URL: https://my.swissboxplus.ch/
Submission: On March 27 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 11 HTTP transactions. The main IP is 54.216.252.255, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is my.swissboxplus.ch.
TLS certificate: Issued by R3 on March 26th 2023. Valid for: 3 months.
This is the only time my.swissboxplus.ch was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
9 54.216.252.255 16509 (AMAZON-02)
1 34.102.145.72 396982 (GOOGLE-CL...)
1 52.92.20.129 16509 (AMAZON-02)
11 4
Domain Requested by
8 my.swissboxplus.ch my.swissboxplus.ch
1 storeganise.s3.amazonaws.com
1 api.wurd.io my.swissboxplus.ch
1 621f4120ec8a0e581bb6f644.endpoint.csper.io my.swissboxplus.ch
11 4

This site contains links to these domains. Also see Links.

Domain
storeganise.com
Subject Issuer Validity Valid
my.swissboxplus.ch
R3
2023-03-26 -
2023-06-24
3 months crt.sh
*.endpoint.csper.io
Sectigo RSA Domain Validation Secure Server CA
2023-01-04 -
2024-02-04
a year crt.sh
api.wurd.io
R3
2023-03-21 -
2023-06-19
3 months crt.sh
*.s3.amazonaws.com
Amazon
2022-09-21 -
2023-08-26
a year crt.sh

This page contains 1 frames:

Primary Page: https://my.swissboxplus.ch/
Frame ID: 58246EDF28B1FC4C2D23880F1C29F2AC
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

