benefitsplus-auth-dev.hsbc.com.hk Open in urlscan Pro
2600:9000:266e:6000:a:9a74:f000:93a1 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://benefitsplus-auth-dev.hsbc.com.hk/
Effective URL:
https://benefitsplus-auth-dev.hsbc.com.hk/
Submission Tags: falconsandbox
Submission: On July 24 via api (July 24th 2024, 10:37:08 pm UTC) from US — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 10 HTTP transactions. The main IP is 2600:9000:266e:6000:a:9a74:f000:93a1, located in United States and belongs to AMAZON-02, US. The main domain is benefitsplus-auth-dev.hsbc.com.hk.
TLS certificate: Issued by DigiCert EV RSA CA G2 on August 10th 2023. Valid for: a year.

This is the only time benefitsplus-auth-dev.hsbc.com.hk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
7	2600:9000:266... 2600:9000:266e:6000:a:9a74:f000:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:238... 2600:9000:238d:6600:7:2bfb:7c00:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:811::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81c::2003	15169 (GOOGLE) (GOOGLE)
10	4

7 2600:9000:266e:6000:a:9a74:f000:93a1 (United States)

ASN16509 (AMAZON-02, US)

benefitsplus-auth-dev.hsbc.com.hk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:238d:6600:7:2bfb:7c00:93a1 (United States)

ASN16509 (AMAZON-02, US)

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	hsbc.com.hk benefitsplus-auth-dev.hsbc.com.hk	28 KB
1	gstatic.com fonts.gstatic.com	48 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 110	2 KB
1	tiqcdn.com tags.tiqcdn.com — Cisco Umbrella Rank: 1751	412 B
10	4

	Domain	Requested by
7	benefitsplus-auth-dev.hsbc.com.hk	benefitsplus-auth-dev.hsbc.com.hk
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	benefitsplus-auth-dev.hsbc.com.hk
1	tags.tiqcdn.com	benefitsplus-auth-dev.hsbc.com.hk
10	4

This site contains no links.

Subject Issuer	Validity	Valid
benefitsplus-dev.hsbc.com.hk DigiCert EV RSA CA G2	`2023-08-10` - `2024-09-09`	a year	crt.sh
tags.tiqcdn.com Amazon RSA 2048 M02	`2024-03-19` - `2025-04-17`	a year	crt.sh
upload.video.google.com WR2	`2024-07-01` - `2024-09-23`	3 months	crt.sh
*.gstatic.com WR2	`2024-07-01` - `2024-09-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://benefitsplus-auth-dev.hsbc.com.hk/
Frame ID: 5E2ECA9EF33CCEFCD1E7C8CF43ADC9E7
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Something went wrong

Page URL History Show full URLs

http://benefitsplus-auth-dev.hsbc.com.hk/ HTTP 307
https://benefitsplus-auth-dev.hsbc.com.hk/ Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

78 kB
Transfer

101 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://benefitsplus-auth-dev.hsbc.com.hk/ HTTP 307
https://benefitsplus-auth-dev.hsbc.com.hk/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

404

Primary Request / Show response
benefitsplus-auth-dev.hsbc.com.hk/
Redirect Chain

http://benefitsplus-auth-dev.hsbc.com.hk/
https://benefitsplus-auth-dev.hsbc.com.hk/

1 KB
4 KB

1884ms
1268ms

Document
text/html

2600:9000:266e:6000:a:9a74:f000:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://benefitsplus-auth-dev.hsbc.com.hk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266e:6000:a:9a74:f000:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

df1aa01147bd53253e9a533a03218928192542e21219be95d1e7fa928d2e7c2a

Security Headers

Name	Value
Content-Security-Policy	font-src .hsbc.com.hk fonts.gstatic.com maxcdn.bootstrapcdn.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com data: 'self' 'unsafe-inline'; form-action https: .hsbc.com.hk secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com www.paypal.com www.sandbox.paypal.com 'self' 'unsafe-inline'; frame-ancestors .hsbc.com.hk .stripe.com stripe.com 'self'; frame-src 'self' data: .hsbc.com.hk .my-doc.com lpcdn.lpsnmedia.net td.doubleclick.net fast.amc.demdex.net .adobe.com secure.authorize.net test.authorize.net bid.g.doubleclick.net .youtube.com .youtube-nocookie.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com https://www.google.com/recaptcha/ .weltpixel.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com 'self' 'unsafe-inline'; img-src blob: .google.com.hk .yahoo.com .hsbc.com.hk .tealiumiq.com .adsrvr.org maps.googleapis.com maps.gstatic.com assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net .adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net www.google.com bid.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com t.paypal.com .ftcdn.net .behance.net www.paypal.com fpdbs.paypal.com fpdbs.sandbox.paypal.com .vimeocdn.com i.ytimg.com .youtube.com validator.swagger.io flagpedia.net .gstatic.com data: 'self' 'unsafe-inline'; script-src .hsbc.com.hk unpkg.com connect.facebook.net s.yimg.com visitor-service-ap-northeast-1.tealiumiq.com lptag.liveperson.net datacloud.tealiumiq.com tags.tiqcdn.com assets.adobedtm.com .adobe.com secure.authorize.net test.authorize.net www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com js.braintreegateway.com www.paypal.com .newrelic.com .nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.sandbox.paypal.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com .vimeocdn.com .youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ .gstatic.com maps.googleapis.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com https://www.googletagmanager.com tagmanager.google.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .hsbc.com.hk fonts.googleapis.com .adobe.com maxcdn.bootstrapcdn.com .gstatic.com tagmanager.google.com 'self' 'unsafe-inline'; object-src .hsbc.com.hk 'self' 'unsafe-inline'; media-src .hsbc.com.hk .adobe.com 'self' 'unsafe-inline'; manifest-src .hsbc.com.hk 'self' 'unsafe-inline'; connect-src wss: .hsbc.com.hk www.issthk-dev.hsbc.com.hk:31000 .tealiumiq.com .tiqcdn.com pagead2.googlesyndication.com log-happyhktest.us.v2.customers.biocatch.com log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com .newrelic.com .nr-data.net vimeo.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com www.gstatic.com maps.googleapis.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com https://www.google-analytics.com 'self' 'unsafe-inline'; child-src http: https: .hsbc.com.hk blob: 'self' 'unsafe-inline'; default-src .hsbc.com.hk 'self' 'unsafe-inline' 'unsafe-eval' log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com; base-uri *.hsbc.com.hk 'self' 'unsafe-inline';
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-methods: GET,HEAD
access-control-allow-origin: domain
access-control-max-age: 86
content-encoding: gzip
content-length: 578
content-security-policy: font-src *.hsbc.com.hk fonts.gstatic.com maxcdn.bootstrapcdn.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com data: 'self' 'unsafe-inline'; form-action https: *.hsbc.com.hk secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com www.paypal.com www.sandbox.paypal.com 'self' 'unsafe-inline'; frame-ancestors *.hsbc.com.hk *.stripe.com stripe.com 'self'; frame-src 'self' data: *.hsbc.com.hk *.my-doc.com lpcdn.lpsnmedia.net td.doubleclick.net fast.amc.demdex.net *.adobe.com secure.authorize.net test.authorize.net bid.g.doubleclick.net *.youtube.com *.youtube-nocookie.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com https://www.google.com/recaptcha/ *.weltpixel.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com 'self' 'unsafe-inline'; img-src blob: *.google.com.hk *.yahoo.com *.hsbc.com.hk *.tealiumiq.com *.adsrvr.org maps.googleapis.com maps.gstatic.com assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net *.adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net www.google.com bid.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com t.paypal.com *.ftcdn.net *.behance.net www.paypal.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com i.ytimg.com *.youtube.com validator.swagger.io flagpedia.net *.gstatic.com data: 'self' 'unsafe-inline'; script-src *.hsbc.com.hk unpkg.com connect.facebook.net s.yimg.com visitor-service-ap-northeast-1.tealiumiq.com lptag.liveperson.net datacloud.tealiumiq.com tags.tiqcdn.com assets.adobedtm.com *.adobe.com secure.authorize.net test.authorize.net www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com js.braintreegateway.com www.paypal.com *.newrelic.com *.nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.sandbox.paypal.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com *.vimeocdn.com *.youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ *.gstatic.com maps.googleapis.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com https://www.googletagmanager.com tagmanager.google.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.hsbc.com.hk fonts.googleapis.com *.adobe.com maxcdn.bootstrapcdn.com *.gstatic.com tagmanager.google.com 'self' 'unsafe-inline'; object-src *.hsbc.com.hk 'self' 'unsafe-inline'; media-src *.hsbc.com.hk *.adobe.com 'self' 'unsafe-inline'; manifest-src *.hsbc.com.hk 'self' 'unsafe-inline'; connect-src wss: *.hsbc.com.hk www.issthk-dev.hsbc.com.hk:31000 *.tealiumiq.com *.tiqcdn.com pagead2.googlesyndication.com log-happyhktest.us.v2.customers.biocatch.com log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net vimeo.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com www.gstatic.com maps.googleapis.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com https://www.google-analytics.com 'self' 'unsafe-inline'; child-src http: https: *.hsbc.com.hk blob: 'self' 'unsafe-inline'; default-src *.hsbc.com.hk 'self' 'unsafe-inline' 'unsafe-eval' log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com; base-uri *.hsbc.com.hk 'self' 'unsafe-inline';
content-type: text/html; charset=utf-8
date: Wed, 24 Jul 2024 22:37:02 GMT
etag: W/"4a6-Z96pD+i+0kpLIoUKD0lfij5rzDs"
server: CloudFront
strict-transport-security: max-age=63072000; includeSubdomains; preload
vary: Accept-Encoding
via: 1.1 37236193bd380575cb98e661bedbb260.cloudfront.net (CloudFront)
x-amz-apigw-id: bcFCVGn3HUYErfA=
x-amz-cf-id: hW3MC99tzuT4bA4j-fTKoqEP3AKICVYv3uP7I_9WlqX4AMxexDmAVw==
x-amz-cf-pop: FRA56-P8
x-amzn-remapped-connection: keep-alive
x-amzn-remapped-date: Wed, 24 Jul 2024 22:37:02 GMT
x-amzn-requestid: 3909a567-e761-44af-bedf-422850933614
x-cache: Error from cloudfront
x-content-type-options: nosniff
x-correlation-id: 401ed88572f7716af69d43d375ce7154
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

