Submitted URL: https://bench.myquotewin.com/SupplyWin
Effective URL: https://bench.myquotewin.com/SupplyWin/login
Submission: On October 08 via api from US — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 52.222.77.19, located in Boardman, United States and belongs to AMAZON EXPANSION, IE. The main domain is bench.myquotewin.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on July 12th 2021. Valid for: a year.
This is the only time bench.myquotewin.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 12 52.222.77.19 8987 (AMAZON EX...)
9 1
Apex Domain
Subdomains
Transfer
12 myquotewin.com
bench.myquotewin.com
184 KB
9 1
Domain Requested by
12 bench.myquotewin.com 3 redirects bench.myquotewin.com
9 1

This site contains links to these domains. Also see Links.

Domain
supplyframe.com
Subject Issuer Validity Valid
*.myquotewin.com
DigiCert TLS RSA SHA256 2020 CA1
2021-07-12 -
2022-07-19
a year crt.sh

This page contains 1 frames:

Primary Page: https://bench.myquotewin.com/SupplyWin/login
Frame ID: 60A42C5EEA51FBF9BA058DB551112676
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Supplyframe Inc.

Page URL History Show full URLs

  1. https://bench.myquotewin.com/SupplyWin HTTP 302
    http://bench.myquotewin.com/SupplyWin/ HTTP 307
    https://bench.myquotewin.com/SupplyWin/ HTTP 302
    https://bench.myquotewin.com/SupplyWin/main?ACTION=DISPLAY_EULA& HTTP 302
    https://bench.myquotewin.com/SupplyWin/login Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

183 kB
Transfer

180 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://bench.myquotewin.com/SupplyWin HTTP 302
    http://bench.myquotewin.com/SupplyWin/ HTTP 307
    https://bench.myquotewin.com/SupplyWin/ HTTP 302
    https://bench.myquotewin.com/SupplyWin/main?ACTION=DISPLAY_EULA& HTTP 302
    https://bench.myquotewin.com/SupplyWin/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login
bench.myquotewin.com/SupplyWin/
Redirect Chain
  • https://bench.myquotewin.com/SupplyWin
  • http://bench.myquotewin.com/SupplyWin/
  • https://bench.myquotewin.com/SupplyWin/
  • https://bench.myquotewin.com/SupplyWin/main?ACTION=DISPLAY_EULA&
  • https://bench.myquotewin.com/SupplyWin/login
9 KB
9 KB
Document
General
Full URL
https://bench.myquotewin.com/SupplyWin/login
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.222.77.19 Boardman, United States, ASN8987 (AMAZON EXPANSION, IE),
Reverse DNS
mail02.rfxix.com
Software
/
Resource Hash
52fd45d29835286d2a355f9da82af1c487f15fdd0f43348e826bba7acb3970f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains max-age=15768000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
bench.myquotewin.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Cookie
JSESSIONID=864DFA1AC6513304B0CE80EE0807AE5E
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Pragma
no-cache
Expires
0
Strict-Transport-Security
max-age=31536000 ; includeSubDomains max-age=15768000
X-Frame-Options
SAMEORIGIN
Content-Type
text/html;charset=UTF-8
Content-Language
de-DE
Transfer-Encoding
chunked
Date
Fri, 08 Oct 2021 16:51:32 GMT

Redirect headers

Set-Cookie
JSESSIONID=864DFA1AC6513304B0CE80EE0807AE5E; Path=/SupplyWin; Secure; HttpOnly
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Pragma
no-cache
Expires
0
Strict-Transport-Security
max-age=31536000 ; includeSubDomains max-age=15768000
X-Frame-Options
SAMEORIGIN
Location
https://bench.myquotewin.com/SupplyWin/login
Content-Length
0
Date
Fri, 08 Oct 2021 16:51:32 GMT
supplywin_temp.css
bench.myquotewin.com/SupplyWin/css/login/
3 KB
3 KB
Stylesheet
General
Full URL
https://bench.myquotewin.com/SupplyWin/css/login/supplywin_temp.css
Requested by
Host: bench.myquotewin.com
URL: https://bench.myquotewin.com/SupplyWin/login
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.222.77.19 Boardman, United States, ASN8987 (AMAZON EXPANSION, IE),
Reverse DNS
mail02.rfxix.com
Software
/
Resource Hash
6c13e95c6190acf8ddce71dfe922143cf6e14290ad9096aeb18bbee1c92b01d2
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
bench.myquotewin.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://bench.myquotewin.com/SupplyWin/login
Cookie
JSESSIONID=864DFA1AC6513304B0CE80EE0807AE5E
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://bench.myquotewin.com/SupplyWin/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Fri, 08 Oct 2021 16:51:32 GMT
Vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
Last-Modified
Sat, 02 Oct 2021 14:42:07 GMT
Accept-Ranges
bytes
Content-Length
2715
Strict-Transport-Security
max-age=15768000
Content-Type
text/css
supplywin.css
bench.myquotewin.com/SupplyWin/css/login/
3 KB
3 KB
Stylesheet
General
Full URL
https://bench.myquotewin.com/SupplyWin/css/login/supplywin.css
Requested by
Host: bench.myquotewin.com
URL: https://bench.myquotewin.com/SupplyWin/login
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.222.77.19 Boardman, United States, ASN8987 (AMAZON EXPANSION, IE),
Reverse DNS
mail02.rfxix.com
Software
/
Resource Hash
287a7f5d64fc1c87fe053036c6776fcb6ff370fd404e841ece8ed617b1a1c7e8
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
bench.myquotewin.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://bench.myquotewin.com/SupplyWin/login
Cookie
JSESSIONID=864DFA1AC6513304B0CE80EE0807AE5E
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://bench.myquotewin.com/SupplyWin/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Fri, 08 Oct 2021 16:51:32 GMT
Vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
Last-Modified
Sat, 02 Oct 2021 14:42:07 GMT
Accept-Ranges
bytes
Content-Length
2928
Strict-Transport-Security
max-age=15768000
Content-Type
text/css
toastr.min.css
bench.myquotewin.com/SupplyWin/css/
5 KB
6 KB
Stylesheet
General
Full URL
https://bench.myquotewin.com/SupplyWin/css/toastr.min.css
Requested by
Host: bench.myquotewin.com
URL: https://bench.myquotewin.com/SupplyWin/login
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.222.77.19 Boardman, United States, ASN8987 (AMAZON EXPANSION, IE),
Reverse DNS
mail02.rfxix.com
Software
/
Resource Hash
561ab72887e145be776ad0321fd55a66eab9e2ee9091e62fa3a103d31c126efe
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
bench.myquotewin.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://bench.myquotewin.com/SupplyWin/login
Cookie
JSESSIONID=864DFA1AC6513304B0CE80EE0807AE5E
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://bench.myquotewin.com/SupplyWin/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Fri, 08 Oct 2021 16:51:33 GMT
Vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
Last-Modified
Sat, 02 Oct 2021 14:42:07 GMT
Accept-Ranges
bytes
Content-Length
5420
Strict-Transport-Security
max-age=15768000
Content-Type
text/css
sw.js
bench.myquotewin.com/SupplyWin/css/
4 KB
4 KB
Script
General
Full URL
https://bench.myquotewin.com/SupplyWin/css/sw.js
Requested by
Host: bench.myquotewin.com
URL: https://bench.myquotewin.com/SupplyWin/login
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.222.77.19 Boardman, United States, ASN8987 (AMAZON EXPANSION, IE),
Reverse DNS
mail02.rfxix.com
Software
/
Resource Hash
d4611ba4e992a91b386069c2bd926119572b5e959bcdaced919e12766dba21d1
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
bench.myquotewin.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://bench.myquotewin.com/SupplyWin/login
Cookie
JSESSIONID=864DFA1AC6513304B0CE80EE0807AE5E
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://bench.myquotewin.com/SupplyWin/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Fri, 08 Oct 2021 16:51:33 GMT
Vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
Last-Modified
Sat, 02 Oct 2021 14:42:07 GMT
Accept-Ranges
bytes
Content-Length
3851
Strict-Transport-Security
max-age=15768000
Content-Type
application/javascript
sw-login.jpg
bench.myquotewin.com/SupplyWin/images/login/
31 KB
31 KB
Image
General
Full URL
https://bench.myquotewin.com/SupplyWin/images/login/sw-login.jpg
Requested by
Host: bench.myquotewin.com
URL: https://bench.myquotewin.com/SupplyWin/login
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.222.77.19 Boardman, United States, ASN8987 (AMAZON EXPANSION, IE),
Reverse DNS
mail02.rfxix.com
Software
/
Resource Hash
4a7d460e607918c5e67c7db6daaff0a8cc914c5afdd2fe80121fd62ffeea1f05
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
bench.myquotewin.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://bench.myquotewin.com/SupplyWin/login
Cookie
JSESSIONID=864DFA1AC6513304B0CE80EE0807AE5E
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://bench.myquotewin.com/SupplyWin/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Fri, 08 Oct 2021 16:51:33 GMT
Vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
Last-Modified
Sat, 02 Oct 2021 14:42:07 GMT
Accept-Ranges
bytes
Content-Length
31525
Strict-Transport-Security
max-age=15768000
Content-Type
image/jpeg
jquery-1.11.1.min.js
bench.myquotewin.com/SupplyWin/js/
94 KB
94 KB
Script
General
Full URL
https://bench.myquotewin.com/SupplyWin/js/jquery-1.11.1.min.js
Requested by
Host: bench.myquotewin.com
URL: https://bench.myquotewin.com/SupplyWin/login
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.222.77.19 Boardman, United States, ASN8987 (AMAZON EXPANSION, IE),
Reverse DNS
mail02.rfxix.com
Software
/
Resource Hash
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
bench.myquotewin.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://bench.myquotewin.com/SupplyWin/login
Cookie
JSESSIONID=864DFA1AC6513304B0CE80EE0807AE5E
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://bench.myquotewin.com/SupplyWin/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Fri, 08 Oct 2021 16:51:33 GMT
Vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
Last-Modified
Sat, 02 Oct 2021 14:42:07 GMT
Accept-Ranges
bytes
Content-Length
95786
Strict-Transport-Security
max-age=15768000
Content-Type
application/javascript
toastr.min.js
bench.myquotewin.com/SupplyWin/js/
4 KB
4 KB
Script
General
Full URL
https://bench.myquotewin.com/SupplyWin/js/toastr.min.js
Requested by
Host: bench.myquotewin.com
URL: https://bench.myquotewin.com/SupplyWin/login
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.222.77.19 Boardman, United States, ASN8987 (AMAZON EXPANSION, IE),
Reverse DNS
mail02.rfxix.com
Software
/
Resource Hash
79658778157c03a8e7a481ae4a1e6ef6c649ec6a14ebd0a446c2e235726936ef
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
bench.myquotewin.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://bench.myquotewin.com/SupplyWin/login
Cookie
JSESSIONID=864DFA1AC6513304B0CE80EE0807AE5E
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://bench.myquotewin.com/SupplyWin/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Fri, 08 Oct 2021 16:51:33 GMT
Vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
Last-Modified
Sat, 02 Oct 2021 14:42:07 GMT
Accept-Ranges
bytes
Content-Length
3695
Strict-Transport-Security
max-age=15768000
Content-Type
application/javascript
supplywin_new_grey.png
bench.myquotewin.com/SupplyWin/images/brand/
29 KB
30 KB
Image
General
Full URL
https://bench.myquotewin.com/SupplyWin/images/brand/supplywin_new_grey.png
Requested by
Host: bench.myquotewin.com
URL: https://bench.myquotewin.com/SupplyWin/css/login/supplywin_temp.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.222.77.19 Boardman, United States, ASN8987 (AMAZON EXPANSION, IE),
Reverse DNS
mail02.rfxix.com
Software
/
Resource Hash
d48527a327f5da595bee19d051d840106057e5ccff4e99d2485763e178635357
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
bench.myquotewin.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://bench.myquotewin.com/SupplyWin/css/login/supplywin_temp.css
Cookie
JSESSIONID=864DFA1AC6513304B0CE80EE0807AE5E
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://bench.myquotewin.com/SupplyWin/css/login/supplywin_temp.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Fri, 08 Oct 2021 16:51:33 GMT
Vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
Last-Modified
Sat, 02 Oct 2021 14:42:07 GMT
Accept-Ranges
bytes
Content-Length
30033
Strict-Transport-Security
max-age=15768000
Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster function| checkBrowser function| Import function| CloseQuote function| OpenWindow function| OpenWindowMenu function| OpenWindowWithName function| AddAlt function| SubmitPrice function| SubmitAction function| CloseWindow function| WinSize function| SetUrl function| focusOnError function| setClass function| setText function| formAction function| popupwindow object| CsrfInjection function| $ function| jQuery object| toastr string| msg string| errorType string| errorMsg

1 Cookies

Domain/Path Name / Value
bench.myquotewin.com/SupplyWin Name: JSESSIONID
Value: 864DFA1AC6513304B0CE80EE0807AE5E

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains max-age=15768000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block