URL: https://sandbox.toloka.yandex.uz/
Submission: On March 27 via automatic, source certstream-suspicious

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 10 HTTP transactions. The main IP is 2a02:6b8::39, located in Moscow, Russian Federation and belongs to YANDEX, RU. The main domain is sandbox.toloka.yandex.uz.
TLS certificate: Issued by Yandex CA on October 30th 2019. Valid for: 6 months.
This is the only time sandbox.toloka.yandex.uz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2a02:6b8::39 13238 (YANDEX)
9 2a02:6b8:4::44 13238 (YANDEX)
10 3
Apex Domain
Subdomains
Transfer
9 yastat.net
yastat.net
269 KB
1 yandex.uz
sandbox.toloka.yandex.uz
3 KB
10 2
Domain Requested by
9 yastat.net sandbox.toloka.yandex.uz
1 sandbox.toloka.yandex.uz
10 2

This site contains no links.

Subject Issuer Validity Valid
sandbox.toloka.yandex.uz
Yandex CA
2019-10-30 -
2020-04-27
6 months crt.sh
*.yastat.net
Yandex CA
2020-02-15 -
2021-02-14
a year crt.sh

This page contains 1 frames:

Primary Page: https://sandbox.toloka.yandex.uz/
Frame ID: 7090A1AE870358380290C58B789C6773
Requests: 11 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

272 kB
Transfer

1194 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
sandbox.toloka.yandex.uz/
5 KB
3 KB
Document
General
Full URL
https://sandbox.toloka.yandex.uz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::39 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
e67444e0c91d1f941cf529125b6aa987d587b24880d43461eb3233cd007aa4db
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' http://mixed-content-permission-indicator.toloka.yandex.net/ https://cdn.branch.io/ https://app.link/ http://sandbox.iframe-toloka.com/ http://*.sandbox.iframe-toloka.com/ http://*.yandex.ru/ https://*.yandex.ru/ https://yastatic.net/ https://yastat.net/; img-src 'self' 'unsafe-inline' 'unsafe-eval' * data: https://yastat.net/; manifest-src 'self' https://yastat.net/; worker-src 'self' https://yastat.net/; font-src 'self' https://yastatic.net data: https://yastat.net/; child-src https://sandbox.iframe-toloka.com/ https://*.sandbox.iframe-toloka.com/ https://yastatic.net/ https://*.yandex.ru/ https://*.yandex.com/ https://*.yandex.com.tr/ https://*.yandex.uz/ https://*.yandex.id/ 'self'; frame-src https://sandbox.iframe-toloka.com/ https://*.sandbox.iframe-toloka.com/ https://yastatic.net/ https://*.yandex.ru/ https://yandex.ru/ https://*.yandex.com/ https://*.yandex.com.tr/ https://*.yandex.uz/ https://*.yandex.id/ 'self'; style-src 'self' 'unsafe-inline' https://yastat.net/; connect-src 'self' http://*.yandex.ru/ https://*.yandex.ru/ https://*.yandex.net/ https://*.yandex.com/ https://*.yandex.com.tr/ https://*.yandex.uz/ https://mc.yandex.ua/ https://passport.yandex-team.ru/ https://yandex.ru/clck/click https://api.branch.io/ https://yastat.net/; media-src *; report-uri https://csp.yandex.net/csp?from=sandbox.toloka.yandex.uz&project=toloka;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
sandbox.toloka.yandex.uz
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document