Redirect headers

Location: https://benefitsplus-auth-dev.hsbc.com.hk/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 utag.sync.js Show response
tags.tiqcdn.com/utag/hsbc/hk-rbwm-gsp/undefined/ 3 B
412 B 589ms
514ms Script
application/javascript 2600:9000:238d:6600:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/hsbc/hk-rbwm-gsp/undefined/utag.sync.js
Requested by: Host: benefitsplus-auth-dev.hsbc.com.hk
URL: https://benefitsplus-auth-dev.hsbc.com.hk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:238d:6600:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 101ead936a2281d53dcc064b7e2a2ab0d53b92ef3ef7b34b668673007895c860

Request headers

Referer: https://benefitsplus-auth-dev.hsbc.com.hk/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-amz-version-id: nLbQyMlglyGoXodCndLd0t6DmRceuaJH
date: Wed, 24 Jul 2024 21:15:28 GMT
via: 1.1 0e12b175c31e0e750266df78bf0e1068.cloudfront.net (CloudFront)
last-modified: Thu, 02 Mar 2023 22:20:41 GMT
server: AmazonS3
x-amz-cf-pop: AMS1-P1
age: 4897
x-amz-server-side-encryption: AES256
etag: "b519d08ef66fd54910edbedba6181ec2"
vary: Accept-Encoding
x-cache: Error from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 3
x-amz-cf-id: E7lvm4FbDGpCl6YYyhIvqGGxowohmBS3RedTSq4-NFS9NiYA12tGig==

GET
H2 200 css
fonts.googleapis.com/ 22 KB
2 KB 155ms
55ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700

Requested by

Host: benefitsplus-auth-dev.hsbc.com.hk
URL: https://benefitsplus-auth-dev.hsbc.com.hk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

31fe46164ce2459191ca1f7727fd742ce01833ee4f705459e88d43f53fcc9f80

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://benefitsplus-auth-dev.hsbc.com.hk/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 24 Jul 2024 22:37:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 24 Jul 2024 21:09:32 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 24 Jul 2024 22:37:03 GMT

GET
H2 200 main.css
benefitsplus-auth-dev.hsbc.com.hk/static/assets/css/ 13 KB
7 KB 966ms
965ms Stylesheet
text/css 2600:9000:266e:6000:a:9a74:f000:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://benefitsplus-auth-dev.hsbc.com.hk/static/assets/css/main.css

Requested by

Host: benefitsplus-auth-dev.hsbc.com.hk
URL: https://benefitsplus-auth-dev.hsbc.com.hk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266e:6000:a:9a74:f000:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

