URL: https://invest.invescomutualfund.com/dit/newinvestor/NewInvestor/Login
Submission Tags: falconsandbox
Submission: On July 08 via api from US

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 8 HTTP transactions. The main IP is 103.147.26.236, located in India and belongs to KFPL-AS-AP KFIN TECHNOLOGIES PRIVATE LIMITED, IN. The main domain is invest.invescomutualfund.com.
TLS certificate: Issued by DigiCert EV RSA CA G2 on July 20th 2020. Valid for: a year.
This is the only time invest.invescomutualfund.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
7 103.147.26.236 140621 (KFPL-AS-A...)
8 2
Apex Domain
Subdomains
Transfer
7 invescomutualfund.com
invest.invescomutualfund.com
366 KB
0 googleapis.com Failed
fonts.googleapis.com Failed
8 2
Domain Requested by
7 invest.invescomutualfund.com invest.invescomutualfund.com
0 fonts.googleapis.com Failed invest.invescomutualfund.com
8 2

This site contains no links.

Subject Issuer Validity Valid
invescomutualfund.com
DigiCert EV RSA CA G2
2020-07-20 -
2021-07-21
a year crt.sh

This page contains 1 frames:

Primary Page: https://invest.invescomutualfund.com/dit/newinvestor/NewInvestor/Login
Frame ID: CFBB08CF6786EB9D40201E4B6B1C7836
Requests: 8 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
  • script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

Overall confidence: 100%
Detected patterns
  • headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