Response headers

Server
nginx
Date
Fri, 27 Mar 2020 08:25:55 GMT
Content-Type
text/html; charset=utf-8
Content-Length
1368
Connection
keep-alive
Keep-Alive
timeout=120
Last-Modified
Fri, 20 Mar 2020 11:47:09 GMT
ETag
"5e74ad3d-558"
Content-Encoding
br
Cache-Control
no-cache, no-store, must-revalidate, max-age=0
X-Frame-Options
SAMEORIGIN
Content-Security-Policy
default-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' http://mixed-content-permission-indicator.toloka.yandex.net/ https://cdn.branch.io/ https://app.link/ http://sandbox.iframe-toloka.com/ http://*.sandbox.iframe-toloka.com/ http://*.yandex.ru/ https://*.yandex.ru/ https://yastatic.net/ https://yastat.net/; img-src 'self' 'unsafe-inline' 'unsafe-eval' * data: https://yastat.net/; manifest-src 'self' https://yastat.net/; worker-src 'self' https://yastat.net/; font-src 'self' https://yastatic.net data: https://yastat.net/; child-src https://sandbox.iframe-toloka.com/ https://*.sandbox.iframe-toloka.com/ https://yastatic.net/ https://*.yandex.ru/ https://*.yandex.com/ https://*.yandex.com.tr/ https://*.yandex.uz/ https://*.yandex.id/ 'self'; frame-src https://sandbox.iframe-toloka.com/ https://*.sandbox.iframe-toloka.com/ https://yastatic.net/ https://*.yandex.ru/ https://yandex.ru/ https://*.yandex.com/ https://*.yandex.com.tr/ https://*.yandex.uz/ https://*.yandex.id/ 'self'; style-src 'self' 'unsafe-inline' https://yastat.net/; connect-src 'self' http://*.yandex.ru/ https://*.yandex.ru/ https://*.yandex.net/ https://*.yandex.com/ https://*.yandex.com.tr/ https://*.yandex.uz/ https://mc.yandex.ua/ https://passport.yandex-team.ru/ https://yandex.ru/clck/click https://api.branch.io/ https://yastat.net/; media-src *; report-uri https://csp.yandex.net/csp?from=sandbox.toloka.yandex.uz&project=toloka;
Strict-Transport-Security
max-age=31536000
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Service-Worker-Allowed
/
X-qloud-router
vla1-c231fa102f64.qloud-c.yandex.net
toloka.worker.uz.8a5400a778a5b831c3fc7114f96abbb3.json
yastat.net/s3/toloka/p/
171 KB
40 KB
Other
General
Full URL
https://yastat.net/s3/toloka/p/toloka.worker.uz.8a5400a778a5b831c3fc7114f96abbb3.json
Requested by
Host: sandbox.toloka.yandex.uz
URL: https://sandbox.toloka.yandex.uz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:4::44 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.8 /
Resource Hash
48aaee8c17a2761ea91af118b03e1e812e988b06ff0889b41e964d45b1eed9cd

Request headers

Referer
https://sandbox.toloka.yandex.uz/
Origin
https://sandbox.toloka.yandex.uz
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 27 Mar 2020 08:25:55 GMT
content-encoding
br
x-yc-s3-bucket-tags
{}
status
200
content-length
40802
timing-allow-origin
*
last-modified
Fri, 20 Mar 2020 11:46:42 GMT
server
nginx/1.17.8
etag
"9a5f76f0d9b0058ec20a225d5e77fed2"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
x-robots-tag
noindex, noarchive, nofollow
rum-init_head.f43c5f67af453f8eaa37.js
yastat.net/s3/toloka/p/
4 KB
2 KB
Script
General
Full URL
https://yastat.net/s3/toloka/p/rum-init_head.f43c5f67af453f8eaa37.js
Requested by
Host: sandbox.toloka.yandex.uz
URL: https://sandbox.toloka.yandex.uz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:4::44 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.8 /
Resource Hash
33a690fc6f75f1f702585d65b2a391aabee4d89722f2ee2bc28feb55c13a984e

Request headers

Referer
https://sandbox.toloka.yandex.uz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 27 Mar 2020 08:25:55 GMT
content-encoding
br
x-yc-s3-bucket-tags
{}
status
200
content-length
1574
timing-allow-origin
*
last-modified
Fri, 20 Mar 2020 11:46:42 GMT
server
nginx/1.17.8
etag
"e0a96639675fda019de1b8ad101de76b"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
x-robots-tag
noindex, noarchive, nofollow
error-counter-init_head.b283f841227c218a42d1.js
yastat.net/s3/toloka/p/
6 KB
3 KB
Script
General
Full URL
https://yastat.net/s3/toloka/p/error-counter-init_head.b283f841227c218a42d1.js
Requested by
Host: sandbox.toloka.yandex.uz
URL: https://sandbox.toloka.yandex.uz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:4::44 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.8 /
Resource Hash
e145e797bd5cccc54890b7c20c4f2f1a4869fce53f1ee522a2986b5f76cee471