swissbox+

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

1602 kB
Transfer

1609 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
my.swissboxplus.ch/
698 B
2 KB
Document
General
Full URL
https://my.swissboxplus.ch/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.216.252.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-216-252-255.eu-west-1.compute.amazonaws.com
Software
Cowboy /
Resource Hash
0ef9bc6f5ef4d345646d515390288d64a644e720167bcee0aaac84433572d5ce
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'nonce-MHrDuQ5M3eeq' 'strict-dynamic' 'self' 'unsafe-inline' https://*.braintreegateway.com https://*.mul-pay.jp https://connect.facebook.net https://cdn.segment.com https://cdn.polyfill.io https://*.googletagmanager.com https://*.googleadservices.com https://*.g.doubleclick.net https://*.google.com; connect-src 'self' https://api-v3.wurd.io https://api.wurd.io https://maps.googleapis.com https://www.google-analytics.com https://cdn.segment.com https://api.segment.io https://accounts.google.com/gsi/log *.google-analytics.com *.analytics.google.com *.googletagmanager.com *.g.doubleclick.net *.googleadservices.com *.google.com https://*.facebook.com; style-src 'self' 'nonce-hwsR9oQJ+msy' https://accounts.google.com/gsi/style https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' https: blob: data: *.google-analytics.com *.analytics.google.com *.googletagmanager.com *.g.doubleclick.net *.google.com; object-src 'none'; base-uri 'none'; form-action 'self' https://checkout.stripe.com https://*.cybersource.com/pay https://www.facebook.com; frame-ancestors 'none'; frame-src https://assets.braintreegateway.com https://accounts.google.com https://www.facebook.com; block-all-mixed-content; report-uri https://621f4120ec8a0e581bb6f644.endpoint.csper.io?v=1
Strict-Transport-Security max-age=7776000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Length
698
Content-Security-Policy
default-src 'none'; script-src 'nonce-MHrDuQ5M3eeq' 'strict-dynamic' 'self' 'unsafe-inline' https://*.braintreegateway.com https://*.mul-pay.jp https://connect.facebook.net https://cdn.segment.com https://cdn.polyfill.io https://*.googletagmanager.com https://*.googleadservices.com https://*.g.doubleclick.net https://*.google.com; connect-src 'self' https://api-v3.wurd.io https://api.wurd.io https://maps.googleapis.com https://www.google-analytics.com https://cdn.segment.com https://api.segment.io https://accounts.google.com/gsi/log *.google-analytics.com *.analytics.google.com *.googletagmanager.com *.g.doubleclick.net *.googleadservices.com *.google.com https://*.facebook.com; style-src 'self' 'nonce-hwsR9oQJ+msy' https://accounts.google.com/gsi/style https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' https: blob: data: *.google-analytics.com *.analytics.google.com *.googletagmanager.com *.g.doubleclick.net *.google.com; object-src 'none'; base-uri 'none'; form-action 'self' https://checkout.stripe.com https://*.cybersource.com/pay https://www.facebook.com; frame-ancestors 'none'; frame-src https://assets.braintreegateway.com https://accounts.google.com https://www.facebook.com; block-all-mixed-content; report-uri https://621f4120ec8a0e581bb6f644.endpoint.csper.io?v=1
Content-Type
text/html; charset=utf-8
Date
Mon, 27 Mar 2023 00:10:55 GMT
Etag
W/"2ba-ZqvLzCZog0cOzE0tI6Jyp1B/QQo"
Referrer-Policy
strict-origin-when-cross-origin
Server
Cowboy
Strict-Transport-Security
max-age=7776000; includeSubDomains
Via
1.1 vegur
X-Content-Type-Options
nosniff
main.2f5ebfc0.js
my.swissboxplus.ch/static/userapp/static/js/
908 KB
908 KB
Script
General
Full URL
https://my.swissboxplus.ch/static/userapp/static/js/main.2f5ebfc0.js
Requested by
Host: my.swissboxplus.ch
URL: https://my.swissboxplus.ch/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.216.252.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-216-252-255.eu-west-1.compute.amazonaws.com
Software
Cowboy /
Resource Hash
f6e5dde4241b4bc6c7cb9fa850efe81c8d8057881eccc1d2e19a3c09b8c6a0c8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://my.swissboxplus.ch/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Mon, 27 Mar 2023 00:10:55 GMT
Via
1.1 vegur
Last-Modified
Mon, 20 Feb 2023 14:33:00 GMT
Server
Cowboy
Etag
W/"e30a2-1866f3e0160"
Content-Type
application/javascript; charset=UTF-8
Cache-Control
public, max-age=0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
929954
main.97d468b5.css
my.swissboxplus.ch/static/userapp/static/css/
277 KB
277 KB
Stylesheet
General
Full URL
https://my.swissboxplus.ch/static/userapp/static/css/main.97d468b5.css
Requested by
Host: my.swissboxplus.ch
URL: https://my.swissboxplus.ch/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.216.252.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-216-252-255.eu-west-1.compute.amazonaws.com
Software
Cowboy /
Resource Hash
040bcd0da1b22a101b8dcbcd8d16784c96820f932d12fae471284f957aa89d7c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://my.swissboxplus.ch/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Mon, 27 Mar 2023 00:10:55 GMT
Via
1.1 vegur
Last-Modified
Mon, 20 Feb 2023 14:33:00 GMT
Server
Cowboy
Etag
W/"4549f-1866f3e0160"
Content-Type
text/css; charset=UTF-8
Cache-Control
public, max-age=0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
283807
/
621f4120ec8a0e581bb6f644.endpoint.csper.io/
7 B
139 B
Other
General
Full URL
https://621f4120ec8a0e581bb6f644.endpoint.csper.io/?v=1
Requested by
Host: my.swissboxplus.ch
URL: https://my.swissboxplus.ch/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.102.145.72 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
72.145.102.34.bc.googleusercontent.com
Software
/
Resource Hash
1aa7b1c1d5fb1fd6d299eae251a665c7898baeb43d48fb6b8a5b76da6c6ef739

Request headers

Referer
https://my.swissboxplus.ch/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
Content-Type
application/csp-report

Response headers

date
Mon, 27 Mar 2023 00:10:56 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7
content-type
text/plain; charset=utf-8
settings
my.swissboxplus.ch/api/v1/
1 KB
968 B
Fetch
General
Full URL
https://my.swissboxplus.ch/api/v1/settings?include=userCustomFields,unitRentalCustomFields,minmaxBookingDates
Requested by
Host: my.swissboxplus.ch
URL: https://my.swissboxplus.ch/static/userapp/static/js/main.2f5ebfc0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.216.252.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-216-252-255.eu-west-1.compute.amazonaws.com
Software
Cowboy /
Resource Hash
7a63ab8e250558e72f12d28280ad643d455f3db079adab1e08af07cdde12b4a8

Request headers

Accept
application/json
Referer
https://my.swissboxplus.ch/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Mon, 27 Mar 2023 00:10:57 GMT
Content-Encoding
gzip
Via
1.1 vegur
Server
Cowboy
Etag
W/"474-qbic42AodwIpIg++yiKva0rYgRQ"
Vary
Origin, Accept-Encoding
Transfer-Encoding
chunked
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Credentials
true
Connection
keep-alive
truncated
/
353 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
910d42773de429538b60f2bd714ebd734dd66dea33fcd52845228ea0daa77fe1

