urlscan.io logo urlscan.io
SecurityTrails logo

player.vimeo.com Open in urlscan Pro
151.101.12.217  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://click.mail.virginpulse.com/?qs=7380d1b2f401cd38884d5092b298a5130ab8cc84796052a6893ce3828b9af31965b398413ae2651b93975016a0b6...
Effective URL: https://player.vimeo.com/video/585501183?utm_source=sfmc&utm_medium=email&utm_campaign=74526
Submission: On August 26 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 151.101.12.217, located in Frankfurt am Main, Germany and belongs to FASTLY, US. The main domain is player.vimeo.com.
TLS certificate: Issued by GlobalSign Atlas R3 DV TLS CA 2020 on May 21st 2021. Valid for: a year.
This is the only time player.vimeo.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 13.111.159.142 22606 (EXACT-7)
1 151.101.12.217 54113 (FASTLY)
5 151.101.14.109 54113 (FASTLY)
6 2
Apex Domain
Subdomains		 Transfer
5 vimeocdn.com
i.vimeocdn.com
f.vimeocdn.com
191 KB
1 vimeo.com
player.vimeo.com
18 KB
1 virginpulse.com
click.mail.virginpulse.com
267 B
6 3
Domain Requested by
3 i.vimeocdn.com player.vimeo.com
2 f.vimeocdn.com player.vimeo.com
1 player.vimeo.com
1 click.mail.virginpulse.com 1 redirects
6 4

This site contains no links.

Subject Issuer Validity Valid
*.vimeo.com
GlobalSign Atlas R3 DV TLS CA 2020		 2021-05-21 -
2022-06-22		 a year crt.sh
*.vimeocdn.com
GlobalSign Atlas R3 DV TLS CA 2020		 2021-05-18 -
2022-06-19		 a year crt.sh

This page contains 1 frames:

Primary Page: https://player.vimeo.com/video/585501183?utm_source=sfmc&utm_medium=email&utm_campaign=74526
Frame ID: EA6B8D013E28F9E5CF2312B43379C031
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Connecting for Good Challenge from Virgin Pulse on VimeoPlayPausePlayChoose captionsSettingsEnter full screenExit full screen

Page URL History Show full URLs

  1. https://click.mail.virginpulse.com/?qs=7380d1b2f401cd38884d5092b298a5130ab8cc84796052a6893ce3828b9af31965b39841... HTTP 302
    https://player.vimeo.com/video/585501183?utm_source=sfmc&utm_medium=email&utm_campaign=74526 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers via /varnish(?: \(Varnish\/([\d.]+)\))?/i