Request headers

Referer
https://sandbox.toloka.yandex.uz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 27 Mar 2020 08:25:55 GMT
content-encoding
br
x-yc-s3-bucket-tags
{}
status
200
content-length
2702
timing-allow-origin
*
last-modified
Fri, 20 Mar 2020 11:46:42 GMT
server
nginx/1.17.8
etag
"830fe714357310aca38f5b2ffdae49f1"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
x-robots-tag
noindex, noarchive, nofollow
runtime.a79d5373f0772ae4ee57.js
yastat.net/s3/toloka/p/
25 KB
7 KB
Script
General
Full URL
https://yastat.net/s3/toloka/p/runtime.a79d5373f0772ae4ee57.js
Requested by
Host: sandbox.toloka.yandex.uz
URL: https://sandbox.toloka.yandex.uz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:4::44 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.8 /
Resource Hash
bd81f5a777f375226db97b7b4ffbfe4df6ebd6c31fedb7fa1f231c0142737c87

Request headers

Referer
https://sandbox.toloka.yandex.uz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 27 Mar 2020 08:25:55 GMT
content-encoding
br
x-yc-s3-bucket-tags
{}
status
200
content-length
7289
timing-allow-origin
*
last-modified
Fri, 20 Mar 2020 11:46:42 GMT
server
nginx/1.17.8
etag
"bf05dcb59b9a8738d872a208b54669b9"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
x-robots-tag
noindex, noarchive, nofollow
vendors~admin-pages~admin-yang-plugin~maintenance-page~requester-toloka-plugin~requester-toloka-sand~7839f792.6085fd08f3629151ae2d.js
yastat.net/s3/toloka/p/
14 KB
5 KB
Script
General
Full URL
https://yastat.net/s3/toloka/p/vendors~admin-pages~admin-yang-plugin~maintenance-page~requester-toloka-plugin~requester-toloka-sand~7839f792.6085fd08f3629151ae2d.js
Requested by
Host: sandbox.toloka.yandex.uz
URL: https://sandbox.toloka.yandex.uz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:4::44 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.8 /
Resource Hash
9f98fccad468620fe6c7548cf9bd0d8dc287d46dfaa11ae4ee87b0642c334d73

Request headers

Referer
https://sandbox.toloka.yandex.uz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 27 Mar 2020 08:25:55 GMT
content-encoding
br
x-yc-s3-bucket-tags
{}
status
200
content-length
5150
timing-allow-origin
*
last-modified
Sun, 01 Mar 2020 09:02:38 GMT
server
nginx/1.17.8
etag
"da581699251621147a783106afb4a7a6"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
x-robots-tag
noindex, noarchive, nofollow
vendors~admin~requester~worker.2411d091370ae39617ba.js
yastat.net/s3/toloka/p/
648 KB
152 KB
Script
General
Full URL
https://yastat.net/s3/toloka/p/vendors~admin~requester~worker.2411d091370ae39617ba.js
Requested by
Host: sandbox.toloka.yandex.uz
URL: https://sandbox.toloka.yandex.uz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:4::44 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.8 /
Resource Hash
5cfa2d76b9a137f02037481159ccd269b0b00a28b0d92fb8f8c34755db5eee36

Request headers

Referer
https://sandbox.toloka.yandex.uz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 27 Mar 2020 08:25:55 GMT
content-encoding
br
x-yc-s3-bucket-tags
{}
status
200
content-length
155434
timing-allow-origin
*
last-modified
Fri, 06 Mar 2020 14:13:43 GMT
server
nginx/1.17.8
etag
"110e3df5e8629a7ae3d8870acc63fa98"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
x-robots-tag
noindex, noarchive, nofollow
admin~requester~worker.9c496418bc20ac56398f.js
yastat.net/s3/toloka/p/
96 KB
24 KB
Script
General
Full URL
https://yastat.net/s3/toloka/p/admin~requester~worker.9c496418bc20ac56398f.js
Requested by
Host: sandbox.toloka.yandex.uz
URL: https://sandbox.toloka.yandex.uz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:4::44 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.8 /
Resource Hash
8ffa48371f23f3885bab1a5d670699ad8e6592e3990426093bc4aaaac2739e21

