urlscan.io logo urlscan.io
SecurityTrails logo

photo.gvix.foo Open in urlscan Pro
74.110.157.13  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://gvix.foo/exposeme
Effective URL: https://photo.gvix.foo/mo/request/6WEYfaG1g
Submission: On November 27 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 74.110.157.13, located in Richmond, United States and belongs to UUNET, US. The main domain is photo.gvix.foo.
TLS certificate: Issued by R3 on November 21st 2023. Valid for: 3 months.
This is the only time photo.gvix.foo was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
11 74.110.157.13 701 (UUNET)
11 1
Apex Domain
Subdomains		 Transfer
12 gvix.foo
gvix.foo
photo.gvix.foo
1 MB
11 1
Domain Requested by
11 photo.gvix.foo photo.gvix.foo
1 gvix.foo 1 redirects
11 2

This site contains no links.

Subject Issuer Validity Valid
*.gvix.foo
R3		 2023-11-21 -
2024-02-19		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://photo.gvix.foo/mo/request/6WEYfaG1g
Frame ID: CE2E26D057D19F95033263AB609BEC35
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Synology Photos

Page URL History Show full URLs

  1. http://gvix.foo/exposeme HTTP 307
    https://gvix.foo/exposeme HTTP 302
    https://photo.gvix.foo/mo/request/6WEYfaG1g Page URL

Page Statistics

11
Requests

100 %
HTTPS

50 %
IPv6

1
Domains

2
Subdomains

1
IPs

1
Countries

1057 kB
Transfer

3541 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://gvix.foo/exposeme HTTP 307
    https://gvix.foo/exposeme HTTP 302
    https://photo.gvix.foo/mo/request/6WEYfaG1g Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 6WEYfaG1g
photo.gvix.foo/mo/request/
Redirect Chain
  • http://gvix.foo/exposeme
  • https://gvix.foo/exposeme
  • https://photo.gvix.foo/mo/request/6WEYfaG1g
3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://photo.gvix.foo/mo/request/6WEYfaG1g
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
74.110.157.13 Richmond, United States, ASN701 (UUNET, US),
Reverse DNS
pool-74-110-157-13.rcmdva.fios.verizon.net
Software
/
Resource Hash
d83bf8f9e13f30b30f7939f15746360ea69ee54acb3b9fec4a1285b7a722080f
Security Headers
Name Value
Content-Security-Policy base-uri 'self'; connect-src data: ws: wss: http: https:; default-src 'self' 'unsafe-eval' data: blob: https://*.synology.com https://www.synology.cn/ https://help.synology.cn/; font-src 'self' data: https://*.googleapis.com https://*.gstatic.com; form-action 'self'; frame-ancestors 'self' https://william-anderson.com https://www.william-anderson.com; frame-src 'self' data: blob: https://*.synology.com https://*.synology.cn http://*.synology.com http://*.synology.cn http://global.synologydownload.com https://global.synologydownload.com; img-src 'self' data: blob: https://*.google.com https://*.googleapis.com http://*.googlecode.com https://*.gstatic.com https://global.download.synology.com; media-src 'self' data: about: https://*.synology.com https://help.synology.cn; script-src 'self' 'unsafe-eval' data: blob: https://maps.google.com https://maps.googleapis.com https://ajax.googleapis.com https://help.synology.com https://help.synology.cn 'nonce-rbxplaQMRfvZ3UCM6V6CXulv'; style-src 'self' 'unsafe-inline' https://*.googleapis.com; ;
Strict-Transport-Security max-age=15768000; includeSubdomains; preload
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-security-policy
base-uri 'self'; connect-src data: ws: wss: http: https:; default-src 'self' 'unsafe-eval' data: blob: https://*.synology.com https://www.synology.cn/ https://help.synology.cn/; font-src 'self' data: https://*.googleapis.com https://*.gstatic.com; form-action 'self'; frame-ancestors 'self' https://william-anderson.com https://www.william-anderson.com; frame-src 'self' data: blob: https://*.synology.com https://*.synology.cn http://*.synology.com http://*.synology.cn http://global.synologydownload.com https://global.synologydownload.com; img-src 'self' data: blob: https://*.google.com https://*.googleapis.com http://*.googlecode.com https://*.gstatic.com https://global.download.synology.com; media-src 'self' data: about: https://*.synology.com https://help.synology.cn; script-src 'self' 'unsafe-eval' data: blob: https://maps.google.com https://maps.googleapis.com https://ajax.googleapis.com https://help.synology.com https://help.synology.cn 'nonce-rbxplaQMRfvZ3UCM6V6CXulv'; style-src 'self' 'unsafe-inline' https://*.googleapis.com; ;
content-type
text/html; charset="UTF-8"
date
Mon, 27 Nov 2023 01:15:20 GMT
strict-transport-security
max-age=15768000; includeSubdomains; preload
vary
Accept-Encoding
x-frame-options
SAMEORIGIN

