691136b59401acfb7cc31379062450df9d
Security Headers
Name Value
Content-Security-Policy media-src 'none'; script-src 'self' 'nonce-3IuSmJrv2X+UHut8/R3iqw=='; frame-src 'none'; child-src 'none'; font-src 'self' data:; default-src 'self'; object-src 'none'; frame-ancestors 'none'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
www.zahlentaucher.mavobiz.de
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Server
nginx
Date
Wed, 08 Sep 2021 02:31:13 GMT
Content-Type
text/html; charset=utf-8
Content-Length
13281
Connection
keep-alive
Cache-Control
no-cache, max-age=0, must-revalidate, no-store
Expires
Wed, 08 Sep 2021 02:31:13 GMT
Referrer-Policy
same-origin
Strict-Transport-Security
max-age=31536000; preload
Content-Language
de-de
Vary
Accept-Language, Cookie
Content-Security-Policy
media-src 'none'; script-src 'self' 'nonce-3IuSmJrv2X+UHut8/R3iqw=='; frame-src 'none'; child-src 'none'; font-src 'self' data:; default-src 'self'; object-src 'none'; frame-ancestors 'none'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
Set-Cookie
csrftoken=f2w7fG5MvyTa56ht2DWrh4Bta8AOzvmpn6tLH3MJ0LYB4oBx7lSHRlesOWCof7oQ; Path=/; SameSite=Lax; Secure
chunk-0-bc072b0f04d49ff3a31f.css
www.zahlentaucher.mavobiz.de/static/bundles/
161 KB
46 KB
Stylesheet
General
Full URL
https://www.zahlentaucher.mavobiz.de/static/bundles/chunk-0-bc072b0f04d49ff3a31f.css
Requested by
Host: www.zahlentaucher.mavobiz.de
URL: https://www.zahlentaucher.mavobiz.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.4.230.109 Frankfurt am Main, Germany, ASN200517 (MS-DEUTSCHLAND, DE),
Reverse DNS
Software
nginx /
Resource Hash
634fac35c65d605f49ac1b2d3f89985b58f8aca0a463f8fe187a4af3fc8675a0

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Origin
https://www.zahlentaucher.mavobiz.de
Accept-Encoding
gzip, deflate, br
Host
www.zahlentaucher.mavobiz.de
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://www.zahlentaucher.mavobiz.de/
Cookie
csrftoken=f2w7fG5MvyTa56ht2DWrh4Bta8AOzvmpn6tLH3MJ0LYB4oBx7lSHRlesOWCof7oQ
Connection
keep-alive
Origin
https://www.zahlentaucher.mavobiz.de
Referer
https://www.zahlentaucher.mavobiz.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Wed, 08 Sep 2021 02:31:13 GMT
Content-Encoding
gzip
Last-Modified
Thu, 31 Dec 2020 14:12:07 GMT
Server
nginx
ETag
W/"5feddc37-283b7"
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=2592000
Connection
keep-alive
Expires
Fri, 08 Oct 2021 02:31:13 GMT
chunk-3-ca638427efc05b11d6aa.css
www.zahlentaucher.mavobiz.de/static/bundles/
213 KB
32 KB
Stylesheet
General
Full URL
https://www.zahlentaucher.mavobiz.de/static/bundles/chunk-3-ca638427efc05b11d6aa.css
Requested by
Host: www.zahlentaucher.mavobiz.de
URL: https://www.zahlentaucher.mavobiz.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.4.230.109 Frankfurt am Main, Germany, ASN200517 (MS-DEUTSCHLAND, DE),
Reverse DNS
Software
nginx /
Resource Hash
6d3b8707787977bbfdbe898f1b48ebd82ccb4758bc97a0b0c1fc8202df0493e3

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Origin
https://www.zahlentaucher.mavobiz.de
Accept-Encoding
gzip, deflate, br
Host
www.zahlentaucher.mavobiz.de
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://www.zahlentaucher.mavobiz.de/
Cookie
csrftoken=f2w7fG5MvyTa56ht2DWrh4Bta8AOzvmpn6tLH3MJ0LYB4oBx7lSHRlesOWCof7oQ
Connection
keep-alive
Origin
https://www.zahlentaucher.mavobiz.de
Referer
https://www.zahlentaucher.mavobiz.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Wed, 08 Sep 2021 02:31:13 GMT
Content-Encoding
gzip
Last-Modified
Thu, 31 Dec 2020 14:12:07 GMT
Server
nginx
ETag
W/"5feddc37-35498"
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=2592000
Connection
keep-alive
Expires
Fri, 08 Oct 2021 02:31:13 GMT
runtime-56298d8c8c1e019b4e0e.js
www.zahlentaucher.mavobiz.de/static/bundles/
2 KB
1 KB
Script
General
Full URL
https://www.zahlentaucher.mavobiz.de/static/bundles/runtime-56298d8c8c1e019b4e0e.js
Requested by
Host: www.zahlentaucher.mavobiz.de
URL: https://www.zahlentaucher.mavobiz.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.4.230.109 Frankfurt am Main, Germany, ASN200517 (MS-DEUTSCHLAND, DE),
Reverse DNS
Software
nginx /
Resource Hash
5c38f615ec705823173a476dcd7a6271bd94618cc98dda730a38cfc4b3ca86b0

