URL: https://login.sunprime.net/
Submission: On August 07 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 8 HTTP transactions. The main IP is 2620:1ec:46::45, located in United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is login.sunprime.net.
TLS certificate: Issued by GeoTrust Global TLS RSA4096 SHA256 20... on August 7th 2023. Valid for: 6 months.
This is the only time login.sunprime.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
6 2620:1ec:46::45 8075 (MICROSOFT...)
2 2a04:4e42:200... 54113 (FASTLY)
8 3
Apex Domain
Subdomains
Transfer
6 sunprime.net
login.sunprime.net
124 KB
2 ving.se
img.ving.se
37 KB
8 2
Domain Requested by
6 login.sunprime.net login.sunprime.net
2 img.ving.se login.sunprime.net
8 2

This site contains no links.

Subject Issuer Validity Valid
login.sunprime.net
GeoTrust Global TLS RSA4096 SHA256 2022 CA1
2023-08-07 -
2024-02-07
6 months crt.sh
img.ving.se
GlobalSign Atlas R3 DV TLS CA 2023 Q1
2023-04-09 -
2024-05-10
a year crt.sh

This page contains 1 frames:

Primary Page: https://login.sunprime.net/
Frame ID: 005ADF3C03CDB49DA1FD9E20900314B9
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Login app

Page Statistics

8
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

161 kB
Transfer

302 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
login.sunprime.net/
18 KB
10 KB
Document
General
Full URL
https://login.sunprime.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
1946191357f8a0b08e06679241bcc00dc5ece55c761eaf7fa1d6b7e36f0e72e1
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline';default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
arr-disable-session-affinity
true
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-length
9305
content-security-policy
script-src 'self' 'unsafe-inline';default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
same-origin
date
Mon, 07 Aug 2023 16:02:52 GMT
origin-agent-cluster
?1
referrer-policy
no-referrer
server-timing
dtSInfo;desc="0", dtRpid;desc="-23684773"
strict-transport-security
max-age=15552000; includeSubDomains
traceresponse
00-d065def9251004667c2a7252e9f67112-1d6750c7af2f4dd0-01
vary
Accept-Encoding
x-azure-ref
20230807T160252Z-wcvk1uqqdd1hme2ffeykdrrwr400000009r0000000008vew
x-cache
CONFIG_NOCACHE
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-download-options
noopen
x-dt-tracestate
d179cb54-eae04eec@dt
x-frame-options
SAMEORIGIN
x-permitted-cross-domain-policies
none
x-xss-protection
0
index.801b7298.js
login.sunprime.net/assets/
6 KB
4 KB
Script
General
Full URL
https://login.sunprime.net/assets/index.801b7298.js
Requested by
Host: login.sunprime.net
URL: https://login.sunprime.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
b517d8d943e6e54a958349987720fb7891322d5e47a4915276af37a7eabd075b
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline';default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
Origin
https://login.sunprime.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 16:02:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
script-src 'self' 'unsafe-inline';default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=15552000; includeSubDomains
cross-origin-embedder-policy
require-corp
traceresponse
00-1d815fc1778bd35c1d315b74e5c1a25f-fb2f8ff3ec1a5065-01
x-dns-prefetch-control
off
x-cache
CONFIG_NOCACHE
arr-disable-session-affinity
true
cross-origin-resource-policy
same-origin
server-timing
dtSInfo;desc="0", dtRpid;desc="645496258", dtTao;desc="1"
content-length
3066
x-xss-protection
0