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
82c684eef8c09954-FRA
content-length
0
date
Mon, 27 Nov 2023 01:15:18 GMT
location
https://photo.gvix.foo/mo/request/6WEYfaG1g
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GalZ8WoxnfLUXT3QQlwUiWOBaMMQbYrQT8%2B7wC8gQhK2CMmIQvm%2FdelADjnZ2P52KTs7enfYJf2LEXEXOs8FN5s4LYHGGLzwcIN6G0q4eXoy3qRRVAFgn%2FHaxGUAhqdzb36kEF8Ngw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=15768000; includeSubdomains; preload
x-request-id
35432c06-c74e-4d33-8717-f7734ffc2b84
style.css
photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/ 		374 KB
50 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/style.css?v=1700072650
Requested by
Host: photo.gvix.foo
URL: https://photo.gvix.foo/mo/request/6WEYfaG1g
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
74.110.157.13 Richmond, United States, ASN701 (UUNET, US),
Reverse DNS
pool-74-110-157-13.rcmdva.fios.verizon.net
Software
/
Resource Hash
0b7c76a6fe4b4d5e9699722fb065fc07d1970bee26aaa03b827ecf0d0ea370ea
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubdomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://photo.gvix.foo/mo/request/6WEYfaG1g
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 01:15:21 GMT
content-encoding
gzip
strict-transport-security
max-age=15768000; includeSubdomains; preload
last-modified
Thu, 26 Oct 2023 10:22:13 GMT
etag
"653a3dd5-c738"
vary
Accept-Encoding
content-type
text/css
content-length
51000
external_album_sharing.css
photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/ 		456 B
427 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/external_album_sharing.css?v=1700072650
Requested by
Host: photo.gvix.foo
URL: https://photo.gvix.foo/mo/request/6WEYfaG1g
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
74.110.157.13 Richmond, United States, ASN701 (UUNET, US),
Reverse DNS
pool-74-110-157-13.rcmdva.fios.verizon.net
Software
/
Resource Hash
2a4756f567fcd607c28d41f1b89347e23c53cebf3f265261519a6dc4f2a645fe
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubdomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://photo.gvix.foo/mo/request/6WEYfaG1g
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 01:15:21 GMT
content-encoding
gzip
strict-transport-security
max-age=15768000; includeSubdomains; preload
last-modified
Thu, 26 Oct 2023 10:22:13 GMT
etag
"653a3dd5-e0"
vary
Accept-Encoding
content-type
text/css
content-length
224
entry.cgi
photo.gvix.foo/mo/request/webapi/ 		111 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://photo.gvix.foo/mo/request/webapi/entry.cgi?api=SYNO.Foto.PublicSharing&version=1&method=get_ui_string&v=1700072650
Requested by
Host: photo.gvix.foo
URL: https://photo.gvix.foo/mo/request/6WEYfaG1g
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
74.110.157.13 Richmond, United States, ASN701 (UUNET, US),
Reverse DNS
pool-74-110-157-13.rcmdva.fios.verizon.net
Software
/
Resource Hash
6d10ae1574febf23f9e15bb62adfaab8f6037e16e00873674b7f38015658b972