c42319ce7aea1c71d227a3f114dc79725b0362444c45901c3715d7c7511bf799

Security Headers

Name	Value
Content-Security-Policy	font-src .hsbc.com.hk fonts.gstatic.com maxcdn.bootstrapcdn.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com data: 'self' 'unsafe-inline'; form-action https: .hsbc.com.hk secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com www.paypal.com www.sandbox.paypal.com 'self' 'unsafe-inline'; frame-ancestors .hsbc.com.hk .stripe.com stripe.com 'self'; frame-src 'self' data: .hsbc.com.hk .my-doc.com lpcdn.lpsnmedia.net td.doubleclick.net fast.amc.demdex.net .adobe.com secure.authorize.net test.authorize.net bid.g.doubleclick.net .youtube.com .youtube-nocookie.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com https://www.google.com/recaptcha/ .weltpixel.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com 'self' 'unsafe-inline'; img-src blob: .google.com.hk .yahoo.com .hsbc.com.hk .tealiumiq.com .adsrvr.org maps.googleapis.com maps.gstatic.com assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net .adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net www.google.com bid.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com t.paypal.com .ftcdn.net .behance.net www.paypal.com fpdbs.paypal.com fpdbs.sandbox.paypal.com .vimeocdn.com i.ytimg.com .youtube.com validator.swagger.io flagpedia.net .gstatic.com data: 'self' 'unsafe-inline'; script-src .hsbc.com.hk unpkg.com connect.facebook.net s.yimg.com visitor-service-ap-northeast-1.tealiumiq.com lptag.liveperson.net datacloud.tealiumiq.com tags.tiqcdn.com assets.adobedtm.com .adobe.com secure.authorize.net test.authorize.net www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com js.braintreegateway.com www.paypal.com .newrelic.com .nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.sandbox.paypal.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com .vimeocdn.com .youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ .gstatic.com maps.googleapis.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com https://www.googletagmanager.com tagmanager.google.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .hsbc.com.hk fonts.googleapis.com .adobe.com maxcdn.bootstrapcdn.com .gstatic.com tagmanager.google.com 'self' 'unsafe-inline'; object-src .hsbc.com.hk 'self' 'unsafe-inline'; media-src .hsbc.com.hk .adobe.com 'self' 'unsafe-inline'; manifest-src .hsbc.com.hk 'self' 'unsafe-inline'; connect-src wss: .hsbc.com.hk www.issthk-dev.hsbc.com.hk:31000 .tealiumiq.com .tiqcdn.com pagead2.googlesyndication.com log-happyhktest.us.v2.customers.biocatch.com log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com .newrelic.com .nr-data.net vimeo.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com www.gstatic.com maps.googleapis.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com https://www.google-analytics.com 'self' 'unsafe-inline'; child-src http: https: .hsbc.com.hk blob: 'self' 'unsafe-inline'; default-src .hsbc.com.hk 'self' 'unsafe-inline' 'unsafe-eval' log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com; base-uri *.hsbc.com.hk 'self' 'unsafe-inline';
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://benefitsplus-auth-dev.hsbc.com.hk/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 22:37:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-correlation-id: ab1fd39f9e13cba00f7b0e52515cecc8
content-security-policy: font-src *.hsbc.com.hk fonts.gstatic.com maxcdn.bootstrapcdn.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com data: 'self' 'unsafe-inline'; form-action https: *.hsbc.com.hk secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com www.paypal.com www.sandbox.paypal.com 'self' 'unsafe-inline'; frame-ancestors *.hsbc.com.hk *.stripe.com stripe.com 'self'; frame-src 'self' data: *.hsbc.com.hk *.my-doc.com lpcdn.lpsnmedia.net td.doubleclick.net fast.amc.demdex.net *.adobe.com secure.authorize.net test.authorize.net bid.g.doubleclick.net *.youtube.com *.youtube-nocookie.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com https://www.google.com/recaptcha/ *.weltpixel.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com 'self' 'unsafe-inline'; img-src blob: *.google.com.hk *.yahoo.com *.hsbc.com.hk *.tealiumiq.com *.adsrvr.org maps.googleapis.com maps.gstatic.com assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net *.adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net www.google.com bid.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com t.paypal.com *.ftcdn.net *.behance.net www.paypal.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com i.ytimg.com *.youtube.com validator.swagger.io flagpedia.net *.gstatic.com data: 'self' 'unsafe-inline'; script-src *.hsbc.com.hk unpkg.com connect.facebook.net s.yimg.com visitor-service-ap-northeast-1.tealiumiq.com lptag.liveperson.net datacloud.tealiumiq.com tags.tiqcdn.com assets.adobedtm.com *.adobe.com secure.authorize.net test.authorize.net www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com js.braintreegateway.com www.paypal.com *.newrelic.com *.nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.sandbox.paypal.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com *.vimeocdn.com *.youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ *.gstatic.com maps.googleapis.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com https://www.googletagmanager.com tagmanager.google.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.hsbc.com.hk fonts.googleapis.com *.adobe.com maxcdn.bootstrapcdn.com *.gstatic.com tagmanager.google.com 'self' 'unsafe-inline'; object-src *.hsbc.com.hk 'self' 'unsafe-inline'; media-src *.hsbc.com.hk *.adobe.com 'self' 'unsafe-inline'; manifest-src *.hsbc.com.hk 'self' 'unsafe-inline'; connect-src wss: *.hsbc.com.hk www.issthk-dev.hsbc.com.hk:31000 *.tealiumiq.com *.tiqcdn.com pagead2.googlesyndication.com log-happyhktest.us.v2.customers.biocatch.com log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net vimeo.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com www.gstatic.com maps.googleapis.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com https://www.google-analytics.com 'self' 'unsafe-inline'; child-src http: https: *.hsbc.com.hk blob: 'self' 'unsafe-inline'; default-src *.hsbc.com.hk 'self' 'unsafe-inline' 'unsafe-eval' log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com; base-uri *.hsbc.com.hk 'self' 'unsafe-inline';
via: 1.1 37236193bd380575cb98e661bedbb260.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P8
x-amzn-remapped-connection: keep-alive
x-amzn-requestid: c147d2e2-1b8b-44f4-a61a-230ee106b26c
x-dns-prefetch-control: off
x-cache: Miss from cloudfront
x-amz-apigw-id: bcFCiE9EnUYEDqA=
content-length: 3038
x-xss-protection: 1; mode=block
last-modified: Fri, 14 Jun 2024 09:38:46 GMT
server: CloudFront
etag: W/"333f-190161d2070"
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
access-control-allow-origin: domain
access-control-allow-methods: GET,HEAD
cache-control: public, max-age=0
access-control-max-age: 86
accept-ranges: bytes
x-amzn-remapped-date: Wed, 24 Jul 2024 22:37:03 GMT
x-amz-cf-id: JV4deYA5AeN5Ac0YVKfPXw03NfChkKeIwQUwJc1pq4mOx0in6yoClA==

GET
H2 200 main.js Show response
benefitsplus-auth-dev.hsbc.com.hk/static/assets/js/ 12 KB
7 KB 1051ms
1051ms Script
application/javascript 2600:9000:266e:6000:a:9a74:f000:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://benefitsplus-auth-dev.hsbc.com.hk/static/assets/js/main.js

Requested by

Host: benefitsplus-auth-dev.hsbc.com.hk
URL: https://benefitsplus-auth-dev.hsbc.com.hk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266e:6000:a:9a74:f000:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

