Submitted URL: https://yip.su/2dCVU5.html
Effective URL: https://leaks.sh/
Submission: On February 26 via manual from TR

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 9 HTTP transactions. The main IP is 2606:4700:3033::ac43:8e06, located in United States and belongs to CLOUDFLARENET, US. The main domain is leaks.sh.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on February 9th 2021. Valid for: a year.
This is the only time leaks.sh was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 88.99.66.31 24940 (HETZNER-AS)
6 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
9 3
Apex Domain
Subdomains
Transfer
6 leaks.sh
leaks.sh
206 KB
2 google-analytics.com
www.google-analytics.com
499 B
1 googletagmanager.com
www.googletagmanager.com
53 KB
1 yip.su
yip.su
391 B
9 4
Domain Requested by
6 leaks.sh leaks.sh
2 www.google-analytics.com www.googletagmanager.com
1 www.googletagmanager.com leaks.sh
1 yip.su 1 redirects
9 4

This site contains links to these domains. Also see Links.

Domain
t.me
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2021-02-09 -
2022-02-08
a year crt.sh
*.google-analytics.com
GTS CA 1O1
2021-01-26 -
2021-04-20
3 months crt.sh

This page contains 1 frames:

Primary Page: https://leaks.sh/
Frame ID: 6F12202DD81CA19D278357C8CF7E73A3
Requests: 9 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://yip.su/2dCVU5.html HTTP 301
    https://leaks.sh/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

9
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

259 kB
Transfer

534 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://yip.su/2dCVU5.html HTTP 301
    https://leaks.sh/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
leaks.sh/
Redirect Chain
  • https://yip.su/2dCVU5.html
  • https://leaks.sh/
5 KB
2 KB
Document
General
Full URL
https://leaks.sh/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::ac43:8e06 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.0.33
Resource Hash
aad0eeecbf6aff2bcc134a174700ffde5ff6d708859c68d79f024f3db7a78344
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

:method
GET
:authority
leaks.sh
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 26 Feb 2021 14:27:41 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=dc7a314bdf084e64e45d43a70129d77d21614349660; expires=Sun, 28-Mar-21 14:27:40 GMT; path=/; domain=.leaks.sh; HttpOnly; SameSite=Lax; Secure
x-powered-by
PHP/7.0.33
strict-transport-security
max-age=63072000; includeSubdomains
x-frame-options
DENY
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
cf-request-id
0880560b270000c2e0e3834000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=91Zsd8mHbGvkAbhC8lwt7M75PL93K6SW%2F3PIaAFSE0wEx00OR0dwOSe0zXxsfm8B%2Fo2zQeNJb%2BSv%2FITPvDFZdfTh%2B3KwuPsJOzUaOTSI%2BkbVVTOxmQ%3D%3D"}],"max_age":604800}
nel
{"max_age":604800,"report_to":"cf-nel"}
server
cloudflare
cf-ray
627a59250d1ac2e0-FRA
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