referrer-policy
no-referrer
last-modified
Fri, 12 May 2023 09:13:24 GMT
x-dt-tracestate
d179cb54-eae04eec@dt
cross-origin-opener-policy
same-origin
x-download-options
noopen
vary
Origin,Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
access-control-allow-origin
*
origin-agent-cluster
?1
cache-control
public, max-age=31536000, immutable
access-control-allow-credentials
true
x-azure-ref
20230807T160252Z-wcvk1uqqdd1hme2ffeykdrrwr400000009r0000000008vf6
accept-ranges
bytes
timing-allow-origin
*
vendor.aef1860a.js
login.sunprime.net/assets/
217 KB
91 KB
Script
General
Full URL
https://login.sunprime.net/assets/vendor.aef1860a.js
Requested by
Host: login.sunprime.net
URL: https://login.sunprime.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
a5fff2fc7827032516732a5a4691a90c6c08760f63075c30e83dd48d2e9ecc25
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline';default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
Origin
https://login.sunprime.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 16:02:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
script-src 'self' 'unsafe-inline';default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=15552000; includeSubDomains
cross-origin-embedder-policy
require-corp
traceresponse
00-d9506327547789a9b611f832bbf52970-468ddc99587e34ac-01
x-dns-prefetch-control
off
x-cache
CONFIG_NOCACHE
arr-disable-session-affinity
true
cross-origin-resource-policy
same-origin
server-timing
dtSInfo;desc="0", dtRpid;desc="1478489582", dtTao;desc="1"
x-xss-protection
0
referrer-policy
no-referrer
last-modified
Fri, 12 May 2023 09:13:24 GMT
x-dt-tracestate
d179cb54-eae04eec@dt
cross-origin-opener-policy
same-origin
x-download-options
noopen
vary
Origin,Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
access-control-allow-origin
*
origin-agent-cluster
?1
cache-control
public, max-age=31536000, immutable
access-control-allow-credentials
true
x-azure-ref
20230807T160252Z-wcvk1uqqdd1hme2ffeykdrrwr400000009r0000000008vf8
timing-allow-origin
*
index.66456018.css
login.sunprime.net/assets/
8 KB
4 KB
Stylesheet
General
Full URL
https://login.sunprime.net/assets/index.66456018.css
Requested by
Host: login.sunprime.net
URL: https://login.sunprime.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
3fc0c9cb1ae01147b69dae0b39c7060823cf618ff96ca85dd033dd6559f3744e
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline';default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 16:02:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
script-src 'self' 'unsafe-inline';default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=15552000; includeSubDomains
cross-origin-embedder-policy
require-corp
traceresponse
00-9e29b38ec98c626d3a93c920980074a0-23705b566ee2184e-01
x-dns-prefetch-control
off
x-cache
CONFIG_NOCACHE
arr-disable-session-affinity
true
cross-origin-resource-policy
same-origin
server-timing
dtSInfo;desc="0", dtRpid;desc="-1478741844"
content-length
2934
x-xss-protection
0
referrer-policy
no-referrer
last-modified
Fri, 12 May 2023 09:13:24 GMT
x-dt-tracestate
d179cb54-eae04eec@dt
cross-origin-opener-policy
same-origin
x-download-options
noopen
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
access-control-allow-origin
*
origin-agent-cluster
?1
cache-control
public, max-age=31536000, immutable
x-azure-ref
20230807T160252Z-wcvk1uqqdd1hme2ffeykdrrwr400000009r0000000008vf7
accept-ranges
bytes
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
33899cb93f63eab63efbec3f441a44c493814d999accb7d6273497d59e7e3d2f