f63aa9cbf1ed197a7e8d6e192bedd57a3376bc1defa5fc2bcc84835eed6900c9

Security Headers

Name	Value
Content-Security-Policy	font-src .hsbc.com.hk fonts.gstatic.com maxcdn.bootstrapcdn.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com data: 'self' 'unsafe-inline'; form-action https: .hsbc.com.hk secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com www.paypal.com www.sandbox.paypal.com 'self' 'unsafe-inline'; frame-ancestors .hsbc.com.hk .stripe.com stripe.com 'self'; frame-src 'self' data: .hsbc.com.hk .my-doc.com lpcdn.lpsnmedia.net td.doubleclick.net fast.amc.demdex.net .adobe.com secure.authorize.net test.authorize.net bid.g.doubleclick.net .youtube.com .youtube-nocookie.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com https://www.google.com/recaptcha/ .weltpixel.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com 'self' 'unsafe-inline'; img-src blob: .google.com.hk .yahoo.com .hsbc.com.hk .tealiumiq.com .adsrvr.org maps.googleapis.com maps.gstatic.com assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net .adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net www.google.com bid.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com t.paypal.com .ftcdn.net .behance.net www.paypal.com fpdbs.paypal.com fpdbs.sandbox.paypal.com .vimeocdn.com i.ytimg.com .youtube.com validator.swagger.io flagpedia.net .gstatic.com data: 'self' 'unsafe-inline'; script-src .hsbc.com.hk unpkg.com connect.facebook.net s.yimg.com visitor-service-ap-northeast-1.tealiumiq.com lptag.liveperson.net datacloud.tealiumiq.com tags.tiqcdn.com assets.adobedtm.com .adobe.com secure.authorize.net test.authorize.net www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com js.braintreegateway.com www.paypal.com .newrelic.com .nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.sandbox.paypal.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com .vimeocdn.com .youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ .gstatic.com maps.googleapis.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com https://www.googletagmanager.com tagmanager.google.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .hsbc.com.hk fonts.googleapis.com .adobe.com maxcdn.bootstrapcdn.com .gstatic.com tagmanager.google.com 'self' 'unsafe-inline'; object-src .hsbc.com.hk 'self' 'unsafe-inline'; media-src .hsbc.com.hk .adobe.com 'self' 'unsafe-inline'; manifest-src .hsbc.com.hk 'self' 'unsafe-inline'; connect-src wss: .hsbc.com.hk www.issthk-dev.hsbc.com.hk:31000 .tealiumiq.com .tiqcdn.com pagead2.googlesyndication.com log-happyhktest.us.v2.customers.biocatch.com log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com .newrelic.com .nr-data.net vimeo.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com www.gstatic.com maps.googleapis.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com https://www.google-analytics.com 'self' 'unsafe-inline'; child-src http: https: .hsbc.com.hk blob: 'self' 'unsafe-inline'; default-src .hsbc.com.hk 'self' 'unsafe-inline' 'unsafe-eval' log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com; base-uri *.hsbc.com.hk 'self' 'unsafe-inline';
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://benefitsplus-auth-dev.hsbc.com.hk/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 22:37:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-correlation-id: e46ebb320afd4d1a51d27c5b7e3a5b5d
content-security-policy: font-src *.hsbc.com.hk fonts.gstatic.com maxcdn.bootstrapcdn.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com data: 'self' 'unsafe-inline'; form-action https: *.hsbc.com.hk secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com www.paypal.com www.sandbox.paypal.com 'self' 'unsafe-inline'; frame-ancestors *.hsbc.com.hk *.stripe.com stripe.com 'self'; frame-src 'self' data: *.hsbc.com.hk *.my-doc.com lpcdn.lpsnmedia.net td.doubleclick.net fast.amc.demdex.net *.adobe.com secure.authorize.net test.authorize.net bid.g.doubleclick.net *.youtube.com *.youtube-nocookie.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com https://www.google.com/recaptcha/ *.weltpixel.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com 'self' 'unsafe-inline'; img-src blob: *.google.com.hk *.yahoo.com *.hsbc.com.hk *.tealiumiq.com *.adsrvr.org maps.googleapis.com maps.gstatic.com assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net *.adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net www.google.com bid.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com t.paypal.com *.ftcdn.net *.behance.net www.paypal.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com i.ytimg.com *.youtube.com validator.swagger.io flagpedia.net *.gstatic.com data: 'self' 'unsafe-inline'; script-src *.hsbc.com.hk unpkg.com connect.facebook.net s.yimg.com visitor-service-ap-northeast-1.tealiumiq.com lptag.liveperson.net datacloud.tealiumiq.com tags.tiqcdn.com assets.adobedtm.com *.adobe.com secure.authorize.net test.authorize.net www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com js.braintreegateway.com www.paypal.com *.newrelic.com *.nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.sandbox.paypal.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com *.vimeocdn.com *.youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ *.gstatic.com maps.googleapis.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com https://www.googletagmanager.com tagmanager.google.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.hsbc.com.hk fonts.googleapis.com *.adobe.com maxcdn.bootstrapcdn.com *.gstatic.com tagmanager.google.com 'self' 'unsafe-inline'; object-src *.hsbc.com.hk 'self' 'unsafe-inline'; media-src *.hsbc.com.hk *.adobe.com 'self' 'unsafe-inline'; manifest-src *.hsbc.com.hk 'self' 'unsafe-inline'; connect-src wss: *.hsbc.com.hk www.issthk-dev.hsbc.com.hk:31000 *.tealiumiq.com *.tiqcdn.com pagead2.googlesyndication.com log-happyhktest.us.v2.customers.biocatch.com log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net vimeo.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com www.gstatic.com maps.googleapis.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com https://www.google-analytics.com 'self' 'unsafe-inline'; child-src http: https: *.hsbc.com.hk blob: 'self' 'unsafe-inline'; default-src *.hsbc.com.hk 'self' 'unsafe-inline' 'unsafe-eval' log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com; base-uri *.hsbc.com.hk 'self' 'unsafe-inline';
via: 1.1 37236193bd380575cb98e661bedbb260.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P8
x-amzn-remapped-connection: keep-alive
x-amzn-requestid: ce30396d-3b97-4713-a45f-f540a38b7dd5
x-dns-prefetch-control: off
x-cache: Miss from cloudfront
x-amz-apigw-id: bcFCiGMsnUYEQQg=
content-length: 2912
x-xss-protection: 1; mode=block
last-modified: Fri, 14 Jun 2024 09:38:46 GMT
server: CloudFront
etag: W/"30db-190161d2070"
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: domain
access-control-allow-methods: GET,HEAD
cache-control: public, max-age=0
access-control-max-age: 86
accept-ranges: bytes
x-amzn-remapped-date: Wed, 24 Jul 2024 22:37:03 GMT
x-amz-cf-id: IDJs8o6qNB6KkIl9GvpaE_odXSKto19KVU-vmfD3a9hecBBsD20aWg==

GET
H2 404 utag_data.js
benefitsplus-auth-dev.hsbc.com.hk/static/assets/tealium/undefined/ 0
0 984ms
984ms Script
application/json 2600:9000:266e:6000:a:9a74:f000:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://benefitsplus-auth-dev.hsbc.com.hk/static/assets/tealium/undefined/utag_data.js

Requested by

Host: benefitsplus-auth-dev.hsbc.com.hk
URL: https://benefitsplus-auth-dev.hsbc.com.hk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266e:6000:a:9a74:f000:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	font-src .hsbc.com.hk fonts.gstatic.com maxcdn.bootstrapcdn.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com data: 'self' 'unsafe-inline'; form-action https: .hsbc.com.hk secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com www.paypal.com www.sandbox.paypal.com 'self' 'unsafe-inline'; frame-ancestors .hsbc.com.hk .stripe.com stripe.com 'self'; frame-src 'self' data: .hsbc.com.hk .my-doc.com lpcdn.lpsnmedia.net td.doubleclick.net fast.amc.demdex.net .adobe.com secure.authorize.net test.authorize.net bid.g.doubleclick.net .youtube.com .youtube-nocookie.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com https://www.google.com/recaptcha/ .weltpixel.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com 'self' 'unsafe-inline'; img-src blob: .google.com.hk .yahoo.com .hsbc.com.hk .tealiumiq.com .adsrvr.org maps.googleapis.com maps.gstatic.com assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net .adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net www.google.com bid.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com t.paypal.com .ftcdn.net .behance.net www.paypal.com fpdbs.paypal.com fpdbs.sandbox.paypal.com .vimeocdn.com i.ytimg.com .youtube.com validator.swagger.io flagpedia.net .gstatic.com data: 'self' 'unsafe-inline'; script-src .hsbc.com.hk unpkg.com connect.facebook.net s.yimg.com visitor-service-ap-northeast-1.tealiumiq.com lptag.liveperson.net datacloud.tealiumiq.com tags.tiqcdn.com assets.adobedtm.com .adobe.com secure.authorize.net test.authorize.net www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com js.braintreegateway.com www.paypal.com .newrelic.com .nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.sandbox.paypal.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com .vimeocdn.com .youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ .gstatic.com maps.googleapis.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com https://www.googletagmanager.com tagmanager.google.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .hsbc.com.hk fonts.googleapis.com .adobe.com maxcdn.bootstrapcdn.com .gstatic.com tagmanager.google.com 'self' 'unsafe-inline'; object-src .hsbc.com.hk 'self' 'unsafe-inline'; media-src .hsbc.com.hk .adobe.com 'self' 'unsafe-inline'; manifest-src .hsbc.com.hk 'self' 'unsafe-inline'; connect-src wss: .hsbc.com.hk www.issthk-dev.hsbc.com.hk:31000 .tealiumiq.com .tiqcdn.com pagead2.googlesyndication.com log-happyhktest.us.v2.customers.biocatch.com log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com .newrelic.com .nr-data.net vimeo.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com www.gstatic.com maps.googleapis.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com https://www.google-analytics.com 'self' 'unsafe-inline'; child-src http: https: .hsbc.com.hk blob: 'self' 'unsafe-inline'; default-src .hsbc.com.hk 'self' 'unsafe-inline' 'unsafe-eval' log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com; base-uri *.hsbc.com.hk 'self' 'unsafe-inline';
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://benefitsplus-auth-dev.hsbc.com.hk/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 22:37:03 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
x-amzn-remapped-content-length: 145
x-correlation-id: 289e7a38d80736aff4b061374331cfe4
content-security-policy: font-src *.hsbc.com.hk fonts.gstatic.com maxcdn.bootstrapcdn.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com data: 'self' 'unsafe-inline'; form-action https: *.hsbc.com.hk secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com www.paypal.com www.sandbox.paypal.com 'self' 'unsafe-inline'; frame-ancestors *.hsbc.com.hk *.stripe.com stripe.com 'self'; frame-src 'self' data: *.hsbc.com.hk *.my-doc.com lpcdn.lpsnmedia.net td.doubleclick.net fast.amc.demdex.net *.adobe.com secure.authorize.net test.authorize.net bid.g.doubleclick.net *.youtube.com *.youtube-nocookie.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com https://www.google.com/recaptcha/ *.weltpixel.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com 'self' 'unsafe-inline'; img-src blob: *.google.com.hk *.yahoo.com *.hsbc.com.hk *.tealiumiq.com *.adsrvr.org maps.googleapis.com maps.gstatic.com assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net *.adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net www.google.com bid.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com t.paypal.com *.ftcdn.net *.behance.net www.paypal.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com i.ytimg.com *.youtube.com validator.swagger.io flagpedia.net *.gstatic.com data: 'self' 'unsafe-inline'; script-src *.hsbc.com.hk unpkg.com connect.facebook.net s.yimg.com visitor-service-ap-northeast-1.tealiumiq.com lptag.liveperson.net datacloud.tealiumiq.com tags.tiqcdn.com assets.adobedtm.com *.adobe.com secure.authorize.net test.authorize.net www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com js.braintreegateway.com www.paypal.com *.newrelic.com *.nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.sandbox.paypal.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com *.vimeocdn.com *.youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ *.gstatic.com maps.googleapis.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com https://www.googletagmanager.com tagmanager.google.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.hsbc.com.hk fonts.googleapis.com *.adobe.com maxcdn.bootstrapcdn.com *.gstatic.com tagmanager.google.com 'self' 'unsafe-inline'; object-src *.hsbc.com.hk 'self' 'unsafe-inline'; media-src *.hsbc.com.hk *.adobe.com 'self' 'unsafe-inline'; manifest-src *.hsbc.com.hk 'self' 'unsafe-inline'; connect-src wss: *.hsbc.com.hk www.issthk-dev.hsbc.com.hk:31000 *.tealiumiq.com *.tiqcdn.com pagead2.googlesyndication.com log-happyhktest.us.v2.customers.biocatch.com log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net vimeo.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com www.gstatic.com maps.googleapis.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com https://www.google-analytics.com 'self' 'unsafe-inline'; child-src http: https: *.hsbc.com.hk blob: 'self' 'unsafe-inline'; default-src *.hsbc.com.hk 'self' 'unsafe-inline' 'unsafe-eval' log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com; base-uri *.hsbc.com.hk 'self' 'unsafe-inline';
via: 1.1 37236193bd380575cb98e661bedbb260.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P8
x-amzn-remapped-connection: keep-alive
x-amzn-requestid: a1567aae-b3b8-4a5e-be1b-8396327aa7b0
x-dns-prefetch-control: off
x-cache: Error from cloudfront
x-amz-apigw-id: bcFCiH5ZnUYEWwA=
content-length: 145
x-xss-protection: 1; mode=block
server: CloudFront
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: domain
access-control-allow-methods: GET,HEAD
access-control-max-age: 86
x-amzn-remapped-date: Wed, 24 Jul 2024 22:37:03 GMT
x-amz-cf-id: CLKginYeYp9V0xZVxYk9KsEsgLzDJvKzi4je1r5sHrfjnjq7ChTwUA==