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Content-Type
image/jpeg
billing,common,forgotPassword,invoice,invoices,login,signup,my-items,my-units,profile,resetPassword,unitOrder,selfStorage,siteDetail,siteMap,siteList,unitDetail,valetOrder
api.wurd.io/apps/sg-userapp/content/
17 KB
6 KB
Fetch
General
Full URL
https://api.wurd.io/apps/sg-userapp/content/billing,common,forgotPassword,invoice,invoices,login,signup,my-items,my-units,profile,resetPassword,unitOrder,selfStorage,siteDetail,siteMap,siteList,unitDetail,valetOrder?lang=en
Requested by
Host: my.swissboxplus.ch
URL: https://my.swissboxplus.ch/static/userapp/static/js/main.2f5ebfc0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.216.252.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-216-252-255.eu-west-1.compute.amazonaws.com
Software
Cowboy /
Resource Hash
19e9007b2746284b1a7e2e02e78525bbf2167c376d84305cfbe50fa540ebecb8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://my.swissboxplus.ch/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Mon, 27 Mar 2023 00:10:57 GMT
Content-Encoding
gzip
Via
1.1 vegur
Server
Cowboy
Etag
W/"4208-TjYXMvcmGqhzgvxJvZV26SDtyzE"
Vary
Accept-Encoding
Transfer-Encoding
chunked
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Connection
keep-alive
user
my.swissboxplus.ch/api/v1/
60 B
370 B
Fetch
General
Full URL
https://my.swissboxplus.ch/api/v1/user?include=settings,billing,units,valetOrders,items,customFields
Requested by
Host: my.swissboxplus.ch
URL: https://my.swissboxplus.ch/static/userapp/static/js/main.2f5ebfc0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.216.252.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-216-252-255.eu-west-1.compute.amazonaws.com
Software
Cowboy /
Resource Hash
ebcd72a4515050c74d2111ec36459fe8616972bd5bc9d8b5b0ed73a7c34306c1

Request headers

Accept
application/json
Referer
https://my.swissboxplus.ch/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Mon, 27 Mar 2023 00:10:57 GMT
Via
1.1 vegur
Server
Cowboy
Etag
W/"3c-Oq5m11LHKHrxecVGuGXS8DqmDNU"
Vary
Origin, Accept, Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
60
4ff3773539cae8a8baf9082d41f4cd48.svg
storeganise.s3.amazonaws.com/63c54e50a92aa500043c4c7d/uploads/
6 KB
7 KB
Image
General
Full URL
https://storeganise.s3.amazonaws.com/63c54e50a92aa500043c4c7d/uploads/4ff3773539cae8a8baf9082d41f4cd48.svg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.92.20.129 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-3-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
3fe81cd8f39ca183c54f40cdc6ce72c912d9328c635e75d0dc28664f112932f9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://my.swissboxplus.ch/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Mon, 27 Mar 2023 00:10:58 GMT
Last-Modified
Mon, 16 Jan 2023 13:31:22 GMT
Server
AmazonS3
x-amz-request-id
F19STS0EJ4V6PRH9
ETag
"f26e820c44873a1539f508f9701155a1"
x-amz-server-side-encryption
AES256
Content-Type
image/svg+xml
Cache-Control
max-age=604800
Accept-Ranges
bytes
Content-Length
6344
x-amz-id-2
FiqbTZas9J3g9V7yT8t9QyouVxkCUopO5ycGMFMDJxAplJ4xr/wto6opE40Aox1QWCDWF+ZgszM=
fa-regular-400.33904a1b964c9b363ce7.woff2
my.swissboxplus.ch/static/userapp/static/media/
165 KB
165 KB
Font
General
Full URL
https://my.swissboxplus.ch/static/userapp/static/media/fa-regular-400.33904a1b964c9b363ce7.woff2
Requested by
Host: my.swissboxplus.ch
URL: https://my.swissboxplus.ch/static/userapp/static/css/main.97d468b5.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.216.252.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-216-252-255.eu-west-1.compute.amazonaws.com
Software
Cowboy /
Resource Hash
3bbb0df89b8dbe8001e8c24de4e2d1693f94997b29f007a7bda22a9802832768