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
image/webp
thomasheadlinebold-webfont.woff
img.ving.se/raw/upload/fonts/
21 KB
21 KB
Font
General
Full URL
https://img.ving.se/raw/upload/fonts/thomasheadlinebold-webfont.woff
Requested by
Host: login.sunprime.net
URL: https://login.sunprime.net/assets/index.66456018.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::604 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cloudinary /
Resource Hash
1dcab336da7075d363a98b55ecc00a692f2212bff3078b014661c9f69517b6a3
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
Origin
https://login.sunprime.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 16:02:52 GMT
strict-transport-security
max-age=604800
last-modified
Mon, 20 Sep 2021 06:48:16 GMT
server
Cloudinary
etag
"f5898ec51462794d995d281d425b068a"
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Disposition,ETag,Server-Timing
cache-control
public, no-transform, immutable, max-age=31557600
content-disposition
attachment; filename="ht7cutsmr0gsrv7lldo9.woff"
server-timing
cld-fastly;mitm=p;dur=2;cpu=0;start=2023-08-07T16:02:52.541Z;desc=hit,rtt;dur=38
accept-ranges
bytes
timing-allow-origin
*
content-length
21416
source-sans-pro-v11-latin-regular.woff2
img.ving.se/raw/upload/fonts/
16 KB
16 KB
Font
General
Full URL
https://img.ving.se/raw/upload/fonts/source-sans-pro-v11-latin-regular.woff2
Requested by
Host: login.sunprime.net
URL: https://login.sunprime.net/assets/index.66456018.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::604 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cloudinary /
Resource Hash
cb992eae898417162c48b37712991d9ad8053c4a64fce51aff195edc69dc35f2
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
Origin
https://login.sunprime.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 16:02:52 GMT
strict-transport-security
max-age=604800
last-modified
Mon, 20 Sep 2021 06:47:17 GMT
server
Cloudinary
etag
"76d8cbb0496cb184eff868152b67ad45"
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Disposition,ETag,Server-Timing
cache-control
public, no-transform, immutable, max-age=31557600
content-disposition
attachment; filename="lmvkw36dffwvaelveun3.woff2"
server-timing
cld-fastly;mitm=p;dur=2;cpu=0;start=2023-08-07T16:02:52.541Z;desc=hit,rtt;dur=38
accept-ranges
bytes
timing-allow-origin
*
content-length
15908
Standalone.90219991.js
login.sunprime.net/assets/
13 KB
13 KB
Script
General
Full URL
https://login.sunprime.net/assets/Standalone.90219991.js
Requested by
Host: login.sunprime.net
URL: https://login.sunprime.net/assets/index.801b7298.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
a9fa882e65db94d5dd19959be79be1e7e796c046c1ae84b0cf453e6231959d11
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline';default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
Origin
https://login.sunprime.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 16:02:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
script-src 'self' 'unsafe-inline';default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=15552000; includeSubDomains
cross-origin-embedder-policy
require-corp
traceresponse
00-5ae06c09d885878ea16aca727905cb18-ff80b997104ac74e-01
x-dns-prefetch-control
off
x-cache
CONFIG_NOCACHE
arr-disable-session-affinity
true
cross-origin-resource-policy
same-origin
server-timing
dtSInfo;desc="0", dtRpid;desc="-1631214753", dtTao;desc="1"
content-length
12349
x-xss-protection
0
referrer-policy
no-referrer
last-modified
Fri, 12 May 2023 09:13:24 GMT
x-dt-tracestate
d179cb54-eae04eec@dt
cross-origin-opener-policy
same-origin
x-download-options
noopen
vary
Origin,Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
access-control-allow-origin
*
origin-agent-cluster
?1
cache-control
public, max-age=31536000, immutable
access-control-allow-credentials
true
x-azure-ref
20230807T160252Z-wcvk1uqqdd1hme2ffeykdrrwr400000009r0000000008vg7
accept-ranges
bytes
timing-allow-origin
*
siteId.d86043cd.js
login.sunprime.net/assets/
565 B
2 KB
Script
General
Full URL
https://login.sunprime.net/assets/siteId.d86043cd.js
Requested by
Host: login.sunprime.net
URL: https://login.sunprime.net/assets/index.801b7298.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
891abe19f570ee24f6c1f288ef036921773f1c0b2af91bc72e18beda66d8f047
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline';default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
Origin
https://login.sunprime.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 16:02:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
script-src 'self' 'unsafe-inline';default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=15552000; includeSubDomains
cross-origin-embedder-policy
require-corp
traceresponse
00-c5eed77934b58930933096a88fc677ec-c7424ec91c9fe98c-01
x-dns-prefetch-control
off
x-cache
CONFIG_NOCACHE
arr-disable-session-affinity
true
cross-origin-resource-policy
same-origin
server-timing
dtSInfo;desc="0", dtRpid;desc="1417888854", dtTao;desc="1"
content-length
514
x-xss-protection
0
referrer-policy
no-referrer
last-modified
Fri, 12 May 2023 09:13:24 GMT
x-dt-tracestate
d179cb54-eae04eec@dt
cross-origin-opener-policy
same-origin
x-download-options
noopen
vary
Origin,Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
access-control-allow-origin
*
origin-agent-cluster
?1
cache-control
public, max-age=31536000, immutable
access-control-allow-credentials
true
x-azure-ref
20230807T160252Z-wcvk1uqqdd1hme2ffeykdrrwr400000009r0000000008vg8
accept-ranges
bytes
timing-allow-origin
*

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| __INITIAL_STATE_LOGIN__ string| __BASE_LOGIN__

1 Cookies

Domain/Path Name / Value
.sunprime.net/ Name: dtCookie
Value: v_4_srv_6_sn_BF0735AAE0BA09389D29F51C4C037641_perc_100000_ol_0_mul_1_app-3A10e21b74bf8b675d_1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy script-src 'self' 'unsafe-inline';default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0