GET
H2 404 utag.js
benefitsplus-auth-dev.hsbc.com.hk/static/assets/tealium/undefined/ 0
0 1004ms
1003ms Script
application/json 2600:9000:266e:6000:a:9a74:f000:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://benefitsplus-auth-dev.hsbc.com.hk/static/assets/tealium/undefined/utag.js

Requested by

Host: benefitsplus-auth-dev.hsbc.com.hk
URL: https://benefitsplus-auth-dev.hsbc.com.hk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266e:6000:a:9a74:f000:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	font-src .hsbc.com.hk fonts.gstatic.com maxcdn.bootstrapcdn.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com data: 'self' 'unsafe-inline'; form-action https: .hsbc.com.hk secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com www.paypal.com www.sandbox.paypal.com 'self' 'unsafe-inline'; frame-ancestors .hsbc.com.hk .stripe.com stripe.com 'self'; frame-src 'self' data: .hsbc.com.hk .my-doc.com lpcdn.lpsnmedia.net td.doubleclick.net fast.amc.demdex.net .adobe.com secure.authorize.net test.authorize.net bid.g.doubleclick.net .youtube.com .youtube-nocookie.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com https://www.google.com/recaptcha/ .weltpixel.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com 'self' 'unsafe-inline'; img-src blob: .google.com.hk .yahoo.com .hsbc.com.hk .tealiumiq.com .adsrvr.org maps.googleapis.com maps.gstatic.com assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net .adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net www.google.com bid.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com t.paypal.com .ftcdn.net .behance.net www.paypal.com fpdbs.paypal.com fpdbs.sandbox.paypal.com .vimeocdn.com i.ytimg.com .youtube.com validator.swagger.io flagpedia.net .gstatic.com data: 'self' 'unsafe-inline'; script-src .hsbc.com.hk unpkg.com connect.facebook.net s.yimg.com visitor-service-ap-northeast-1.tealiumiq.com lptag.liveperson.net datacloud.tealiumiq.com tags.tiqcdn.com assets.adobedtm.com .adobe.com secure.authorize.net test.authorize.net www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com js.braintreegateway.com www.paypal.com .newrelic.com .nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.sandbox.paypal.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com .vimeocdn.com .youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ .gstatic.com maps.googleapis.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com https://www.googletagmanager.com tagmanager.google.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .hsbc.com.hk fonts.googleapis.com .adobe.com maxcdn.bootstrapcdn.com .gstatic.com tagmanager.google.com 'self' 'unsafe-inline'; object-src .hsbc.com.hk 'self' 'unsafe-inline'; media-src .hsbc.com.hk .adobe.com 'self' 'unsafe-inline'; manifest-src .hsbc.com.hk 'self' 'unsafe-inline'; connect-src wss: .hsbc.com.hk www.issthk-dev.hsbc.com.hk:31000 .tealiumiq.com .tiqcdn.com pagead2.googlesyndication.com log-happyhktest.us.v2.customers.biocatch.com log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com .newrelic.com .nr-data.net vimeo.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com www.gstatic.com maps.googleapis.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com https://www.google-analytics.com 'self' 'unsafe-inline'; child-src http: https: .hsbc.com.hk blob: 'self' 'unsafe-inline'; default-src .hsbc.com.hk 'self' 'unsafe-inline' 'unsafe-eval' log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com; base-uri *.hsbc.com.hk 'self' 'unsafe-inline';
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://benefitsplus-auth-dev.hsbc.com.hk/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 22:37:04 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
x-amzn-remapped-content-length: 140
x-correlation-id: cc62a833b8888ac186324d2e766dfc34
content-security-policy: font-src *.hsbc.com.hk fonts.gstatic.com maxcdn.bootstrapcdn.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com data: 'self' 'unsafe-inline'; form-action https: *.hsbc.com.hk secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com www.paypal.com www.sandbox.paypal.com 'self' 'unsafe-inline'; frame-ancestors *.hsbc.com.hk *.stripe.com stripe.com 'self'; frame-src 'self' data: *.hsbc.com.hk *.my-doc.com lpcdn.lpsnmedia.net td.doubleclick.net fast.amc.demdex.net *.adobe.com secure.authorize.net test.authorize.net bid.g.doubleclick.net *.youtube.com *.youtube-nocookie.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com https://www.google.com/recaptcha/ *.weltpixel.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com 'self' 'unsafe-inline'; img-src blob: *.google.com.hk *.yahoo.com *.hsbc.com.hk *.tealiumiq.com *.adsrvr.org maps.googleapis.com maps.gstatic.com assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net *.adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net www.google.com bid.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com t.paypal.com *.ftcdn.net *.behance.net www.paypal.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com i.ytimg.com *.youtube.com validator.swagger.io flagpedia.net *.gstatic.com data: 'self' 'unsafe-inline'; script-src *.hsbc.com.hk unpkg.com connect.facebook.net s.yimg.com visitor-service-ap-northeast-1.tealiumiq.com lptag.liveperson.net datacloud.tealiumiq.com tags.tiqcdn.com assets.adobedtm.com *.adobe.com secure.authorize.net test.authorize.net www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com js.braintreegateway.com www.paypal.com *.newrelic.com *.nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.sandbox.paypal.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com *.vimeocdn.com *.youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ *.gstatic.com maps.googleapis.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com https://www.googletagmanager.com tagmanager.google.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.hsbc.com.hk fonts.googleapis.com *.adobe.com maxcdn.bootstrapcdn.com *.gstatic.com tagmanager.google.com 'self' 'unsafe-inline'; object-src *.hsbc.com.hk 'self' 'unsafe-inline'; media-src *.hsbc.com.hk *.adobe.com 'self' 'unsafe-inline'; manifest-src *.hsbc.com.hk 'self' 'unsafe-inline'; connect-src wss: *.hsbc.com.hk www.issthk-dev.hsbc.com.hk:31000 *.tealiumiq.com *.tiqcdn.com pagead2.googlesyndication.com log-happyhktest.us.v2.customers.biocatch.com log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net vimeo.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com www.gstatic.com maps.googleapis.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com https://www.google-analytics.com 'self' 'unsafe-inline'; child-src http: https: *.hsbc.com.hk blob: 'self' 'unsafe-inline'; default-src *.hsbc.com.hk 'self' 'unsafe-inline' 'unsafe-eval' log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com; base-uri *.hsbc.com.hk 'self' 'unsafe-inline';
via: 1.1 37236193bd380575cb98e661bedbb260.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P8
x-amzn-remapped-connection: keep-alive
x-amzn-requestid: 643f37ea-259d-4142-9370-186417035843
x-dns-prefetch-control: off
x-cache: Error from cloudfront
x-amz-apigw-id: bcFCiGFsnUYEe5Q=
content-length: 140
x-xss-protection: 1; mode=block
server: CloudFront
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: domain
access-control-allow-methods: GET,HEAD
access-control-max-age: 86
x-amzn-remapped-date: Wed, 24 Jul 2024 22:37:03 GMT
x-amz-cf-id: e6vxlj8sPCQDUYqFsz7HcokTMFunSV8lJvZ9MHQuMfSS18MSH1KkMQ==