Request headers

Referer
https://my.swissboxplus.ch/static/userapp/static/css/main.97d468b5.css
Origin
https://my.swissboxplus.ch
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Mon, 27 Mar 2023 00:10:57 GMT
Via
1.1 vegur
Last-Modified
Mon, 20 Feb 2023 14:33:00 GMT
Server
Cowboy
Etag
W/"29378-1866f3e0160"
Content-Type
font/woff2
Cache-Control
public, max-age=0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
168824
fa-light-300.d3271a5651ab5ba62d85.woff2
my.swissboxplus.ch/static/userapp/static/media/
180 KB
180 KB
Font
General
Full URL
https://my.swissboxplus.ch/static/userapp/static/media/fa-light-300.d3271a5651ab5ba62d85.woff2
Requested by
Host: my.swissboxplus.ch
URL: https://my.swissboxplus.ch/static/userapp/static/css/main.97d468b5.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.216.252.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-216-252-255.eu-west-1.compute.amazonaws.com
Software
Cowboy /
Resource Hash
1ddc6ae069ea7aedb68a92d53a12933a5a326f28c714869b99f335377dcce217

Request headers

Referer
https://my.swissboxplus.ch/static/userapp/static/css/main.97d468b5.css
Origin
https://my.swissboxplus.ch
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Mon, 27 Mar 2023 00:10:57 GMT
Via
1.1 vegur
Last-Modified
Mon, 20 Feb 2023 14:33:00 GMT
Server
Cowboy
Etag
W/"2cf8c-1866f3e0160"
Content-Type
font/woff2
Cache-Control
public, max-age=0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
184204
inter-latin-variable-full-normal.662312a083b9f48417ca.woff2
my.swissboxplus.ch/static/userapp/static/media/
54 KB
54 KB
Font
General
Full URL
https://my.swissboxplus.ch/static/userapp/static/media/inter-latin-variable-full-normal.662312a083b9f48417ca.woff2
Requested by
Host: my.swissboxplus.ch
URL: https://my.swissboxplus.ch/static/userapp/static/css/main.97d468b5.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.216.252.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-216-252-255.eu-west-1.compute.amazonaws.com
Software
Cowboy /
Resource Hash
750a469d97a45e7b315b7a44a4ee41e615aca938544cf7199b681785a993a8ec

Request headers

Referer
https://my.swissboxplus.ch/static/userapp/static/css/main.97d468b5.css
Origin
https://my.swissboxplus.ch
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Mon, 27 Mar 2023 00:10:57 GMT
Via
1.1 vegur
Last-Modified
Mon, 20 Feb 2023 14:33:00 GMT
Server
Cowboy
Etag
W/"d840-1866f3e0160"
Content-Type
font/woff2
Cache-Control
public, max-age=0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
55360

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| webpackChunk_storeganise_userapp string| app_version

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://my.swissboxplus.ch/api/v1/user?include=settings,billing,units,valetOrders,items,customFields
Message:
Failed to load resource: the server responded with a status of 401 (Unauthorized)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'none'; script-src 'nonce-MHrDuQ5M3eeq' 'strict-dynamic' 'self' 'unsafe-inline' https://*.braintreegateway.com https://*.mul-pay.jp https://connect.facebook.net https://cdn.segment.com https://cdn.polyfill.io https://*.googletagmanager.com https://*.googleadservices.com https://*.g.doubleclick.net https://*.google.com; connect-src 'self' https://api-v3.wurd.io https://api.wurd.io https://maps.googleapis.com https://www.google-analytics.com https://cdn.segment.com https://api.segment.io https://accounts.google.com/gsi/log *.google-analytics.com *.analytics.google.com *.googletagmanager.com *.g.doubleclick.net *.googleadservices.com *.google.com https://*.facebook.com; style-src 'self' 'nonce-hwsR9oQJ+msy' https://accounts.google.com/gsi/style https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' https: blob: data: *.google-analytics.com *.analytics.google.com *.googletagmanager.com *.g.doubleclick.net *.google.com; object-src 'none'; base-uri 'none'; form-action 'self' https://checkout.stripe.com https://*.cybersource.com/pay https://www.facebook.com; frame-ancestors 'none'; frame-src https://assets.braintreegateway.com https://accounts.google.com https://www.facebook.com; block-all-mixed-content; report-uri https://621f4120ec8a0e581bb6f644.endpoint.csper.io?v=1
Strict-Transport-Security max-age=7776000; includeSubDomains
X-Content-Type-Options nosniff