Request headers

Referer
https://sandbox.toloka.yandex.uz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 27 Mar 2020 08:25:55 GMT
content-encoding
br
x-yc-s3-bucket-tags
{}
status
200
content-length
24202
timing-allow-origin
*
last-modified
Fri, 20 Mar 2020 11:46:42 GMT
server
nginx/1.17.8
etag
"822f0fe44b839dcc40f81ec34ab08360"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
x-robots-tag
noindex, noarchive, nofollow
requester~worker.596778195ddc8c1cf036.js
yastat.net/s3/toloka/p/
7 KB
3 KB
Script
General
Full URL
https://yastat.net/s3/toloka/p/requester~worker.596778195ddc8c1cf036.js
Requested by
Host: sandbox.toloka.yandex.uz
URL: https://sandbox.toloka.yandex.uz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:4::44 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.8 /
Resource Hash
5a661701c3502ac5c9bb177f1c0e858fd4ca6dbc8c1d4e69a707569aae92d70c

Request headers

Referer
https://sandbox.toloka.yandex.uz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 27 Mar 2020 08:25:55 GMT
content-encoding
br
x-yc-s3-bucket-tags
{}
status
200
content-length
2315
timing-allow-origin
*
last-modified
Fri, 13 Mar 2020 13:12:02 GMT
server
nginx/1.17.8
etag
"7638242a7196c0d1ffd1649291e50d83"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
x-robots-tag
noindex, noarchive, nofollow
worker.5c1119b95a78dbf217e1.js
yastat.net/s3/toloka/p/
219 KB
32 KB
Script
General
Full URL
https://yastat.net/s3/toloka/p/worker.5c1119b95a78dbf217e1.js
Requested by
Host: sandbox.toloka.yandex.uz
URL: https://sandbox.toloka.yandex.uz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:4::44 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.8 /
Resource Hash
e736aa39fa8a35bfc8a7d1f1aff8c6e564fbe58b68e3b1d98f1d81af3b66c0e3

Request headers

Referer
https://sandbox.toloka.yandex.uz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 27 Mar 2020 08:25:55 GMT
content-encoding
br
x-yc-s3-bucket-tags
{}
status
200
content-length
32175
timing-allow-origin
*
last-modified
Fri, 20 Mar 2020 11:46:42 GMT
server
nginx/1.17.8
etag
"350777f7a6052a2638edc5b1ef366266"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
x-robots-tag
noindex, noarchive, nofollow
truncated
/
34 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
86be52bdb7547413cafb3ed175a806a798c65de98b40849e0b974c47d187de65

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/webp

Verdicts & Comments Add Verdict or Comment

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate string| staticPath string| assetsUrl string| tolokaVersion string| lang string| domainLang string| deployRoot string| SENTRY_ENVIRONMENT boolean| IS_TOLOKA boolean| IS_SANDBOX string| langUrl object| webpackJsonp object| Ya object| core object| __core-js_shared__ function| setImmediate function| clearImmediate object| regeneratorRuntime function| _ function| $ function| jQuery object| Backbone object| Marionette

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' http://mixed-content-permission-indicator.toloka.yandex.net/ https://cdn.branch.io/ https://app.link/ http://sandbox.iframe-toloka.com/ http://*.sandbox.iframe-toloka.com/ http://*.yandex.ru/ https://*.yandex.ru/ https://yastatic.net/ https://yastat.net/; img-src 'self' 'unsafe-inline' 'unsafe-eval' * data: https://yastat.net/; manifest-src 'self' https://yastat.net/; worker-src 'self' https://yastat.net/; font-src 'self' https://yastatic.net data: https://yastat.net/; child-src https://sandbox.iframe-toloka.com/ https://*.sandbox.iframe-toloka.com/ https://yastatic.net/ https://*.yandex.ru/ https://*.yandex.com/ https://*.yandex.com.tr/ https://*.yandex.uz/ https://*.yandex.id/ 'self'; frame-src https://sandbox.iframe-toloka.com/ https://*.sandbox.iframe-toloka.com/ https://yastatic.net/ https://*.yandex.ru/ https://yandex.ru/ https://*.yandex.com/ https://*.yandex.com.tr/ https://*.yandex.uz/ https://*.yandex.id/ 'self'; style-src 'self' 'unsafe-inline' https://yastat.net/; connect-src 'self' http://*.yandex.ru/ https://*.yandex.ru/ https://*.yandex.net/ https://*.yandex.com/ https://*.yandex.com.tr/ https://*.yandex.uz/ https://mc.yandex.ua/ https://passport.yandex-team.ru/ https://yandex.ru/clck/click https://api.branch.io/ https://yastat.net/; media-src *; report-uri https://csp.yandex.net/csp?from=sandbox.toloka.yandex.uz&project=toloka;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block