GET
H2 200 error.svg
benefitsplus-auth-dev.hsbc.com.hk/static/assets/images/ 5 KB
6 KB 950ms
950ms Image
image/svg+xml 2600:9000:266e:6000:a:9a74:f000:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://benefitsplus-auth-dev.hsbc.com.hk/static/assets/images/error.svg

Requested by

Host: benefitsplus-auth-dev.hsbc.com.hk
URL: https://benefitsplus-auth-dev.hsbc.com.hk/static/assets/css/main.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266e:6000:a:9a74:f000:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

0719b6941df6ae5ae85e23268b4bdf3ee804e27941de3cdd9655e73ac9cc5aa0

Security Headers

Name	Value
Content-Security-Policy	font-src .hsbc.com.hk fonts.gstatic.com maxcdn.bootstrapcdn.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com data: 'self' 'unsafe-inline'; form-action https: .hsbc.com.hk secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com www.paypal.com www.sandbox.paypal.com 'self' 'unsafe-inline'; frame-ancestors .hsbc.com.hk .stripe.com stripe.com 'self'; frame-src 'self' data: .hsbc.com.hk .my-doc.com lpcdn.lpsnmedia.net td.doubleclick.net fast.amc.demdex.net .adobe.com secure.authorize.net test.authorize.net bid.g.doubleclick.net .youtube.com .youtube-nocookie.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com https://www.google.com/recaptcha/ .weltpixel.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com 'self' 'unsafe-inline'; img-src blob: .google.com.hk .yahoo.com .hsbc.com.hk .tealiumiq.com .adsrvr.org maps.googleapis.com maps.gstatic.com assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net .adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net www.google.com bid.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com t.paypal.com .ftcdn.net .behance.net www.paypal.com fpdbs.paypal.com fpdbs.sandbox.paypal.com .vimeocdn.com i.ytimg.com .youtube.com validator.swagger.io flagpedia.net .gstatic.com data: 'self' 'unsafe-inline'; script-src .hsbc.com.hk unpkg.com connect.facebook.net s.yimg.com visitor-service-ap-northeast-1.tealiumiq.com lptag.liveperson.net datacloud.tealiumiq.com tags.tiqcdn.com assets.adobedtm.com .adobe.com secure.authorize.net test.authorize.net www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com js.braintreegateway.com www.paypal.com .newrelic.com .nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.sandbox.paypal.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com .vimeocdn.com .youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ .gstatic.com maps.googleapis.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com https://www.googletagmanager.com tagmanager.google.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .hsbc.com.hk fonts.googleapis.com .adobe.com maxcdn.bootstrapcdn.com .gstatic.com tagmanager.google.com 'self' 'unsafe-inline'; object-src .hsbc.com.hk 'self' 'unsafe-inline'; media-src .hsbc.com.hk .adobe.com 'self' 'unsafe-inline'; manifest-src .hsbc.com.hk 'self' 'unsafe-inline'; connect-src wss: .hsbc.com.hk www.issthk-dev.hsbc.com.hk:31000 .tealiumiq.com .tiqcdn.com pagead2.googlesyndication.com log-happyhktest.us.v2.customers.biocatch.com log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com .newrelic.com .nr-data.net vimeo.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com www.gstatic.com maps.googleapis.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com https://www.google-analytics.com 'self' 'unsafe-inline'; child-src http: https: .hsbc.com.hk blob: 'self' 'unsafe-inline'; default-src .hsbc.com.hk 'self' 'unsafe-inline' 'unsafe-eval' log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com; base-uri *.hsbc.com.hk 'self' 'unsafe-inline';
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://benefitsplus-auth-dev.hsbc.com.hk/static/assets/css/main.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 22:37:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-correlation-id: 673d8c966b2e5845b59476bd1f6c4e46
content-security-policy: font-src *.hsbc.com.hk fonts.gstatic.com maxcdn.bootstrapcdn.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com data: 'self' 'unsafe-inline'; form-action https: *.hsbc.com.hk secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com www.paypal.com www.sandbox.paypal.com 'self' 'unsafe-inline'; frame-ancestors *.hsbc.com.hk *.stripe.com stripe.com 'self'; frame-src 'self' data: *.hsbc.com.hk *.my-doc.com lpcdn.lpsnmedia.net td.doubleclick.net fast.amc.demdex.net *.adobe.com secure.authorize.net test.authorize.net bid.g.doubleclick.net *.youtube.com *.youtube-nocookie.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com https://www.google.com/recaptcha/ *.weltpixel.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com 'self' 'unsafe-inline'; img-src blob: *.google.com.hk *.yahoo.com *.hsbc.com.hk *.tealiumiq.com *.adsrvr.org maps.googleapis.com maps.gstatic.com assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net *.adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net www.google.com bid.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com t.paypal.com *.ftcdn.net *.behance.net www.paypal.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com i.ytimg.com *.youtube.com validator.swagger.io flagpedia.net *.gstatic.com data: 'self' 'unsafe-inline'; script-src *.hsbc.com.hk unpkg.com connect.facebook.net s.yimg.com visitor-service-ap-northeast-1.tealiumiq.com lptag.liveperson.net datacloud.tealiumiq.com tags.tiqcdn.com assets.adobedtm.com *.adobe.com secure.authorize.net test.authorize.net www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com js.braintreegateway.com www.paypal.com *.newrelic.com *.nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.sandbox.paypal.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com *.vimeocdn.com *.youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ *.gstatic.com maps.googleapis.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com https://www.googletagmanager.com tagmanager.google.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.hsbc.com.hk fonts.googleapis.com *.adobe.com maxcdn.bootstrapcdn.com *.gstatic.com tagmanager.google.com 'self' 'unsafe-inline'; object-src *.hsbc.com.hk 'self' 'unsafe-inline'; media-src *.hsbc.com.hk *.adobe.com 'self' 'unsafe-inline'; manifest-src *.hsbc.com.hk 'self' 'unsafe-inline'; connect-src wss: *.hsbc.com.hk www.issthk-dev.hsbc.com.hk:31000 *.tealiumiq.com *.tiqcdn.com pagead2.googlesyndication.com log-happyhktest.us.v2.customers.biocatch.com log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net vimeo.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com www.gstatic.com maps.googleapis.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com https://www.google-analytics.com 'self' 'unsafe-inline'; child-src http: https: *.hsbc.com.hk blob: 'self' 'unsafe-inline'; default-src *.hsbc.com.hk 'self' 'unsafe-inline' 'unsafe-eval' log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com; base-uri *.hsbc.com.hk 'self' 'unsafe-inline';
via: 1.1 37236193bd380575cb98e661bedbb260.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P8
x-amzn-remapped-connection: keep-alive
x-amzn-requestid: 6d50e365-ac79-46db-8bd3-24aa69e6be48
x-dns-prefetch-control: off
x-cache: Miss from cloudfront
x-amz-apigw-id: bcFCtG2aHUYEcDQ=
content-length: 2319
x-xss-protection: 1; mode=block
last-modified: Fri, 14 Jun 2024 09:38:46 GMT
server: CloudFront
etag: W/"1480-190161d2070"
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: domain
access-control-allow-methods: GET,HEAD
cache-control: public, max-age=0
access-control-max-age: 86
accept-ranges: bytes
x-amzn-remapped-date: Wed, 24 Jul 2024 22:37:05 GMT
x-amz-cf-id: YrUomGlsInE-Wx2YdbIG5DVPZP-qKO0Vdc2Z41dgez5XRAN6omGACg==