8
Requests

88 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

366 kB
Transfer

670 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Login
invest.invescomutualfund.com/dit/newinvestor/NewInvestor/
37 KB
13 KB
Document
General
Full URL
https://invest.invescomutualfund.com/dit/newinvestor/NewInvestor/Login?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
103.147.26.236 , India, ASN140621 (KFPL-AS-AP KFIN TECHNOLOGIES PRIVATE LIMITED, IN),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
7f516f1d5e9f019ed63cc1e34f2af2c95f1f435dc6b5074015f7c56bbf381a1c
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' https://invest.invescomutualfund.com; style-src 'self' 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
invest.invescomutualfund.com
:scheme
https
:path
/dit/newinvestor/NewInvestor/Login?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cache-control
private,no-cache, no-store, must-revalidate, pre-check=0, post-check=0, max-age=0, s-maxage=0
pragma
no-cache
content-type
text/html; charset=utf-8
content-encoding
gzip
expires
0
vary
Accept-Encoding
server
Microsoft-IIS/10.0
set-cookie
ASP.NET_SessionId=ql41idwccdpyamrrl4pqo2tb; path=/; secure; HttpOnly; SameSite=Lax
x-aspnetmvc-version
4.0
x-frame-options
sameorigin
strict-transport-security
max-age=31536000; includeSubDomains
x-xss-protection
1; mode=block
x-content-type-options
nosniff
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' https://invest.invescomutualfund.com; style-src 'self' 'unsafe-inline'
referrer-policy
strict-origin
date
Thu, 08 Jul 2021 07:43:17 GMT
content-length
12431
bootstrap.min.css
invest.invescomutualfund.com/dit/newinvestor/Content/css/
118 KB
27 KB
Stylesheet
General
Full URL
https://invest.invescomutualfund.com/dit/newinvestor/Content/css/bootstrap.min.css
Requested by
Host: invest.invescomutualfund.com
URL: https://invest.invescomutualfund.com/dit/newinvestor/NewInvestor/Login?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
103.147.26.236 , India, ASN140621 (KFPL-AS-AP KFIN TECHNOLOGIES PRIVATE LIMITED, IN),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' https://invest.invescomutualfund.com; style-src 'self' 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/dit/newinvestor/Content/css/bootstrap.min.css
pragma
no-cache
cookie
ASP.NET_SessionId=ql41idwccdpyamrrl4pqo2tb
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
invest.invescomutualfund.com
referer
https://invest.invescomutualfund.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://invest.invescomutualfund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-length
27676
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin
last-modified
Mon, 25 Jul 2016 10:23:28 GMT
server
Microsoft-IIS/10.0
x-frame-options
sameorigin
date
Thu, 08 Jul 2021 07:43:17 GMT
vary
Accept-Encoding
content-type
text/css
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0, max-age=0, s-maxage=0
etag
"09080955ee6d11:0"
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' https://invest.invescomutualfund.com; style-src 'self' 'unsafe-inline'
accept-ranges
bytes
expires
0
layout.min.css
invest.invescomutualfund.com/dit/newinvestor/Content/css/
148 KB
32 KB
Stylesheet
General
Full URL
https://invest.invescomutualfund.com/dit/newinvestor/Content/css/layout.min.css
Requested by
Host: invest.invescomutualfund.com
URL: https://invest.invescomutualfund.com/dit/newinvestor/NewInvestor/Login?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
103.147.26.236 , India, ASN140621 (KFPL-AS-AP KFIN TECHNOLOGIES PRIVATE LIMITED, IN),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
25b81f0d0fc7f98c88ceb7d1c8139913f0ef28a38b7b38622bf87cfb5cf5a925
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' https://invest.invescomutualfund.com; style-src 'self' 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/dit/newinvestor/Content/css/layout.min.css
pragma
no-cache
cookie
ASP.NET_SessionId=ql41idwccdpyamrrl4pqo2tb
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
invest.invescomutualfund.com
referer
https://invest.invescomutualfund.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://invest.invescomutualfund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-length
32918
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin
last-modified
Mon, 04 Jun 2018 14:55:53 GMT
server
Microsoft-IIS/10.0
x-frame-options
sameorigin
date
Thu, 08 Jul 2021 07:43:17 GMT
vary
Accept-Encoding
content-type
text/css
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0, max-age=0, s-maxage=0
etag
"997b9c2214fcd31:0"
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' https://invest.invescomutualfund.com; style-src 'self' 'unsafe-inline'
accept-ranges
bytes
expires
0
jquery.min.js
invest.invescomutualfund.com/dit/newinvestor/Content/js/
90 KB
41 KB
Script
General
Full URL
https://invest.invescomutualfund.com/dit/newinvestor/Content/js/jquery.min.js
Requested by
Host: invest.invescomutualfund.com
URL: https://invest.invescomutualfund.com/dit/newinvestor/NewInvestor/Login?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
103.147.26.236 , India, ASN140621 (KFPL-AS-AP KFIN TECHNOLOGIES PRIVATE LIMITED, IN),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' https://invest.invescomutualfund.com; style-src 'self' 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/dit/newinvestor/Content/js/jquery.min.js
pragma
no-cache
cookie
ASP.NET_SessionId=ql41idwccdpyamrrl4pqo2tb
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
invest.invescomutualfund.com
referer
https://invest.invescomutualfund.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://invest.invescomutualfund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-length
41473
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin
last-modified
Mon, 25 Sep 2017 11:02:14 GMT
server
Microsoft-IIS/10.0
x-frame-options
sameorigin
date
Thu, 08 Jul 2021 07:43:17 GMT
vary
Accept-Encoding
content-type
application/javascript
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0, max-age=0, s-maxage=0
etag
"03f4bbeed35d31:0"
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' https://invest.invescomutualfund.com; style-src 'self' 'unsafe-inline'
accept-ranges
bytes
expires
0
bootstrap.min.js
invest.invescomutualfund.com/dit/newinvestor/Content/js/
36 KB
13 KB
Script
General
Full URL
https://invest.invescomutualfund.com/dit/newinvestor/Content/js/bootstrap.min.js
Requested by
Host: invest.invescomutualfund.com
URL: https://invest.invescomutualfund.com/dit/newinvestor/NewInvestor/Login?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
103.147.26.236 , India, ASN140621 (KFPL-AS-AP KFIN TECHNOLOGIES PRIVATE LIMITED, IN),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' https://invest.invescomutualfund.com; style-src 'self' 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/dit/newinvestor/Content/js/bootstrap.min.js
pragma
no-cache
cookie
ASP.NET_SessionId=ql41idwccdpyamrrl4pqo2tb
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
invest.invescomutualfund.com
referer
https://invest.invescomutualfund.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://invest.invescomutualfund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-length
13045
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin
last-modified
Mon, 25 Jul 2016 10:23:30 GMT
server
Microsoft-IIS/10.0
x-frame-options
sameorigin
date
Thu, 08 Jul 2021 07:43:17 GMT
vary
Accept-Encoding
content-type
application/javascript
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0, max-age=0, s-maxage=0
etag
"0bdb1965ee6d11:0"
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' https://invest.invescomutualfund.com; style-src 'self' 'unsafe-inline'
accept-ranges
bytes
expires
0
inv_logo_mf.png
invest.invescomutualfund.com/dit/newinvestor/Content/img/
78 KB
79 KB
Image
General
Full URL
https://invest.invescomutualfund.com/dit/newinvestor/Content/img/inv_logo_mf.png
Requested by
Host: invest.invescomutualfund.com
URL: https://invest.invescomutualfund.com/dit/newinvestor/NewInvestor/Login?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
103.147.26.236 , India, ASN140621 (KFPL-AS-AP KFIN TECHNOLOGIES PRIVATE LIMITED, IN),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
18173fa2356004075ea0e2d88d0635beadfda8e1892f69ea9aabca1de8421211
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' https://invest.invescomutualfund.com; style-src 'self' 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/dit/newinvestor/Content/img/inv_logo_mf.png
pragma
no-cache
cookie
ASP.NET_SessionId=ql41idwccdpyamrrl4pqo2tb
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
invest.invescomutualfund.com
referer
https://invest.invescomutualfund.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://invest.invescomutualfund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-length
80269
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin
last-modified
Fri, 04 Aug 2017 05:47:50 GMT
server
Microsoft-IIS/10.0
date
Thu, 08 Jul 2021 07:43:17 GMT
x-frame-options
sameorigin
content-type
image/png
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0, max-age=0, s-maxage=0
etag
"047fe34e5cd31:0"
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' https://invest.invescomutualfund.com; style-src 'self' 'unsafe-inline'
accept-ranges
bytes
expires
0
css
fonts.googleapis.com/
0
0