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://photo.gvix.foo/mo/request/6WEYfaG1g
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 01:15:21 GMT
strict-transport-security
max-age=15768000; includeSubdomains; preload
x-content-type-options
nosniff
content-encoding
gzip
vary
Accept-Encoding
content-type
application/javascript; charset="UTF-8"
cache-control
must-revalidate, max-age=31536000
x-xss-protection
1; mode=block
photo_request_bundle.js
photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/ 		3 MB
771 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/photo_request_bundle.js?v=1700072650
Requested by
Host: photo.gvix.foo
URL: https://photo.gvix.foo/mo/request/6WEYfaG1g
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
74.110.157.13 Richmond, United States, ASN701 (UUNET, US),
Reverse DNS
pool-74-110-157-13.rcmdva.fios.verizon.net
Software
/
Resource Hash
f9506bdf21a9bdd05592c71f4a7da5238d04eca1cc3b992bec13a663aced81c9
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubdomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://photo.gvix.foo/mo/request/6WEYfaG1g
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 01:15:21 GMT
content-encoding
gzip
strict-transport-security
max-age=15768000; includeSubdomains; preload
last-modified
Thu, 26 Oct 2023 10:22:12 GMT
etag
"653a3dd4-c051e"
vary
Accept-Encoding
content-type
application/javascript
content-length
787742
photo_request_page.js
photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/ 		28 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/photo_request_page.js?v=1700072650
Requested by
Host: photo.gvix.foo
URL: https://photo.gvix.foo/mo/request/6WEYfaG1g
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
74.110.157.13 Richmond, United States, ASN701 (UUNET, US),
Reverse DNS
pool-74-110-157-13.rcmdva.fios.verizon.net
Software
/
Resource Hash
88b4506d6868c7001a7c15802f41679e36b0959363de1b20894693ede32403f9
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubdomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://photo.gvix.foo/mo/request/6WEYfaG1g
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 01:15:21 GMT
content-encoding
gzip
strict-transport-security
max-age=15768000; includeSubdomains; preload
last-modified
Thu, 26 Oct 2023 10:22:11 GMT
etag
"653a3dd3-2c65"
vary
Accept-Encoding
content-type
application/javascript
content-length
11365
Inter-Regular.woff
photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/fonts/ 		131 KB
131 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/fonts/Inter-Regular.woff
Requested by
Host: photo.gvix.foo
URL: https://photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/style.css?v=1700072650
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
74.110.157.13 Richmond, United States, ASN701 (UUNET, US),
Reverse DNS
pool-74-110-157-13.rcmdva.fios.verizon.net
Software
/
Resource Hash
ef1f23c01b18f45995df6ad0c206c36660b6f50a0df25d12c000ce63df9c66dd
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubdomains; preload