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
48 KB 147ms
47ms Font
font/woff2 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://benefitsplus-auth-dev.hsbc.com.hk
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 23 Jul 2024 12:26:16 GMT
x-content-type-options: nosniff
age: 123048
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48236
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 23 Jul 2025 12:26:16 GMT

GET
H2 200 hsbc-favicon.ico
benefitsplus-auth-dev.hsbc.com.hk/static/assets/images/ 1 KB
4 KB 957ms
956ms Other
image/x-icon 2600:9000:266e:6000:a:9a74:f000:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://benefitsplus-auth-dev.hsbc.com.hk/static/assets/images/hsbc-favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266e:6000:a:9a74:f000:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

ea0664a949fba1e56da947f65ca0833ce4296e116c6f2f6d3d518f54e2bb7391

Security Headers

Name	Value
Content-Security-Policy	font-src .hsbc.com.hk fonts.gstatic.com maxcdn.bootstrapcdn.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com data: 'self' 'unsafe-inline'; form-action https: .hsbc.com.hk secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com www.paypal.com www.sandbox.paypal.com 'self' 'unsafe-inline'; frame-ancestors .hsbc.com.hk .stripe.com stripe.com 'self'; frame-src 'self' data: .hsbc.com.hk .my-doc.com lpcdn.lpsnmedia.net td.doubleclick.net fast.amc.demdex.net .adobe.com secure.authorize.net test.authorize.net bid.g.doubleclick.net .youtube.com .youtube-nocookie.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com https://www.google.com/recaptcha/ .weltpixel.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com 'self' 'unsafe-inline'; img-src blob: .google.com.hk .yahoo.com .hsbc.com.hk .tealiumiq.com .adsrvr.org maps.googleapis.com maps.gstatic.com assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net .adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net www.google.com bid.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com t.paypal.com .ftcdn.net .behance.net www.paypal.com fpdbs.paypal.com fpdbs.sandbox.paypal.com .vimeocdn.com i.ytimg.com .youtube.com validator.swagger.io flagpedia.net .gstatic.com data: 'self' 'unsafe-inline'; script-src .hsbc.com.hk unpkg.com connect.facebook.net s.yimg.com visitor-service-ap-northeast-1.tealiumiq.com lptag.liveperson.net datacloud.tealiumiq.com tags.tiqcdn.com assets.adobedtm.com .adobe.com secure.authorize.net test.authorize.net www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com js.braintreegateway.com www.paypal.com .newrelic.com .nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.sandbox.paypal.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com .vimeocdn.com .youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ .gstatic.com maps.googleapis.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com https://www.googletagmanager.com tagmanager.google.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .hsbc.com.hk fonts.googleapis.com .adobe.com maxcdn.bootstrapcdn.com .gstatic.com tagmanager.google.com 'self' 'unsafe-inline'; object-src .hsbc.com.hk 'self' 'unsafe-inline'; media-src .hsbc.com.hk .adobe.com 'self' 'unsafe-inline'; manifest-src .hsbc.com.hk 'self' 'unsafe-inline'; connect-src wss: .hsbc.com.hk www.issthk-dev.hsbc.com.hk:31000 .tealiumiq.com .tiqcdn.com pagead2.googlesyndication.com log-happyhktest.us.v2.customers.biocatch.com log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com .newrelic.com .nr-data.net vimeo.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com www.gstatic.com maps.googleapis.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com https://www.google-analytics.com 'self' 'unsafe-inline'; child-src http: https: .hsbc.com.hk blob: 'self' 'unsafe-inline'; default-src .hsbc.com.hk 'self' 'unsafe-inline' 'unsafe-eval' log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com; base-uri *.hsbc.com.hk 'self' 'unsafe-inline';
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://benefitsplus-auth-dev.hsbc.com.hk/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 22:37:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-correlation-id: c58d9251398c8dd42d163648c23253fa
content-security-policy: font-src *.hsbc.com.hk fonts.gstatic.com maxcdn.bootstrapcdn.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com data: 'self' 'unsafe-inline'; form-action https: *.hsbc.com.hk secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com www.paypal.com www.sandbox.paypal.com 'self' 'unsafe-inline'; frame-ancestors *.hsbc.com.hk *.stripe.com stripe.com 'self'; frame-src 'self' data: *.hsbc.com.hk *.my-doc.com lpcdn.lpsnmedia.net td.doubleclick.net fast.amc.demdex.net *.adobe.com secure.authorize.net test.authorize.net bid.g.doubleclick.net *.youtube.com *.youtube-nocookie.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com https://www.google.com/recaptcha/ *.weltpixel.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com 'self' 'unsafe-inline'; img-src blob: *.google.com.hk *.yahoo.com *.hsbc.com.hk *.tealiumiq.com *.adsrvr.org maps.googleapis.com maps.gstatic.com assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net *.adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net www.google.com bid.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com t.paypal.com *.ftcdn.net *.behance.net www.paypal.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com i.ytimg.com *.youtube.com validator.swagger.io flagpedia.net *.gstatic.com data: 'self' 'unsafe-inline'; script-src *.hsbc.com.hk unpkg.com connect.facebook.net s.yimg.com visitor-service-ap-northeast-1.tealiumiq.com lptag.liveperson.net datacloud.tealiumiq.com tags.tiqcdn.com assets.adobedtm.com *.adobe.com secure.authorize.net test.authorize.net www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com js.braintreegateway.com www.paypal.com *.newrelic.com *.nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.sandbox.paypal.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com *.vimeocdn.com *.youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ *.gstatic.com maps.googleapis.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com https://www.googletagmanager.com tagmanager.google.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.hsbc.com.hk fonts.googleapis.com *.adobe.com maxcdn.bootstrapcdn.com *.gstatic.com tagmanager.google.com 'self' 'unsafe-inline'; object-src *.hsbc.com.hk 'self' 'unsafe-inline'; media-src *.hsbc.com.hk *.adobe.com 'self' 'unsafe-inline'; manifest-src *.hsbc.com.hk 'self' 'unsafe-inline'; connect-src wss: *.hsbc.com.hk www.issthk-dev.hsbc.com.hk:31000 *.tealiumiq.com *.tiqcdn.com pagead2.googlesyndication.com log-happyhktest.us.v2.customers.biocatch.com log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net vimeo.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com www.gstatic.com maps.googleapis.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com https://www.google-analytics.com 'self' 'unsafe-inline'; child-src http: https: *.hsbc.com.hk blob: 'self' 'unsafe-inline'; default-src *.hsbc.com.hk 'self' 'unsafe-inline' 'unsafe-eval' log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com; base-uri *.hsbc.com.hk 'self' 'unsafe-inline';
via: 1.1 37236193bd380575cb98e661bedbb260.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P8
x-amzn-remapped-connection: keep-alive
x-amzn-requestid: 3b9ad564-b295-4d1b-8c76-7a6c2d82c076
x-dns-prefetch-control: off
x-cache: Miss from cloudfront
x-amz-apigw-id: bcFC2FN3nUYEnhA=
content-length: 216
x-xss-protection: 1; mode=block
last-modified: Fri, 14 Jun 2024 09:38:46 GMT
server: CloudFront
etag: W/"47e-190161d2070"
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/x-icon
access-control-allow-origin: domain
access-control-allow-methods: GET,HEAD
cache-control: public, max-age=0
access-control-max-age: 86
accept-ranges: bytes
x-amzn-remapped-date: Wed, 24 Jul 2024 22:37:05 GMT
x-amz-cf-id: hMnPv3w0EGK3sJk5No8tljcwM4feq9Yr-x_ThL8NvjmQHtdcubTW1A==