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

2
IPs

2
Countries

209 kB
Transfer

855 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://click.mail.virginpulse.com/?qs=7380d1b2f401cd38884d5092b298a5130ab8cc84796052a6893ce3828b9af31965b398413ae2651b93975016a0b67bbbb251079a78967a65 HTTP 302
    https://player.vimeo.com/video/585501183?utm_source=sfmc&utm_medium=email&utm_campaign=74526 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 585501183
player.vimeo.com/video/
Redirect Chain
  • https://click.mail.virginpulse.com/?qs=7380d1b2f401cd38884d5092b298a5130ab8cc84796052a6893ce3828b9af31965b398413ae2651b93975016a0b67bbbb251079a78967a65
  • https://player.vimeo.com/video/585501183?utm_source=sfmc&utm_medium=email&utm_campaign=74526
20 KB
18 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://player.vimeo.com/video/585501183?utm_source=sfmc&utm_medium=email&utm_campaign=74526
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
dc8a5c685989d5dee124c68a3c6125fddce62d9e6fb7dbf80434400353ea62fa
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline' blob: resource: https://f.vimeocdn.com https://vimeo.com https://js-agent.newrelic.com https://imasdk.googleapis.com/ https://adservice.google.com/ https://s0.2mdn.net/instream/video/ https://bam.nr-data.net https://src.litix.io https://www.gstatic.com https://cdn.streamroot.io https://wirewax.s3.eu-west-1.amazonaws.com https://f.vimeocdn.com; style-src 'self' 'unsafe-inline' https://f.vimeocdn.com https://f.vimeocdn.com; connect-src 'self' ws: wss: https://vimeo.com https://vimeo.dev https://api.vimeo.com https://api.vimeo.dev https://*.ci.vimeows.com https://csi.gstatic.com https://fresnel.vimeocdn.com https://fresnel-player-staging.vimeows.com https://player-telemetry.vimeo.com https://*.akamaized.net https://*.akamaized-staging.net https://*.vimeocdn.com https://netflux.cloud.vimeo.com https://lic.staging.drmtoday.com https://lic.drmtoday.com https://wv.service.expressplay.com https://fp.service.expressplay.com https://pr.service.expressplay.com https://sentry.io https://*.ingest.sentry.io https://storage.googleapis.com https://bam.nr-data.net https://live-api.cloud.vimeo.com https://live-api-dev.cloud.vimeo.com https://*.litix.io/ https://collector.vhx.tv https://collector.vhxstaging.com https://backend.dna-delivery.com https://mimir.cloud.vimeo.com https://*.wirewax.com https://wirewax.s3.eu-west-1.amazonaws.com https://sqs.us-east-1.amazonaws.com; media-src 'self' blob: https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net https://*.gvt1.com https://live-api.cloud.vimeo.com https://live-api-dev.cloud.vimeo.com; object-src 'self' https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net; default-src 'none'; img-src 'self' data: https://i.vimeocdn.com https://secure-b.vimeocdn.com https://f.vimeocdn.com https://vimeo.com https://secure.gravatar.com https://i0.wp.com https://i1.wp.com https://i2.wp.com https://pagead2.googlesyndication.com https://player.vimeo.com https://*.ci.vimeows.com https://videoapi-sprites.vimeocdn.com https://i.vimeocdn.com https://wirewax.s3.eu-west-1.amazonaws.com https://studio-media.wirewax.com https://f.vimeocdn.com; frame-src 'self' https://imasdk.googleapis.com/ https://f.vimeocdn.com; report-uri /_csp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
player.vimeo.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
15671
Server
nginx
Content-Type
text/html; charset=UTF-8
X-Xss-Protection
1; mode=block
Content-Security-Policy
script-src 'self' 'unsafe-inline' blob: resource: https://f.vimeocdn.com https://vimeo.com https://js-agent.newrelic.com https://imasdk.googleapis.com/ https://adservice.google.com/ https://s0.2mdn.net/instream/video/ https://bam.nr-data.net https://src.litix.io https://www.gstatic.com https://cdn.streamroot.io https://wirewax.s3.eu-west-1.amazonaws.com https://f.vimeocdn.com; style-src 'self' 'unsafe-inline' https://f.vimeocdn.com https://f.vimeocdn.com; connect-src 'self' ws: wss: https://vimeo.com https://vimeo.dev https://api.vimeo.com https://api.vimeo.dev https://*.ci.vimeows.com https://csi.gstatic.com https://fresnel.vimeocdn.com https://fresnel-player-staging.vimeows.com https://player-telemetry.vimeo.com https://*.akamaized.net https://*.akamaized-staging.net https://*.vimeocdn.com https://netflux.cloud.vimeo.com https://lic.staging.drmtoday.com https://lic.drmtoday.com https://wv.service.expressplay.com https://fp.service.expressplay.com https://pr.service.expressplay.com https://sentry.io https://*.ingest.sentry.io https://storage.googleapis.com https://bam.nr-data.net https://live-api.cloud.vimeo.com https://live-api-dev.cloud.vimeo.com https://*.litix.io/ https://collector.vhx.tv https://collector.vhxstaging.com https://backend.dna-delivery.com https://mimir.cloud.vimeo.com https://*.wirewax.com https://wirewax.s3.eu-west-1.amazonaws.com https://sqs.us-east-1.amazonaws.com; media-src 'self' blob: https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net https://*.gvt1.com https://live-api.cloud.vimeo.com https://live-api-dev.cloud.vimeo.com; object-src 'self' https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net; default-src 'none'; img-src 'self' data: https://i.vimeocdn.com https://secure-b.vimeocdn.com https://f.vimeocdn.com https://vimeo.com https://secure.gravatar.com https://i0.wp.com https://i1.wp.com https://i2.wp.com https://pagead2.googlesyndication.com https://player.vimeo.com https://*.ci.vimeows.com https://videoapi-sprites.vimeocdn.com https://i.vimeocdn.com https://wirewax.s3.eu-west-1.amazonaws.com https://studio-media.wirewax.com https://f.vimeocdn.com; frame-src 'self' https://imasdk.googleapis.com/ https://f.vimeocdn.com; report-uri /_csp
X-Content-Type-Options
nosniff
Content-Encoding
gzip
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Link
<https://i.vimeocdn.com>; rel=preconnect; crossorigin <https://f.vimeocdn.com>; rel=preconnect; crossorigin <https://fresnel.vimeocdn.com>; rel=preconnect; crossorigin
P3p
CP="This is not a P3P policy! See https://vimeo.com/privacy"
Expires
Thu, 26 Aug 2021 14:26:18 GMT
Via
1.1 varnish, 1.1 varnish
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
X-Varnish-Cache
1
X-VServer
infra-playproxy-b-5
X-Vimeo-DC
ge
Accept-Ranges
bytes
Date
Thu, 26 Aug 2021 14:17:04 GMT
Age
0
X-Served-By
cache-fra19183-FRA
X-Cache
MISS
X-Cache-Hits
0
X-Timer
S1629987424.286379,VS0,VE230
Vary
Accept-Encoding
X-Player-Backend
p

Redirect headers

Cache-Control
private
Content-Type
text/html; charset=utf-8
Location
https://player.vimeo.com/video/585501183?utm_source=sfmc&utm_medium=email&utm_campaign=74526
Date
Thu, 26 Aug 2021 14:17:03 GMT
Connection
close
Content-Length
217
1211605990.jpg
i.vimeocdn.com/video/ 		837 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.vimeocdn.com/video/1211605990.jpg?mw=80&q=85
Requested by
Host: player.vimeo.com
URL: https://player.vimeo.com/video/585501183?utm_source=sfmc&utm_medium=email&utm_campaign=74526
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
39f91834c904b6bd0b48736f07bef6be2b6cd2c5f12c0fadff934ac5d570f2ad

Request headers

Referer
https://player.vimeo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 26 Aug 2021 14:17:04 GMT
via
vvarnish, 1.1 varnish, 1.1 varnish
age
174042
x-viewmaster-lossless-format
false
x-cache
miss, HIT, HIT
x-backend-server
varnish
content-length
837
viewmaster-server
viewmaster-us-central1-d16w
x-served-by
cache-dfw18638-DFW, cache-fra19130-FRA
x-timer
S1629987425.677388,VS0,VE1
etag
96c1ca5e3667cd5c81d20916191ae974
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
x-cache-hits
1, 1
player.js
f.vimeocdn.com/p/3.39.4/js/ 		648 KB
151 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://f.vimeocdn.com/p/3.39.4/js/player.js
Requested by
Host: player.vimeo.com
URL: https://player.vimeo.com/video/585501183?utm_source=sfmc&utm_medium=email&utm_campaign=74526
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
UploadServer /
Resource Hash
b45a0a36ffe4ca5ddebb82fe0eb384e61c0e6053a235c044ec05d43938f224be

Request headers

Referer
https://player.vimeo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 26 Aug 2021 14:17:04 GMT
via
1.1 varnish, 1.1 varnish
age
78465
x-guploader-uploadid
ADPycdukDI2p9xvsSTAzuJOqdT7AKf100VSISh2i3njoZPdmMeWDT2pNc37nQLeYRRNZ8iUY_2DIeHs01AvCFnhlOUi8PkBC8Q
x-cache
MISS, HIT
content-encoding
br
content-length
154787
x-served-by
cache-bwi5147-BWI, cache-fra19156-FRA
last-modified
Wed, 25 Aug 2021 16:18:39 GMT
server
UploadServer
x-timer
S1629987425.687717,VS0,VE0
etag
"903c019276f79854a3813ca7d404084c"
vary
Accept-Encoding,x-http-method-override
content-type
application/javascript
cache-control
max-age=1209600
accept-ranges
bytes
x-cache-hits
0, 29338
player.css
f.vimeocdn.com/p/3.39.4/css/ 		166 KB
18 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://f.vimeocdn.com/p/3.39.4/css/player.css
Requested by
Host: player.vimeo.com
URL: https://player.vimeo.com/video/585501183?utm_source=sfmc&utm_medium=email&utm_campaign=74526
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
UploadServer /
Resource Hash
349d295cf8357ef1fa78f49f5f3a7046642454466cd99018d06ae07f414b8911

Request headers

Referer
https://player.vimeo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 26 Aug 2021 14:17:04 GMT
via
1.1 varnish, 1.1 varnish
age
78465
x-guploader-uploadid
ADPycdvrzB4cRh8_szVS65l06vYdzVLpCod8ZiN3w-3uK7creYHmTkuJOFT0dZCw69Z1MoRw_3eK5nMu9CpFNSBVfQeVEgFY1Q
x-cache
MISS, HIT
content-encoding
br
content-length
17994
x-served-by
cache-bwi5179-BWI, cache-fra19156-FRA
last-modified
Wed, 25 Aug 2021 16:18:39 GMT
server
UploadServer
x-timer
S1629987425.687655,VS0,VE0
etag
"0e0bd03b726483f7dc123248b47a6817"
vary
Accept-Encoding,x-http-method-override
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=1209600
accept-ranges
bytes
x-cache-hits
0, 44005
79713_100x47.png
i.vimeocdn.com/player/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.vimeocdn.com/player/79713_100x47.png
Requested by
Host: player.vimeo.com
URL: https://player.vimeo.com/video/585501183?utm_source=sfmc&utm_medium=email&utm_campaign=74526
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
241a24a9e8eda5b9f518f8616b4177faf07607c49781750eb3b3401da9befe6b

Request headers

Referer
https://player.vimeo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 26 Aug 2021 14:17:04 GMT
via
vvarnish, 1.1 varnish, 1.1 varnish
age
931062
x-viewmaster-lossless-format
true
x-cache
miss, HIT, HIT
x-backend-server
varnish
content-length
6923
viewmaster-server
viewmaster-us-central1-2638
x-served-by
cache-dfw18638-DFW, cache-fra19130-FRA
x-timer
S1629987425.904028,VS0,VE1
etag
0fb05a07e255c528db5ebf34a7ec1d3b
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
x-cache-hits
1, 1
1211605990
i.vimeocdn.com/video/ 		13 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.vimeocdn.com/video/1211605990?mw=1600&mh=900
Requested by
Host: player.vimeo.com
URL: https://player.vimeo.com/video/585501183?utm_source=sfmc&utm_medium=email&utm_campaign=74526
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
50099d9da8abde4b16609df5b66e1aff0e9873ed498fddbc8e94631fa231331c

Request headers

Referer
https://player.vimeo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 26 Aug 2021 14:17:04 GMT
via
vvarnish, 1.1 varnish, 1.1 varnish
age
565
x-viewmaster-lossless-format
false
x-cache
miss, HIT, HIT
x-backend-server
varnish
content-length
13710
viewmaster-server
viewmaster-us-central1-wcw2
x-served-by
cache-dfw18638-DFW, cache-fra19130-FRA
x-timer
S1629987425.965104,VS0,VE1
etag
e5f44ebd1e1edc13d021c9becad4580b
vary
Accept
content-type
image/avif
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
x-cache-hits
1, 1

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| __tti object| BigScreen function| VimeoPlayer object| requestModule function| closePopup function| confirmPurchase function| confirmLoginAction

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy script-src 'self' 'unsafe-inline' blob: resource: https://f.vimeocdn.com https://vimeo.com https://js-agent.newrelic.com https://imasdk.googleapis.com/ https://adservice.google.com/ https://s0.2mdn.net/instream/video/ https://bam.nr-data.net https://src.litix.io https://www.gstatic.com https://cdn.streamroot.io https://wirewax.s3.eu-west-1.amazonaws.com https://f.vimeocdn.com; style-src 'self' 'unsafe-inline' https://f.vimeocdn.com https://f.vimeocdn.com; connect-src 'self' ws: wss: https://vimeo.com https://vimeo.dev https://api.vimeo.com https://api.vimeo.dev https://*.ci.vimeows.com https://csi.gstatic.com https://fresnel.vimeocdn.com https://fresnel-player-staging.vimeows.com https://player-telemetry.vimeo.com https://*.akamaized.net https://*.akamaized-staging.net https://*.vimeocdn.com https://netflux.cloud.vimeo.com https://lic.staging.drmtoday.com https://lic.drmtoday.com https://wv.service.expressplay.com https://fp.service.expressplay.com https://pr.service.expressplay.com https://sentry.io https://*.ingest.sentry.io https://storage.googleapis.com https://bam.nr-data.net https://live-api.cloud.vimeo.com https://live-api-dev.cloud.vimeo.com https://*.litix.io/ https://collector.vhx.tv https://collector.vhxstaging.com https://backend.dna-delivery.com https://mimir.cloud.vimeo.com https://*.wirewax.com https://wirewax.s3.eu-west-1.amazonaws.com https://sqs.us-east-1.amazonaws.com; media-src 'self' blob: https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net https://*.gvt1.com https://live-api.cloud.vimeo.com https://live-api-dev.cloud.vimeo.com; object-src 'self' https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net; default-src 'none'; img-src 'self' data: https://i.vimeocdn.com https://secure-b.vimeocdn.com https://f.vimeocdn.com https://vimeo.com https://secure.gravatar.com https://i0.wp.com https://i1.wp.com https://i2.wp.com https://pagead2.googlesyndication.com https://player.vimeo.com https://*.ci.vimeows.com https://videoapi-sprites.vimeocdn.com https://i.vimeocdn.com https://wirewax.s3.eu-west-1.amazonaws.com https://studio-media.wirewax.com https://f.vimeocdn.com; frame-src 'self' https://imasdk.googleapis.com/ https://f.vimeocdn.com; report-uri /_csp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block