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Origin
https://www.zahlentaucher.mavobiz.de
Accept-Encoding
gzip, deflate, br
Host
www.zahlentaucher.mavobiz.de
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://www.zahlentaucher.mavobiz.de/
Cookie
csrftoken=f2w7fG5MvyTa56ht2DWrh4Bta8AOzvmpn6tLH3MJ0LYB4oBx7lSHRlesOWCof7oQ
Connection
keep-alive
Origin
https://www.zahlentaucher.mavobiz.de
Referer
https://www.zahlentaucher.mavobiz.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Wed, 08 Sep 2021 02:31:13 GMT
Content-Encoding
gzip
Last-Modified
Thu, 31 Dec 2020 14:12:07 GMT
Server
nginx
ETag
W/"5feddc37-61d"
Transfer-Encoding
chunked
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=2592000
Connection
keep-alive
Expires
Fri, 08 Oct 2021 02:31:13 GMT
common-56298d8c8c1e019b4e0e.js
www.zahlentaucher.mavobiz.de/static/bundles/
3 MB
1 MB
Script
General
Full URL
https://www.zahlentaucher.mavobiz.de/static/bundles/common-56298d8c8c1e019b4e0e.js
Requested by
Host: www.zahlentaucher.mavobiz.de
URL: https://www.zahlentaucher.mavobiz.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.4.230.109 Frankfurt am Main, Germany, ASN200517 (MS-DEUTSCHLAND, DE),
Reverse DNS
Software
nginx /
Resource Hash
9238a3b566ccc3fbdb7dca3ea503f9084ea7e161b9d4aa625973fdabe329f5b2

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Origin
https://www.zahlentaucher.mavobiz.de
Accept-Encoding
gzip, deflate, br
Host
www.zahlentaucher.mavobiz.de
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://www.zahlentaucher.mavobiz.de/
Cookie
csrftoken=f2w7fG5MvyTa56ht2DWrh4Bta8AOzvmpn6tLH3MJ0LYB4oBx7lSHRlesOWCof7oQ
Connection
keep-alive
Origin
https://www.zahlentaucher.mavobiz.de
Referer
https://www.zahlentaucher.mavobiz.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Wed, 08 Sep 2021 02:31:13 GMT
Content-Encoding
gzip
Last-Modified
Thu, 31 Dec 2020 14:12:07 GMT
Server
nginx
ETag
W/"5feddc37-356e35"
Transfer-Encoding
chunked
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=2592000
Connection
keep-alive
Expires
Fri, 08 Oct 2021 02:31:13 GMT
index-56298d8c8c1e019b4e0e.js
www.zahlentaucher.mavobiz.de/static/bundles/
430 KB
108 KB
Script
General
Full URL
https://www.zahlentaucher.mavobiz.de/static/bundles/index-56298d8c8c1e019b4e0e.js
Requested by
Host: www.zahlentaucher.mavobiz.de
URL: https://www.zahlentaucher.mavobiz.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.4.230.109 Frankfurt am Main, Germany, ASN200517 (MS-DEUTSCHLAND, DE),
Reverse DNS
Software
nginx /
Resource Hash
201663cb5aa8c929af0a62bc2a7ab596dcda2240d65b584337841ab987d81a88