log_bg.jpg
invest.invescomutualfund.com/dit/newinvestor/Content/img/
162 KB
162 KB
Image
General
Full URL
https://invest.invescomutualfund.com/dit/newinvestor/Content/img/log_bg.jpg
Requested by
Host: invest.invescomutualfund.com
URL: https://invest.invescomutualfund.com/dit/newinvestor/Content/css/layout.min.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
103.147.26.236 , India, ASN140621 (KFPL-AS-AP KFIN TECHNOLOGIES PRIVATE LIMITED, IN),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
80a6bc447c7f2342f46e5d7ee465d82222d70ea6824cf9eca40f97b4c0cb5818
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' https://invest.invescomutualfund.com; style-src 'self' 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/dit/newinvestor/Content/img/log_bg.jpg
pragma
no-cache
cookie
ASP.NET_SessionId=ql41idwccdpyamrrl4pqo2tb
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
invest.invescomutualfund.com
referer
https://invest.invescomutualfund.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://invest.invescomutualfund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-length
165810
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin
last-modified
Thu, 03 Aug 2017 13:56:28 GMT
server
Microsoft-IIS/10.0
date
Thu, 08 Jul 2021 07:43:17 GMT
x-frame-options
sameorigin
content-type
image/jpeg
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0, max-age=0, s-maxage=0
etag
"04e784d60cd31:0"
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' https://invest.invescomutualfund.com; style-src 'self' 'unsafe-inline'
accept-ranges
bytes
expires
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
fonts.googleapis.com
URL
https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,700

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| jQuery19105805431292327752 function| LoginCheck function| validateNewInvestor function| Privacypopclose function| Disclaimerpopclose

1 Cookies

Domain/Path Name / Value
invest.invescomutualfund.com/ Name: ASP.NET_SessionId
Value: ql41idwccdpyamrrl4pqo2tb

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' https://invest.invescomutualfund.com; style-src 'self' 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block