server
nginx
date
Fri, 26 Feb 2021 14:27:40 GMT
content-type
text/html; charset=UTF-8
location
https://leaks.sh/
set-cookie
PHPSESSID=td14v02p3o0e20he9othvprdl0; path=/; HttpOnly clhf03028ja=185.212.171.67; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=264698531; path=/ timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
expires
Thu, 01 Jan 1970 00:00:01 GMT
cache-control
no-cache
pragma
no-cache
strict-transport-security
max-age=31536000; preload
x-frame-options
DENY
style.css
leaks.sh/assets/
119 KB
18 KB
Stylesheet
General
Full URL
https://leaks.sh/assets/style.css
Requested by
Host: leaks.sh
URL: https://leaks.sh/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::ac43:8e06 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
01e780a0afffca2965b5ac1b1d99e984040b1bbab24d4ed5225eebc602edacd7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://leaks.sh/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 26 Feb 2021 14:27:42 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
nel
{"max_age":604800,"report_to":"cf-nel"}
vary
Accept-Encoding
cf-request-id
0880560f5f0000c2e06d0d0000000001
last-modified
Fri, 12 Feb 2021 21:20:40 GMT
server
cloudflare
x-frame-options
DENY
etag
W/"6026f128-1dd46"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63072000; includeSubdomains
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=JDUFWoQJscBErMzbrbb7vwjGnmMpdBhtxJDXXSD1POUi29%2BksO6gHqMDQz4piTqkN5Rppm42KBY36qc2Oc4u%2Bz%2BwErH9Xdj79kEZJxdjJWuIuDNyKQ%3D%3D"}],"max_age":604800}
content-type
text/css
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
max-age=14400
cf-ray
627a592bcb6bc2e0-FRA
js
www.googletagmanager.com/gtag/
137 KB
53 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-NQQ64BJV09
Requested by
Host: leaks.sh
URL: https://leaks.sh/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b901e90097021a0405bf99c3a440082f4a02d63844c3e7943202a5c7492fe0d4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://leaks.sh/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 26 Feb 2021 14:27:42 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
53743
x-xss-protection
0
expires
Fri, 26 Feb 2021 14:27:42 GMT
logo.png
leaks.sh/assets/
23 KB
23 KB
Image
General
Full URL
https://leaks.sh/assets/logo.png
Requested by
Host: leaks.sh
URL: https://leaks.sh/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::ac43:8e06 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a60e969fcb72f6a84750864a78b882b04c864be6bff192479c6d73652d785301
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://leaks.sh/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 26 Feb 2021 14:27:42 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
1581
vary
Accept-Encoding
content-length
23420
cf-request-id
08805610260000c2e0a7183000000001
last-modified
Fri, 12 Feb 2021 21:57:27 GMT
server
cloudflare
x-frame-options
DENY
etag
"6026f9c7-5b7c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63072000; includeSubdomains
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=kQkO6yfQ94hwJq4D6xwmuD8BjIAjnKYKNIZyegga4zXYHWyEdWrxpQE%2Fl1ucpfBy8qUMOqfl%2FIhTYFDoOSA5HCI5BCfPKl93aDVgUBnoTQ8JJLGEoA%3D%3D"}],"max_age":604800}
content-type
image/png
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
627a592d0c79c2e0-FRA
icon.png
leaks.sh/assets/
120 KB
121 KB
Image
General
Full URL
https://leaks.sh/assets/icon.png
Requested by
Host: leaks.sh
URL: https://leaks.sh/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::ac43:8e06 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0de20d26fa38ae5199350ec757d6c3dd0c744a2406960999e98d2916cff4a688
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://leaks.sh/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 26 Feb 2021 14:27:42 GMT
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
nel
{"max_age":604800,"report_to":"cf-nel"}
vary
Accept-Encoding
content-length
123268
cf-request-id
08805610260000c2e0d2894000000001
last-modified
Fri, 12 Feb 2021 21:58:06 GMT
server
cloudflare
x-frame-options
DENY
etag
"6026f9ee-1e184"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63072000; includeSubdomains
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=P%2By8WfSPZDpHiCnPWyS%2FtdhSMzeenq33Q4IvTuqcrrsDuW%2FfcPDKl1tjWoAri3cFAIqRVX4B5sklNQEjSPWIcxXclcjqrieiMx2XOlmTIXMBAA9zpA%3D%3D"}],"max_age":604800}
content-type
image/png
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
627a592d0c7dc2e0-FRA
jquery.min.js
leaks.sh/assets/
94 KB
32 KB
Script
General
Full URL
https://leaks.sh/assets/jquery.min.js
Requested by
Host: leaks.sh
URL: https://leaks.sh/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::ac43:8e06 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://leaks.sh/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 26 Feb 2021 14:27:42 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
nel
{"max_age":604800,"report_to":"cf-nel"}
vary
Accept-Encoding
cf-request-id
0880560f980000c2e08b34c000000001
last-modified
Fri, 12 Feb 2021 21:20:39 GMT
server
cloudflare
x-frame-options
DENY
etag
W/"6026f127-176bb"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63072000; includeSubdomains
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=IGmnTgysOsO9im4jpynorbVdognz7v%2FZcpaqfUCgcQRUU0Lf103snn9Fuxy1%2F%2BoQIE%2FKZKNGGPCdbZQJUt3%2BPLnm2N3Z9poU5BLE2YSKkzGfONx65Q%3D%3D"}],"max_age":604800}
content-type
application/javascript
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
max-age=14400
cf-ray
627a592c2bd8c2e0-FRA
bootstrap.min.js
leaks.sh/assets/
35 KB
9 KB
Script
General
Full URL
https://leaks.sh/assets/bootstrap.min.js
Requested by
Host: leaks.sh
URL: https://leaks.sh/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::ac43:8e06 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://leaks.sh/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 26 Feb 2021 14:27:42 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
nel
{"max_age":604800,"report_to":"cf-nel"}
vary
Accept-Encoding
cf-request-id
0880560ff30000c2e07435d000000001
last-modified
Fri, 12 Feb 2021 21:20:41 GMT
server
cloudflare
x-frame-options
DENY
etag
W/"6026f129-8c6f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63072000; includeSubdomains
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=RTy2%2BxWTSiep4HVDr3QGegaSCtk8Q5SSQdO2nntlj6aadwgsnyjIyyeN5o62P0u0DgWWcDbHOgSF%2F3doX044USjB83gDkjOATMky5OEfsAEP%2BDql%2FQ%3D%3D"}],"max_age":604800}
content-type
application/javascript
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
max-age=14400
cf-ray
627a592cbc3cc2e0-FRA
collect
www.google-analytics.com/g/
0
166 B
Other
General
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-NQQ64BJV09&gtm=2oe2h0&_p=1100923329&sr=1600x1200&ul=en-us&cid=1180702452.1614349662&_s=1&dl=https%3A%2F%2Fleaks.sh%2F&dt=Leaks%20-%20Data%20Search%20Engine&sid=1614349662&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-NQQ64BJV09
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://leaks.sh/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 26 Feb 2021 14:27:42 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://leaks.sh
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/g/
0
333 B
Other
General
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-NQQ64BJV09&gtm=2oe2h0&_p=1100923329&sr=1600x1200&ul=en-us&cid=1180702452.1614349662&_s=2&dl=https%3A%2F%2Fleaks.sh%2F&dt=Leaks%20-%20Data%20Search%20Engine&sid=1614349662&sct=1&seg=0&en=scroll&_et=356&epn.percent_scrolled=90
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-NQQ64BJV09
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://leaks.sh/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 26 Feb 2021 14:27:47 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://leaks.sh
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| google_tag_manager object| dataLayer function| gtag object| google_tag_data object| gaGlobal function| $ function| jQuery object| jQuery1112022787501338382854 function| onYouTubeIframeAPIReady

3 Cookies

Domain/Path Name / Value
.leaks.sh/ Name: _ga
Value: GA1.1.1180702452.1614349662
.leaks.sh/ Name: _ga_NQQ64BJV09
Value: GS1.1.1614349662.1.0.1614349662.0
.leaks.sh/ Name: __cfduid
Value: dc7a314bdf084e64e45d43a70129d77d21614349660

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options DENY