Request headers

Referer
https://photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/style.css?v=1700072650
Origin
https://photo.gvix.foo
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 01:15:22 GMT
strict-transport-security
max-age=15768000; includeSubdomains; preload
last-modified
Thu, 26 Oct 2023 08:56:09 GMT
accept-ranges
bytes
etag
"653a29a9-20ad4"
content-length
133844
content-type
font/woff
empty_photo_request.svg
photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/images/svg/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/images/svg/empty_photo_request.svg?v=1.6.1-0641
Requested by
Host: photo.gvix.foo
URL: https://photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/style.css?v=1700072650
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
74.110.157.13 Richmond, United States, ASN701 (UUNET, US),
Reverse DNS
pool-74-110-157-13.rcmdva.fios.verizon.net
Software
/
Resource Hash
97e28aff016cc220cc36628141662e06fc7634e0a290b934d63fc97fdcd8a144
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubdomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/style.css?v=1700072650
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 01:15:22 GMT
strict-transport-security
max-age=15768000; includeSubdomains; preload
last-modified
Thu, 26 Oct 2023 10:22:13 GMT
accept-ranges
bytes
etag
"653a3dd5-3f0f"
content-length
16143
content-type
image/svg+xml
pica.min.js
photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/pica/ 		32 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/pica/pica.min.js?v=1700072650
Requested by
Host: photo.gvix.foo
URL: https://photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/photo_request_page.js?v=1700072650
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
74.110.157.13 Richmond, United States, ASN701 (UUNET, US),
Reverse DNS
pool-74-110-157-13.rcmdva.fios.verizon.net
Software
/
Resource Hash
03a9615c5aed8f67e443bd2724c3c3d452a49997245b15aaad315db8d98e5a65
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubdomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://photo.gvix.foo/mo/request/6WEYfaG1g
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 01:15:22 GMT
content-encoding
gzip
strict-transport-security
max-age=15768000; includeSubdomains; preload
last-modified
Thu, 26 Oct 2023 10:22:12 GMT
etag
"653a3dd4-2e2b"
vary
Accept-Encoding
content-type
application/javascript
content-length
11819
logo_dsm_Photos_40.svg
photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/images/svg/ 		20 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/images/svg/logo_dsm_Photos_40.svg
Requested by
Host: photo.gvix.foo
URL: https://photo.gvix.foo/mo/request/6WEYfaG1g
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
74.110.157.13 Richmond, United States, ASN701 (UUNET, US),
Reverse DNS
pool-74-110-157-13.rcmdva.fios.verizon.net
Software
/
Resource Hash
001c06b529dc894d9368c20330706307b3b982a59ad5f508b3d318447df9e457
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubdomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://photo.gvix.foo/mo/request/6WEYfaG1g
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 01:15:22 GMT
strict-transport-security
max-age=15768000; includeSubdomains; preload
last-modified
Thu, 26 Oct 2023 10:22:13 GMT
accept-ranges
bytes
etag
"653a3dd5-517d"
content-length
20861
content-type
image/svg+xml
SYNO.Foto.Sharing.Passphrase
photo.gvix.foo/mo/request/webapi/entry.cgi/ 		91 B
391 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://photo.gvix.foo/mo/request/webapi/entry.cgi/SYNO.Foto.Sharing.Passphrase
Requested by
Host: photo.gvix.foo
URL: https://photo.gvix.foo/mo/request/webman/3rdparty/SynologyPhotos/photo_request_bundle.js?v=1700072650
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
74.110.157.13 Richmond, United States, ASN701 (UUNET, US),
Reverse DNS
pool-74-110-157-13.rcmdva.fios.verizon.net
Software
/
Resource Hash
1547070f5395f86d7cd8abace3c0c4eb7009814686ba950f39cd542d9b41c231
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://photo.gvix.foo/mo/request/6WEYfaG1g
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
X-SYNO-SHARING
6WEYfaG1g
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 01:15:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=15768000; includeSubdomains; preload
vary
Accept-Encoding
content-type
application/json; charset="UTF-8"
cache-control
max-age=0, no-cache, no-store, must-revalidate
x-xss-protection
1; mode=block
expires
0

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| _TT object| SYNO object| Ext function| _S object| SYNO_Kailash_Strings object| FotoPhotoRequestReactLibrary function| requestAnimFrame object| core function| _ object| il object| PhotoRequestPage function| pica

1 Cookies

Domain/Path Name / Value
photo.gvix.foo/ Name: sharing_sid
Value: MOKvysSMKUWhIdh0Nz1m9FU7slECtDEX

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy base-uri 'self'; connect-src data: ws: wss: http: https:; default-src 'self' 'unsafe-eval' data: blob: https://*.synology.com https://www.synology.cn/ https://help.synology.cn/; font-src 'self' data: https://*.googleapis.com https://*.gstatic.com; form-action 'self'; frame-ancestors 'self' https://william-anderson.com https://www.william-anderson.com; frame-src 'self' data: blob: https://*.synology.com https://*.synology.cn http://*.synology.com http://*.synology.cn http://global.synologydownload.com https://global.synologydownload.com; img-src 'self' data: blob: https://*.google.com https://*.googleapis.com http://*.googlecode.com https://*.gstatic.com https://global.download.synology.com; media-src 'self' data: about: https://*.synology.com https://help.synology.cn; script-src 'self' 'unsafe-eval' data: blob: https://maps.google.com https://maps.googleapis.com https://ajax.googleapis.com https://help.synology.com https://help.synology.cn 'nonce-rbxplaQMRfvZ3UCM6V6CXulv'; style-src 'self' 'unsafe-inline' https://*.googleapis.com; ;
Strict-Transport-Security max-age=15768000; includeSubdomains; preload
X-Frame-Options SAMEORIGIN