Verdicts & Comments Add Verdict or Comment

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://benefitsplus-auth-dev.hsbc.com.hk/ Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://benefitsplus-auth-dev.hsbc.com.hk/static/assets/tealium/undefined/utag_data.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://benefitsplus-auth-dev.hsbc.com.hk/static/assets/tealium/undefined/utag.js Message: Failed to load resource: the server responded with a status of 404 ()
security	error	URL: https://benefitsplus-auth-dev.hsbc.com.hk/ Message: Refused to execute script from 'https://benefitsplus-auth-dev.hsbc.com.hk/static/assets/tealium/undefined/utag_data.js' because its MIME type ('application/json') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://benefitsplus-auth-dev.hsbc.com.hk/ Message: Refused to execute script from 'https://benefitsplus-auth-dev.hsbc.com.hk/static/assets/tealium/undefined/utag.js' because its MIME type ('application/json') is not executable, and strict MIME type checking is enabled.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	font-src .hsbc.com.hk fonts.gstatic.com maxcdn.bootstrapcdn.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com data: 'self' 'unsafe-inline'; form-action https: .hsbc.com.hk secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com www.paypal.com www.sandbox.paypal.com 'self' 'unsafe-inline'; frame-ancestors .hsbc.com.hk .stripe.com stripe.com 'self'; frame-src 'self' data: .hsbc.com.hk .my-doc.com lpcdn.lpsnmedia.net td.doubleclick.net fast.amc.demdex.net .adobe.com secure.authorize.net test.authorize.net bid.g.doubleclick.net .youtube.com .youtube-nocookie.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com https://www.google.com/recaptcha/ .weltpixel.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com 'self' 'unsafe-inline'; img-src blob: .google.com.hk .yahoo.com .hsbc.com.hk .tealiumiq.com .adsrvr.org maps.googleapis.com maps.gstatic.com assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net .adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net www.google.com bid.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com t.paypal.com .ftcdn.net .behance.net www.paypal.com fpdbs.paypal.com fpdbs.sandbox.paypal.com .vimeocdn.com i.ytimg.com .youtube.com validator.swagger.io flagpedia.net .gstatic.com data: 'self' 'unsafe-inline'; script-src .hsbc.com.hk unpkg.com connect.facebook.net s.yimg.com visitor-service-ap-northeast-1.tealiumiq.com lptag.liveperson.net datacloud.tealiumiq.com tags.tiqcdn.com assets.adobedtm.com .adobe.com secure.authorize.net test.authorize.net www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com www.paypalobjects.com js.braintreegateway.com www.paypal.com .newrelic.com .nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.sandbox.paypal.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com .vimeocdn.com .youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ .gstatic.com maps.googleapis.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com https://www.googletagmanager.com tagmanager.google.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .hsbc.com.hk fonts.googleapis.com .adobe.com maxcdn.bootstrapcdn.com .gstatic.com tagmanager.google.com 'self' 'unsafe-inline'; object-src .hsbc.com.hk 'self' 'unsafe-inline'; media-src .hsbc.com.hk .adobe.com 'self' 'unsafe-inline'; manifest-src .hsbc.com.hk 'self' 'unsafe-inline'; connect-src wss: .hsbc.com.hk www.issthk-dev.hsbc.com.hk:31000 .tealiumiq.com .tiqcdn.com pagead2.googlesyndication.com log-happyhktest.us.v2.customers.biocatch.com log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com .newrelic.com .nr-data.net vimeo.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com www.gstatic.com maps.googleapis.com .stripe.com klarna.com .klarna.com .klarnacdn.net .klarnaevt.com https://www.google-analytics.com 'self' 'unsafe-inline'; child-src http: https: .hsbc.com.hk blob: 'self' 'unsafe-inline'; default-src .hsbc.com.hk 'self' 'unsafe-inline' 'unsafe-eval' log-69c80419.customers.biocatch.com wup-69c80419.customers.biocatch.com; base-uri *.hsbc.com.hk 'self' 'unsafe-inline';
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

benefitsplus-auth-dev.hsbc.com.hk
fonts.googleapis.com
fonts.gstatic.com
tags.tiqcdn.com
2600:9000:238d:6600:7:2bfb:7c00:93a1
2600:9000:266e:6000:a:9a74:f000:93a1
2a00:1450:4001:811::200a
2a00:1450:4001:81c::2003
0719b6941df6ae5ae85e23268b4bdf3ee804e27941de3cdd9655e73ac9cc5aa0
101ead936a2281d53dcc064b7e2a2ab0d53b92ef3ef7b34b668673007895c860
31fe46164ce2459191ca1f7727fd742ce01833ee4f705459e88d43f53fcc9f80
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
c42319ce7aea1c71d227a3f114dc79725b0362444c45901c3715d7c7511bf799
df1aa01147bd53253e9a533a03218928192542e21219be95d1e7fa928d2e7c2a
ea0664a949fba1e56da947f65ca0833ce4296e116c6f2f6d3d518f54e2bb7391
f63aa9cbf1ed197a7e8d6e192bedd57a3376bc1defa5fc2bcc84835eed6900c9

benefitsplus-auth-dev.hsbc.com.hk Open in urlscan Pro 2600:9000:266e:6000:a:9a74:f000:93a1 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

100 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

78 kBTransfer

101 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

19 JavaScript Global Variables

0 Cookies

5 Console Messages

Security Headers

Indicators

benefitsplus-auth-dev.hsbc.com.hk Open in urlscan Pro
2600:9000:266e:6000:a:9a74:f000:93a1 Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

78 kB
Transfer

101 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions