urlscan.io logo urlscan.io
SecurityTrails logo

survey.zohopublic.com Open in urlscan Pro
204.141.42.97  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://sender.zohoinsights.com/ocgeturl/2d6f.327230a?l=a74a58e0-24ff-11eb-b55c-525400593a2d&m=a71a6f40-24ff-11eb-a890-5254005bf...
Effective URL: https://survey.zohopublic.com/zs/R0BUAG
Submission: On November 13 via manual from CN
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 1 countries across 6 domains to perform 9 HTTP transactions. The main IP is 204.141.42.97, located in United States and belongs to ZOHO-AS, US. The main domain is survey.zohopublic.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 4th 2020. Valid for: 2 years.
This is the only time survey.zohopublic.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 204.141.42.213 2639 (ZOHO-AS)
2 2 34.82.132.54 15169 (GOOGLE)
5 204.141.42.97 2639 (ZOHO-AS)
1 204.141.43.162 2639 (ZOHO-AS)
2 204.141.42.123 2639 (ZOHO-AS)
1 2600:9000:205... 16509 (AMAZON-02)
9 4
1    204.141.42.213 (United States)

ASN2639 (ZOHO-AS, US)
sender.zohoinsights.com
2    34.82.132.54 (United States)

ASN15169 (GOOGLE, US)
PTR: 54.132.82.34.bc.googleusercontent.com
pinsight.com
www.pinsight.com
5    204.141.42.97 (United States)

ASN2639 (ZOHO-AS, US)
survey.zohopublic.com
1    204.141.43.162 (United States)

ASN2639 (ZOHO-AS, US)
webfonts.zoho.com
2    204.141.42.123 (United States)

ASN2639 (ZOHO-AS, US)
css5.zohostatic.com
js5.zohostatic.com
1    2600:9000:2057:ec00:17:1b8f:e140:93a1 (United States)

ASN16509 (AMAZON-02, US)
webfonts.zohowebstatic.com
Domain Requested by
5 survey.zohopublic.com survey.zohopublic.com
1 webfonts.zohowebstatic.com webfonts.zoho.com
1 js5.zohostatic.com survey.zohopublic.com
1 css5.zohostatic.com survey.zohopublic.com
1 webfonts.zoho.com survey.zohopublic.com
1 www.pinsight.com 1 redirects
1 pinsight.com 1 redirects
1 sender.zohoinsights.com 1 redirects
9 8

This site contains links to these domains. Also see Links.

Domain
www.pinsight.com
Subject Issuer Validity Valid
*.zohopublic.com
Sectigo RSA Domain Validation Secure Server CA		 2020-03-04 -
2022-03-04		 2 years crt.sh
*.zoho.com
Thawte RSA CA 2018		 2020-05-31 -
2021-05-31		 a year crt.sh
*.zohostatic.com
Thawte RSA CA 2018		 2020-05-31 -
2021-05-31		 a year crt.sh
*.zohowebstatic.com
Sectigo RSA Domain Validation Secure Server CA		 2020-10-30 -
2021-10-30		 a year crt.sh

This page contains 1 frames:

Primary Page: https://survey.zohopublic.com/zs/R0BUAG
Frame ID: E8E31E13972C2F2806319CA21F3B800C
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://sender.zohoinsights.com/ocgeturl/2d6f.327230a?l=a74a58e0-24ff-11eb-b55c-525400593a2d&m=a71a6f40-24ff... HTTP 302
    http://pinsight.com/survey HTTP 301
    http://www.pinsight.com/survey HTTP 301
    https://survey.zohopublic.com/zs/R0BUAG Page URL

Page Statistics

9
Requests

100 %
HTTPS

17 %
IPv6

6
Domains

8
Subdomains

4
IPs

1
Countries

326 kB
Transfer

1208 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://sender.zohoinsights.com/ocgeturl/2d6f.327230a?l=a74a58e0-24ff-11eb-b55c-525400593a2d&m=a71a6f40-24ff-11eb-a890-5254005bf342&h=506651f999eba6c7d9cd74892d0ebed1d44994d168f3e03bc42e2a946aecff23 HTTP 302
    http://pinsight.com/survey HTTP 301
    http://www.pinsight.com/survey HTTP 301
    https://survey.zohopublic.com/zs/R0BUAG Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set R0BUAG
survey.zohopublic.com/zs/
Redirect Chain
  • https://sender.zohoinsights.com/ocgeturl/2d6f.327230a?l=a74a58e0-24ff-11eb-b55c-525400593a2d&m=a71a6f40-24ff-11eb-a890-5254005bf342&h=506651f999eba6c7d9cd74892d0ebed1d44994d168f3e03bc42e2a946aecff23
  • http://pinsight.com/survey
  • http://www.pinsight.com/survey
  • https://survey.zohopublic.com/zs/R0BUAG
74 KB
19 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://survey.zohopublic.com/zs/R0BUAG
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
204.141.42.97 , United States, ASN2639 (ZOHO-AS, US),
Reverse DNS
Software
ZGS /
Resource Hash
4f6f2df5bcde32983a255fd4fd8c7a66d4410993a29ea235475dbbf6302106d5
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Xss-Protection 1

Request headers

Host
survey.zohopublic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server
ZGS
Date
Fri, 13 Nov 2020 01:39:33 GMT
Content-Type
text/html;charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
53aac31ef0=3b8057df6a1ec0f8bf156c24686ac9bf; Path=/ aprmjrnpkcrkks=c7278eaf-6261-49ea-ae78-5d3ba0678f7a;path=/;SameSite=None;Secure;priority=high _zcsr_tmp=c7278eaf-6261-49ea-ae78-5d3ba0678f7a;path=/;SameSite=Strict;Secure;priority=high JSESSIONID=D9512701993FCEADB39C9A9C8CA38887; Path=/; Secure; HttpOnly
X-Content-Type-Options
nosniff
X-XSS-Protection
1
Pragma
no-cache
Cache-Control
no-cache, no-store, must-revalidate
Expires
0
vary
accept-encoding
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000

Redirect headers

Server
nginx
Date
Fri, 13 Nov 2020 01:39:32 GMT
Content-Type
text/html
Content-Length
162
Connection
keep-alive
Keep-Alive
timeout=20
Location
https://survey.zohopublic.com/zs/R0BUAG
css
webfonts.zoho.com/ 		31 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://webfonts.zoho.com/css?family=Playfair+Display/Raleway/Quicksand/Comfortaa/Flamenco/Abril+Fatface/Chivo/Arimo/Doppio+One/Cabin/Quando/Old+Standard+TT/Roboto/Open+Sans/Montserrat/Ubuntu/Cutive%20Mono/UniBurma_MSSerif/Karla/Heebo/Lato/Merriweather
Requested by
Host: survey.zohopublic.com
URL: https://survey.zohopublic.com/zs/R0BUAG
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
204.141.43.162 , United States, ASN2639 (ZOHO-AS, US),
Reverse DNS
Software
ZGS /
Resource Hash
3b957f3762b4d2c56e94c18e0aa62220845a49d0d460438e3f2280528be21ca0
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1

Request headers

Referer
https://survey.zohopublic.com/zs/R0BUAG
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 13 Nov 2020 01:39:33 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
ZGS
X-Frame-Options
SAMEORIGIN
Content-Type
text/css;charset=ISO-8859-1
Connection
keep-alive
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=63072000
Vary
Accept-Encoding
X-XSS-Protection
1
publishedform_utils.css
css5.zohostatic.com/zohosurvey/v6_11/dist/assets/styles/ 		323 KB
53 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://css5.zohostatic.com/zohosurvey/v6_11/dist/assets/styles/publishedform_utils.css
Requested by
Host: survey.zohopublic.com
URL: https://survey.zohopublic.com/zs/R0BUAG
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
204.141.42.123 , United States, ASN2639 (ZOHO-AS, US),
Reverse DNS
Software
ZGS /
Resource Hash
cc5c77e21c1c4413b8bd4850c284171ed3a22a95436baebd707ab0f623610624

Request headers

Referer
https://survey.zohopublic.com/zs/R0BUAG
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 13 Nov 2020 01:39:33 GMT
Content-Encoding
gzip
Last-Modified
Wed, 11 Nov 2020 08:19:40 GMT
Server
ZGS
ETag
"5fab9e9c-d2cf"
Content-Type
text/css
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
keep-alive
X-Robots-Tag
noindex, nofollow, nosnippet, noarchive
Content-Length
53967
Expires
Sat, 13 Nov 2021 01:39:33 GMT
publishedform_utils.js
js5.zohostatic.com/zohosurvey/v6_11/js/ 		701 KB
194 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js5.zohostatic.com/zohosurvey/v6_11/js/publishedform_utils.js
Requested by
Host: survey.zohopublic.com
URL: https://survey.zohopublic.com/zs/R0BUAG
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
204.141.42.123 , United States, ASN2639 (ZOHO-AS, US),
Reverse DNS
Software
ZGS /
Resource Hash
2fbbb755afbbe560e1c257802943e6e4353d45650f59abee283823f837701a7d

Request headers

Referer
https://survey.zohopublic.com/zs/R0BUAG
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 13 Nov 2020 01:39:33 GMT
Content-Encoding
gzip
Last-Modified
Wed, 11 Nov 2020 08:19:40 GMT
Server
ZGS
ETag
"5fab9e9c-30770"
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
keep-alive
X-Robots-Tag
noindex, nofollow, nosnippet, noarchive
Content-Length
198512
Expires
Sat, 13 Nov 2021 01:39:33 GMT
form-structure.css
survey.zohopublic.com/survey/themes/new/form-styles/ 		27 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://survey.zohopublic.com/survey/themes/new/form-styles/form-structure.css?nocache=1605231573058
Requested by
Host: survey.zohopublic.com
URL: https://survey.zohopublic.com/zs/R0BUAG
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
204.141.42.97 , United States, ASN2639 (ZOHO-AS, US),
Reverse DNS
Software
ZGS /
Resource Hash
359d482f0b8f5da6a44bcf7a5afaff07ff653c4ef456b57afd586021e2f6c51e
Security Headers
Name Value
Strict-Transport-Security max-age=604800, max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1

Request headers

Referer
https://survey.zohopublic.com/zs/R0BUAG
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 13 Nov 2020 01:39:33 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Transfer-Encoding
chunked
Connection
keep-alive
X-XSS-Protection
1
Pragma
public, max-age=31536000
Last-Modified
Wed, 11 Nov 2020 08:20:59 GMT
Server
ZGS
X-Frame-Options
SAMEORIGIN
ETag
W/"27292-1605082859000"
vary
accept-encoding
Strict-Transport-Security
max-age=604800, max-age=63072000
Content-Type
text/css
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Expires
Tue, 07 Sep 2021 11:21:42 GMT
base-form-media.css
survey.zohopublic.com/survey/themes/new/form-styles/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://survey.zohopublic.com/survey/themes/new/form-styles/base-form-media.css?nocache=1605231573059
Requested by
Host: survey.zohopublic.com
URL: https://survey.zohopublic.com/zs/R0BUAG
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
204.141.42.97 , United States, ASN2639 (ZOHO-AS, US),
Reverse DNS
Software
ZGS /
Resource Hash
8112589963110a383ea6267dbe55eceb83723bc73a2093e16fbd5efdf7e69070
Security Headers
Name Value
Strict-Transport-Security max-age=604800, max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1

Request headers

Referer
https://survey.zohopublic.com/zs/R0BUAG
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 13 Nov 2020 01:39:33 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Transfer-Encoding
chunked
Connection
keep-alive
X-XSS-Protection
1
Pragma
public, max-age=31536000
Last-Modified
Wed, 11 Nov 2020 08:20:59 GMT
Server
ZGS
X-Frame-Options
SAMEORIGIN
ETag
W/"6066-1605082859000"
vary
accept-encoding
Strict-Transport-Security
max-age=604800, max-age=63072000
Content-Type
text/css
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Expires
Tue, 07 Sep 2021 11:21:42 GMT
image
survey.zohopublic.com/survey/api/v1/public/livesurveys/R0BUAG/images/NTE3YjAwNzEtYzc4NS00YWZhLWIwMGMtMWE0ODE3NzhiZDk1/web/download/ 		29 KB
30 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://survey.zohopublic.com/survey/api/v1/public/livesurveys/R0BUAG/images/NTE3YjAwNzEtYzc4NS00YWZhLWIwMGMtMWE0ODE3NzhiZDk1/web/download/image?isoriginalfile=true
Requested by
Host: survey.zohopublic.com
URL: https://survey.zohopublic.com/zs/R0BUAG
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
204.141.42.97 , United States, ASN2639 (ZOHO-AS, US),
Reverse DNS
Software
ZGS /
Resource Hash
cc3c84f7bda990df886e7dedd6e4910f77fddc3a3469cf4e6b704735bd9bae7b
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1

Request headers

Referer
https://survey.zohopublic.com/zs/R0BUAG
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 13 Nov 2020 01:39:34 GMT
X-Content-Type-Options
nosniff
Server
ZGS
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=63072000
Content-Type
image/png;charset=utf-8
Access-Control-Allow-Origin
https://survey.zoho.com
Transfer-Encoding
chunked
Content-Disposition
attachment; filename=image
Connection
keep-alive
X-XSS-Protection
1
spacer.gif
survey.zohopublic.com/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://survey.zohopublic.com/images/spacer.gif
Requested by
Host: survey.zohopublic.com
URL: https://survey.zohopublic.com/zs/R0BUAG
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
204.141.42.97 , United States, ASN2639 (ZOHO-AS, US),
Reverse DNS
Software
ZGS /
Resource Hash
6224d6dbc337c3e605bc817112b755a8277d1c44250f42e3c1f184792b398e09
Security Headers
Name Value
Strict-Transport-Security max-age=604800, max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1

Request headers

Referer
https://survey.zohopublic.com/zs/R0BUAG
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public, max-age=31536000
Date
Fri, 13 Nov 2020 01:39:34 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 11 Nov 2020 08:21:01 GMT
Server
ZGS
X-Frame-Options
SAMEORIGIN
ETag
W/"1093-1605082861000"
Strict-Transport-Security
max-age=604800, max-age=63072000
Content-Type
image/gif
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1093
X-XSS-Protection
1
Expires
Tue, 07 Sep 2021 11:13:57 GMT
font_latin.woff2
webfonts.zohowebstatic.com/heeboregular/ 		17 KB
17 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://webfonts.zohowebstatic.com/heeboregular/font_latin.woff2
Requested by
Host: webfonts.zoho.com
URL: https://webfonts.zoho.com/css?family=Playfair+Display/Raleway/Quicksand/Comfortaa/Flamenco/Abril+Fatface/Chivo/Arimo/Doppio+One/Cabin/Quando/Old+Standard+TT/Roboto/Open+Sans/Montserrat/Ubuntu/Cutive%20Mono/UniBurma_MSSerif/Karla/Heebo/Lato/Merriweather
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:ec00:17:1b8f:e140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ZGS /
Resource Hash
4883dca00ded0ddcbd07588a67f81241a8e770115830e872fd935226fb7d0e60

Request headers

Origin
https://survey.zohopublic.com
Referer
https://webfonts.zoho.com/css?family=Playfair+Display/Raleway/Quicksand/Comfortaa/Flamenco/Abril+Fatface/Chivo/Arimo/Doppio+One/Cabin/Quando/Old+Standard+TT/Roboto/Open+Sans/Montserrat/Ubuntu/Cutive%20Mono/UniBurma_MSSerif/Karla/Heebo/Lato/Merriweather
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 23 Oct 2020 20:49:05 GMT
via
1.1 e7e7960d7731a7583cedd8f1ff1aca38.cloudfront.net (CloudFront)
age
1745428
x-cache
Hit from cloudfront
status
200
content-length
17040
last-modified
Tue, 25 Aug 2020 02:11:02 GMT
server
ZGS
etag
"5f447336-4290"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
x-amz-cf-id
PRYrmqIYeCjSbumMtenCIvZAG9htqT4NoIRUqFSNH4sCfiMZSaRUCA==
expires
Sat, 23 Oct 2021 20:49:05 GMT

Verdicts & Comments Add Verdict or Comment

38 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| constuctScrollScript function| getScrollScriptContext function| setScrollWithSelector function| checkHasOverflow object| ZSC object| BarName object| ReviewCons object| ZSMIXIN_CONS object| ZSMixin_Util object| ZSCommonUtil object| ZS_Utils function| ZSEncodeURIComponent object| RatingUtil object| ZSPublishLogic object| CollectResponse object| CacheResponse function| domObserver object| DOMobserver_mixin object| domObserverMixin function| noScroll function| initializeScrollWithSelector function| initializeScroll function| getScrollContext function| setScroll function| valueSetter object| CustomScroll function| $ function| jQuery object| jQuery111304536866621832849 object| NProgress object| SuperScrollbar object| Ss function| ZSDynamicScript object| pageArray

3 Cookies

Domain/Path Name / Value
survey.zohopublic.com/ Name: _zcsr_tmp
Value: 32c1d5c8-efe8-4ec8-91af-135fb2292953
survey.zohopublic.com/ Name: aprmjrnpkcrkks
Value: 32c1d5c8-efe8-4ec8-91af-135fb2292953
survey.zohopublic.com/ Name: 53aac31ef0
Value: 49d80eda11b92e69d89cbae0b1005b16

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Xss-Protection 1