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Origin
https://www.zahlentaucher.mavobiz.de
Accept-Encoding
gzip, deflate, br
Host
www.zahlentaucher.mavobiz.de
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://www.zahlentaucher.mavobiz.de/
Cookie
csrftoken=f2w7fG5MvyTa56ht2DWrh4Bta8AOzvmpn6tLH3MJ0LYB4oBx7lSHRlesOWCof7oQ
Connection
keep-alive
Origin
https://www.zahlentaucher.mavobiz.de
Referer
https://www.zahlentaucher.mavobiz.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Wed, 08 Sep 2021 02:31:13 GMT
Content-Encoding
gzip
Last-Modified
Thu, 31 Dec 2020 14:12:07 GMT
Server
nginx
ETag
W/"5feddc37-6b9d6"
Transfer-Encoding
chunked
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=2592000
Connection
keep-alive
Expires
Fri, 08 Oct 2021 02:31:13 GMT
glyphicons-halflings-regular-448c34a56d699c29117adc64c43affeb.woff2
www.zahlentaucher.mavobiz.de/static/bundles/
18 KB
18 KB
Font
General
Full URL
https://www.zahlentaucher.mavobiz.de/static/bundles/glyphicons-halflings-regular-448c34a56d699c29117adc64c43affeb.woff2
Requested by
Host: www.zahlentaucher.mavobiz.de
URL: https://www.zahlentaucher.mavobiz.de/static/bundles/chunk-0-bc072b0f04d49ff3a31f.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.4.230.109 Frankfurt am Main, Germany, ASN200517 (MS-DEUTSCHLAND, DE),
Reverse DNS
Software
nginx /
Resource Hash
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Origin
https://www.zahlentaucher.mavobiz.de
Accept-Encoding
gzip, deflate, br
Host
www.zahlentaucher.mavobiz.de
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
font
Referer
https://www.zahlentaucher.mavobiz.de/static/bundles/chunk-0-bc072b0f04d49ff3a31f.css
Cookie
csrftoken=f2w7fG5MvyTa56ht2DWrh4Bta8AOzvmpn6tLH3MJ0LYB4oBx7lSHRlesOWCof7oQ
Connection
keep-alive
Origin
https://www.zahlentaucher.mavobiz.de
Referer
https://www.zahlentaucher.mavobiz.de/static/bundles/chunk-0-bc072b0f04d49ff3a31f.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Wed, 08 Sep 2021 02:31:13 GMT
Last-Modified
Thu, 31 Dec 2020 14:12:07 GMT
Server
nginx
ETag
"5feddc37-466c"
Content-Type
application/octet-stream
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
18028
Expires
Fri, 08 Oct 2021 02:31:13 GMT
MaterialIcons-Regular-570eb83859dc23dd0eec423a49e147fe.woff2
www.zahlentaucher.mavobiz.de/static/bundles/
43 KB
44 KB
Font
General
Full URL
https://www.zahlentaucher.mavobiz.de/static/bundles/MaterialIcons-Regular-570eb83859dc23dd0eec423a49e147fe.woff2
Requested by
Host: www.zahlentaucher.mavobiz.de
URL: https://www.zahlentaucher.mavobiz.de/static/bundles/chunk-3-ca638427efc05b11d6aa.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.4.230.109 Frankfurt am Main, Germany, ASN200517 (MS-DEUTSCHLAND, DE),
Reverse DNS
Software
nginx /
Resource Hash
a87d66c91b2e7dc5530aef76c03bd6a3d25ea5826110bf4803b561b811cc8726

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Origin
https://www.zahlentaucher.mavobiz.de
Accept-Encoding
gzip, deflate, br
Host
www.zahlentaucher.mavobiz.de
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
font
Referer
https://www.zahlentaucher.mavobiz.de/static/bundles/chunk-3-ca638427efc05b11d6aa.css
Cookie
csrftoken=f2w7fG5MvyTa56ht2DWrh4Bta8AOzvmpn6tLH3MJ0LYB4oBx7lSHRlesOWCof7oQ
Connection
keep-alive
Origin
https://www.zahlentaucher.mavobiz.de
Referer
https://www.zahlentaucher.mavobiz.de/static/bundles/chunk-3-ca638427efc05b11d6aa.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Wed, 08 Sep 2021 02:31:13 GMT
Last-Modified
Thu, 31 Dec 2020 14:12:07 GMT
Server
nginx
ETag
"5feddc37-ad0c"
Content-Type
application/octet-stream
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
44300
Expires
Fri, 08 Oct 2021 02:31:13 GMT

Verdicts & Comments Add Verdict or Comment

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated string| MAVO_CSP_NONCE object| webpackJsonp function| $ function| jQuery object| regeneratorRuntime function| setImmediate function| clearImmediate object| ParsleyExtend object| ParsleyConfig object| psly object| Parsley object| ParsleyUtils object| ParsleyValidator object| ParsleyUI string| inputEventPatched number| 2f1acc6c3a606b082e5eef5e54414ffb object| FontAwesomeConfig object| ___FONT_AWESOME___ function| saveAs function| SearchIndex function| _

2 Cookies

Domain/Path Name / Value
www.zahlentaucher.mavobiz.de/ Name: loglevel
Value: WARN
www.zahlentaucher.mavobiz.de/ Name: csrftoken
Value: f2w7fG5MvyTa56ht2DWrh4Bta8AOzvmpn6tLH3MJ0LYB4oBx7lSHRlesOWCof7oQ

2 Console Messages

Source Level URL
Text
console-api log URL: https://www.zahlentaucher.mavobiz.de/static/bundles/index-56298d8c8c1e019b4e0e.js(Line 1)
Message:
clear crypto manager
console-api log URL: https://www.zahlentaucher.mavobiz.de/static/bundles/index-56298d8c8c1e019b4e0e.js(Line 1)
Message:
clear session storage

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy media-src 'none'; script-src 'self' 'nonce-3IuSmJrv2X+UHut8/R3iqw=='; frame-src 'none'; child-src 'none'; font-src 'self' data:; default-src 'self'; object-src 'none'; frame-ancestors 'none'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block