urlscan.io logo urlscan.io
SecurityTrails logo

www.pinkelephant.com Open in urlscan Pro
13.68.85.187  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html
Submission: On October 26 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 13.68.85.187, located in Boydton, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is www.pinkelephant.com.
TLS certificate: Issued by RapidSSL TLS DV RSA Mixed SHA256 2020... on April 1st 2022. Valid for: a year.
This is the only time www.pinkelephant.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 11 13.68.85.187 8075 (MICROSOFT...)
7 1
Apex Domain
Subdomains		 Transfer
11 pinkelephant.com
www.pinkelephant.com
www3.pinkelephant.com
206 KB
7 1
Domain Requested by
6 www.pinkelephant.com 4 redirects www.pinkelephant.com
5 www3.pinkelephant.com www.pinkelephant.com
7 2

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.facebook.com
www.linkedin.com
www.flickr.com
Subject Issuer Validity Valid
*.pinkelephant.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1		 2022-04-01 -
2023-03-28		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html
Frame ID: 3734DD4A17BF827F67ACF54508AC96CB
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Black Friday Mega Sale – Get an Early Start

Page Statistics

7
Requests

43 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

1
IPs

1
Countries

206 kB
Transfer

232 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://www.pinkelephant.com/ressource/Emails/PinkTemplate/Twitter.png HTTP 301
  • https://www3.pinkelephant.com/ressource/Emails/PinkTemplate/Twitter.png
Request Chain 3
  • https://www.pinkelephant.com/ressource/Emails/PinkTemplate/Facebook.png HTTP 301
  • https://www3.pinkelephant.com/ressource/Emails/PinkTemplate/Facebook.png
Request Chain 4
  • https://www.pinkelephant.com/ressource/Emails/PinkTemplate/Linkedin.png HTTP 301
  • https://www3.pinkelephant.com/ressource/Emails/PinkTemplate/Linkedin.png
Request Chain 5
  • https://www.pinkelephant.com/ressource/Emails/PinkTemplate/flickr.png HTTP 301
  • https://www3.pinkelephant.com/ressource/Emails/PinkTemplate/flickr.png

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request default.html
www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/ 		34 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.68.85.187 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
e32310d8284fc25e0aec14408149d2b8426da10b194b1aaf349f4ffc9a8219a4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
cache-control
private
content-encoding
gzip
content-length
7614
content-type
text/html
date
Wed, 26 Oct 2022 20:15:07 GMT
etag
"8RNYWXYQ7ftj1ptH4wx70Q=="
last-modified
Wed, 26 Oct 2022 20:15:08 GMT
server
Microsoft-IIS/10.0
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-ua-compatible
IE=Edge
x-xss-protection
1; mode=block
peslogan.jpg
www3.pinkelephant.com/ressource/Emails/Pink16/International/ 		24 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www3.pinkelephant.com/ressource/Emails/Pink16/International/peslogan.jpg
Requested by
Host: www.pinkelephant.com
URL: https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.68.85.187 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
106095ae127c116b81cde6fcacd3c7f221f9ed8766bbe177017334cce10d6777
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.pinkelephant.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 26 Oct 2022 20:15:08 GMT
x-content-type-options
nosniff
last-modified
Wed, 26 Oct 2022 20:15:08 GMT
server
Microsoft-IIS/10.0
etag
"wWlTeKhq0UPv/kgukI1UGQ=="
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
private
accept-ranges
bytes
content-length
24923
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
Black-Friday-2022-email.jpg
www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/Black-Friday-2022-email.jpg
Requested by
Host: www.pinkelephant.com
URL: https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.68.85.187 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
5410ea26ad3d204018f4bd27b682977fd2df0c0b0547cc10e3cb4606ffb61f3a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 26 Oct 2022 20:15:08 GMT
x-content-type-options
nosniff
last-modified
Wed, 26 Oct 2022 20:15:08 GMT
server
Microsoft-IIS/10.0
etag
"saLwfuv11oTXrulvGn/i9w=="
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
private
accept-ranges
bytes
content-length
21856
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
Twitter.png
www3.pinkelephant.com/ressource/Emails/PinkTemplate/
Redirect Chain
  • https://www.pinkelephant.com/ressource/Emails/PinkTemplate/Twitter.png
  • https://www3.pinkelephant.com/ressource/Emails/PinkTemplate/Twitter.png
50 KB
50 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www3.pinkelephant.com/ressource/Emails/PinkTemplate/Twitter.png
Requested by
Host: www.pinkelephant.com
URL: https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html
Protocol
H2
Server
13.68.85.187 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
3c68e127d4aa6d5412b2e6016b00ede9fb7c9c19808f2183cfda65613faefdb2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.pinkelephant.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 26 Oct 2022 20:15:08 GMT
x-content-type-options
nosniff
last-modified
Wed, 26 Oct 2022 20:15:08 GMT
server
Microsoft-IIS/10.0
etag
"iSMXWwc3F/Rygo2ODU9ORQ=="
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
private
accept-ranges
bytes
content-length
51358
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge

Redirect headers

strict-transport-security
max-age=31536000
date
Wed, 26 Oct 2022 20:15:08 GMT
x-content-type-options
nosniff
server
Microsoft-IIS/10.0
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
http://www3.pinkelephant.com/ressource/Emails/PinkTemplate/Twitter.png
cache-control
private
content-length
187
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
Facebook.png
www3.pinkelephant.com/ressource/Emails/PinkTemplate/
Redirect Chain
  • https://www.pinkelephant.com/ressource/Emails/PinkTemplate/Facebook.png
  • https://www3.pinkelephant.com/ressource/Emails/PinkTemplate/Facebook.png
50 KB
50 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www3.pinkelephant.com/ressource/Emails/PinkTemplate/Facebook.png
Requested by
Host: www.pinkelephant.com
URL: https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html
Protocol
H2
Server
13.68.85.187 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
29edc832f337fdeaf6ccba687912629b14dccff70471b2669ff0eb325b343698
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.pinkelephant.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 26 Oct 2022 20:15:08 GMT
x-content-type-options
nosniff
last-modified
Wed, 26 Oct 2022 20:15:08 GMT
server
Microsoft-IIS/10.0
etag
"/JT9j0FOF82TtVcGLnVl3g=="
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
private
accept-ranges
bytes
content-length
50863
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge

Redirect headers

strict-transport-security
max-age=31536000
date
Wed, 26 Oct 2022 20:15:08 GMT
x-content-type-options
nosniff
server
Microsoft-IIS/10.0
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
http://www3.pinkelephant.com/ressource/Emails/PinkTemplate/Facebook.png
cache-control
private
content-length
188
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
Linkedin.png
www3.pinkelephant.com/ressource/Emails/PinkTemplate/
Redirect Chain
  • https://www.pinkelephant.com/ressource/Emails/PinkTemplate/Linkedin.png
  • https://www3.pinkelephant.com/ressource/Emails/PinkTemplate/Linkedin.png
50 KB
50 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www3.pinkelephant.com/ressource/Emails/PinkTemplate/Linkedin.png
Requested by
Host: www.pinkelephant.com
URL: https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html
Protocol
H2
Server
13.68.85.187 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
795ff5abd75ee534f3e3176d5189c10f5caa1cd270b73858bcdb6436ba18fe64
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.pinkelephant.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 26 Oct 2022 20:15:09 GMT
x-content-type-options
nosniff
last-modified
Wed, 26 Oct 2022 20:15:09 GMT
server
Microsoft-IIS/10.0
etag
"dUK0p6QBMAssWg1/ISAZHQ=="
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
private
accept-ranges
bytes
content-length
51214
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge

Redirect headers

strict-transport-security
max-age=31536000
date
Wed, 26 Oct 2022 20:15:09 GMT
x-content-type-options
nosniff
server
Microsoft-IIS/10.0
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
http://www3.pinkelephant.com/ressource/Emails/PinkTemplate/Linkedin.png
cache-control
private
content-length
188
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
flickr.png
www3.pinkelephant.com/ressource/Emails/PinkTemplate/
Redirect Chain
  • https://www.pinkelephant.com/ressource/Emails/PinkTemplate/flickr.png
  • https://www3.pinkelephant.com/ressource/Emails/PinkTemplate/flickr.png
2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www3.pinkelephant.com/ressource/Emails/PinkTemplate/flickr.png
Requested by
Host: www.pinkelephant.com
URL: https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html
Protocol
H2
Server
13.68.85.187 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
a264925222ce7e59c120b6356a40e1a917385fb672362f4dbbf802372c104004
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.pinkelephant.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 26 Oct 2022 20:15:09 GMT
x-content-type-options
nosniff
last-modified
Wed, 26 Oct 2022 20:15:09 GMT
server
Microsoft-IIS/10.0
etag
"prqaBiSxh8x9w7fqDcQNvQ=="
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
private
accept-ranges
bytes
content-length
2034
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge

Redirect headers

strict-transport-security
max-age=31536000
date
Wed, 26 Oct 2022 20:15:09 GMT
x-content-type-options
nosniff
server
Microsoft-IIS/10.0
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
http://www3.pinkelephant.com/ressource/Emails/PinkTemplate/flickr.png
cache-control
private
content-length
186
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

2 Cookies

Domain/Path Name / Value
www.pinkelephant.com/ Name: ASP.NET_SessionId
Value: eegqw51wjdiyfyuackkphmvb
www3.pinkelephant.com/ Name: ASP.NET_SessionId
Value: wntjl2zqt2gqqd0reqpyqkjv

10 Console Messages

Source Level URL
Text
security warning URL: https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html
Message:
Mixed Content: The page at 'https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html' was loaded over HTTPS, but requested an insecure element 'http://www3.pinkelephant.com/ressource/Emails/Pink16/International/peslogan.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html
Message:
Mixed Content: The page at 'https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html' was loaded over HTTPS, but requested an insecure element 'http://www.pinkelephant.com/ressource/Emails/PinkTemplate/Twitter.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html
Message:
Mixed Content: The page at 'https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html' was loaded over HTTPS, but requested an insecure element 'http://www.pinkelephant.com/ressource/Emails/PinkTemplate/Facebook.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html
Message:
Mixed Content: The page at 'https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html' was loaded over HTTPS, but requested an insecure element 'http://www.pinkelephant.com/ressource/Emails/PinkTemplate/Linkedin.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html
Message:
Mixed Content: The page at 'https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html' was loaded over HTTPS, but requested an insecure element 'http://www.pinkelephant.com/ressource/Emails/PinkTemplate/flickr.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html(Line 377)
Message:
Mixed Content: The page at 'https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html' was loaded over HTTPS, but requested an insecure element 'http://www3.pinkelephant.com/ressource/Emails/Pink16/International/peslogan.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html
Message:
Mixed Content: The page at 'https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html' was loaded over HTTPS, but requested an insecure element 'http://www.pinkelephant.com/ressource/Emails/PinkTemplate/Twitter.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html
Message:
Mixed Content: The page at 'https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html' was loaded over HTTPS, but requested an insecure element 'http://www.pinkelephant.com/ressource/Emails/PinkTemplate/Facebook.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html
Message:
Mixed Content: The page at 'https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html' was loaded over HTTPS, but requested an insecure element 'http://www.pinkelephant.com/ressource/Emails/PinkTemplate/Linkedin.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html
Message:
Mixed Content: The page at 'https://www.pinkelephant.com/www1/eBulletin/2022/10-25-Black-Friday/US/default.html' was loaded over HTTPS, but requested an insecure element 'http://www.pinkelephant.com/ressource/Emails/PinkTemplate/flickr.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block