urlscan.io logo urlscan.io
SecurityTrails logo

www.security.online-banking.hsbc.com.cn Open in urlscan Pro
2600:140b:5000::172b:f953  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www2.m.services.online-banking.hsbc.com.cn/
Effective URL: https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
Submission: On March 16 via api from JP — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 39 HTTP transactions. The main IP is 2600:140b:5000::172b:f953, located in Tokyo, Japan and belongs to AKAMAI-ASN1, NL. The main domain is www.security.online-banking.hsbc.com.cn.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on June 9th 2022. Valid for: a year.
This is the only time www.security.online-banking.hsbc.com.cn was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 4 203.112.84.74 9221 (HSBC-HK-A...)
1 12 2600:140b:500... 20940 (AKAMAI-ASN1)
1 2404:6800:400... ()
1 2404:6800:400... ()
39 5
Domain Requested by
12 www.security.online-banking.hsbc.com.cn 1 redirects www.security.online-banking.hsbc.com.cn
4 www2.m.services.online-banking.hsbc.com.cn 1 redirects www2.m.services.online-banking.hsbc.com.cn
www.security.online-banking.hsbc.com.cn
1 www.gstatic.com www.recaptcha.net
1 www.recaptcha.net www.security.online-banking.hsbc.com.cn
39 4

This site contains no links.

Subject Issuer Validity Valid
www.security.online-banking.hsbc.com.cn
DigiCert SHA2 Extended Validation Server CA		 2022-06-23 -
2023-07-24		 a year crt.sh
misc.google.com
GTS CA 1C3		 2023-02-20 -
2023-05-15		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-02-20 -
2023-05-15		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
Frame ID: A9AB159B0C67A58CEC0AB806BC63764F
Requests: 39 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://www2.m.services.online-banking.hsbc.com.cn/ HTTP 301
    https://www2.m.services.online-banking.hsbc.com.cn/gpib/ Page URL
  2. https://www2.m.services.online-banking.hsbc.com.cn/gpib/group/gpib/cmn/layouts/default.html?uid=dashboard Page URL
  3. https://www.security.online-banking.hsbc.com.cn/gsa?idv_cmd=idv.SaaSSecurityCommand HTTP 302
    https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • adrum
Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

39
Requests

41 %
HTTPS

75 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

719 kB
Transfer

2403 kB
Size

17
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www2.m.services.online-banking.hsbc.com.cn/ HTTP 301
    https://www2.m.services.online-banking.hsbc.com.cn/gpib/ Page URL
  2. https://www2.m.services.online-banking.hsbc.com.cn/gpib/group/gpib/cmn/layouts/default.html?uid=dashboard Page URL
  3. https://www.security.online-banking.hsbc.com.cn/gsa?idv_cmd=idv.SaaSSecurityCommand HTTP 302
    https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://www2.m.services.online-banking.hsbc.com.cn/ HTTP 301
  • https://www2.m.services.online-banking.hsbc.com.cn/gpib/

39 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
www2.m.services.online-banking.hsbc.com.cn/gpib/
Redirect Chain
  • https://www2.m.services.online-banking.hsbc.com.cn/
  • https://www2.m.services.online-banking.hsbc.com.cn/gpib/
605 B
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www2.m.services.online-banking.hsbc.com.cn/gpib/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.112.84.74 Central, Hong Kong, ASN9221 (HSBC-HK-AS HSBC HongKong, HK),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains max-age=16070400; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
accept,accept-encoding,accept-language,authorization,content-type,origin,X-HDR-Synchronizer-Token,X-HDR-DoubleSubmit-Token
Access-Control-Allow-Methods
GET, POST, OPTIONS, DELETE, PUT
Connection
Keep-Alive
Content-Encoding
gzip
Content-Language
en-US
Content-Type
text/html
Date
Thu, 16 Mar 2023 16:37:49 GMT
Keep-Alive
timeout=5, max=500
Last-Modified
Tue, 01 Nov 2022 11:48:52 GMT
S
skm_370_02_gspgw
Strict-Transport-Security
max-age=31536000; includeSubDomains max-age=16070400; includeSubDomains
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-Frame-Options
DENY

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
accept,accept-encoding,accept-language,authorization,content-type,origin,X-HDR-Synchronizer-Token,X-HDR-DoubleSubmit-Token
Access-Control-Allow-Methods
GET, POST, OPTIONS, DELETE, PUT
Connection
Keep-Alive
Content-Length
264
Content-Type
text/html; charset=iso-8859-1
Date
Thu, 16 Mar 2023 16:37:48 GMT
Keep-Alive
timeout=5, max=500
Location
https://www2.m.services.online-banking.hsbc.com.cn/gpib/
Strict-Transport-Security
max-age=16070400; includeSubDomains
default.html
www2.m.services.online-banking.hsbc.com.cn/gpib/group/gpib/cmn/layouts/ 		4 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www2.m.services.online-banking.hsbc.com.cn/gpib/group/gpib/cmn/layouts/default.html?uid=dashboard
Requested by
Host: www2.m.services.online-banking.hsbc.com.cn
URL: https://www2.m.services.online-banking.hsbc.com.cn/gpib/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.112.84.74 Central, Hong Kong, ASN9221 (HSBC-HK-AS HSBC HongKong, HK),
Reverse DNS
Software
/
Resource Hash
2aa58c6468300539332e12ecec334a02512443a4ce47287735aa837194807dba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains max-age=16070400; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www2.m.services.online-banking.hsbc.com.cn/gpib/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
accept,accept-encoding,accept-language,authorization,content-type,origin,X-HDR-Synchronizer-Token,X-HDR-DoubleSubmit-Token
Access-Control-Allow-Methods
GET, POST, OPTIONS, DELETE, PUT
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Content-Encoding
gzip
Content-Language
en-US
Content-Type
text/html;charset=ISO-8859-1
Date
Thu, 16 Mar 2023 16:37:49 GMT
Expires
Wed, 31 Dec 1969 23:59:59 GMT
Keep-Alive
timeout=5, max=500
Pragma
no-cache
S
skm_370_02_gspgw
Strict-Transport-Security
max-age=31536000; includeSubDomains max-age=16070400; includeSubDomains
Surrogate-Control
no-store
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-Frame-Options
DENY
Primary Request /
www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
Redirect Chain
  • https://www.security.online-banking.hsbc.com.cn/gsa?idv_cmd=idv.SaaSSecurityCommand
  • https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
47 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:5000::172b:f953 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Apache /
Resource Hash
e2dd1f78666d2f9055868051bb1f6ef4c9d98bb337fb3e7392d8d5d4ef68c17a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains max-age=16070400; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://www2.m.services.online-banking.hsbc.com.cn
Referer
https://www2.m.services.online-banking.hsbc.com.cn/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
accept,accept-encoding,accept-language,authorization,content-type,origin,applicationname,channelid,countrycode,groupmember,locale,timezone
access-control-allow-methods
GET, POST, OPTIONS
cache-control
max-age=1,s-maxage=0, no-cache, no-store, must-revalidate, private post-check=0, pre-check=0
content-encoding
gzip
content-language
en-US
content-length
9104
content-type
text/html;charset=UTF-8
date
Thu, 16 Mar 2023 16:37:51 GMT
expires
Sat, 06 May 1995 12:00:00 GMT
pragma
no-cache
s
skm_375_02_saasip, cn01_saasgsp_ifc02_proxy_skm
server
Apache
strict-transport-security
max-age=31536000; includeSubDomains max-age=16070400; includeSubDomains
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
sameorigin
x-xss-protection
1; mode=block

Redirect headers

access-control-allow-credentials
true
access-control-allow-headers
accept,accept-encoding,accept-language,authorization,content-type,origin,applicationname,channelid,countrycode,groupmember,locale,timezone
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
https://www2.m.services.online-banking.hsbc.com.cn
cache-control
max-age=1,s-maxage=0, no-cache, no-store, must-revalidate, private post-check=0, pre-check=0
content-language
en-US
content-length
0
date
Thu, 16 Mar 2023 16:37:51 GMT
expires
Sat, 06 May 1995 12:00:00 GMT
location
https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
pragma
no-cache
s
skm_375_02_saasip, cn01_saasgsp_ifc01_proxy_skm
server
Apache
strict-transport-security
max-age=31536000; includeSubDomains max-age=16070400; includeSubDomains
x-content-type-options
nosniff
x-frame-options
sameorigin
x-xss-protection
1; mode=block
adrum.js
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/theme_public/js/ 		35 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/theme_public/js/adrum.js
Requested by
Host: www.security.online-banking.hsbc.com.cn
URL: https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:5000::172b:f953 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Apache /
Resource Hash
77fe0fdc363f4e45946f17911eac651a64d1eb1d88f326ce80125bc837f58e93
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
X-Frame-Options sameorigin

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
content-encoding
gzip
date
Thu, 16 Mar 2023 16:37:52 GMT
content-length
11566
last-modified
Sat, 05 Aug 2017 10:49:19 GMT
server
Apache
etag
"8cb1-555ff5d9aef1e"
x-frame-options
sameorigin
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/x-javascript
vary
Accept-Encoding
cache-control
max-age=604800
access-control-allow-credentials
true
accept-ranges
bytes
s
skm_375_02_saasip, cn01_saasgsp_ifc01_proxy_skm
access-control-allow-headers
accept,accept-encoding,accept-language,authorization,content-type,origin,applicationname,channelid,countrycode,groupmember,locale,timezone
expires
Thu, 23 Mar 2023 16:37:51 GMT
googleCaptcha_wrapper.js
www.security.online-banking.hsbc.com.cn/ContentService/gsp/saas/Components/htmls/ 		179 B
798 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.security.online-banking.hsbc.com.cn/ContentService/gsp/saas/Components/htmls/googleCaptcha_wrapper.js?ECAL=zh_CN&SAGG=gsp_hbcn
Requested by
Host: www.security.online-banking.hsbc.com.cn
URL: https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:5000::172b:f953 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Apache /
Resource Hash
3f126420fd031c27598d6150009a3e4d317498a3c98305467679ffc3a55924e9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
X-Frame-Options sameorigin

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
content-encoding
gzip
date
Thu, 16 Mar 2023 16:37:52 GMT
content-length
166
last-modified
Fri, 07 Dec 2018 16:42:49 GMT
server
Apache
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS, GET
content_resource_path
gsp_hbcn/saas/Components/htmls/zh_CN/googleCaptcha_wrapper.js
access-control-allow-origin
*
content-type
application/x-javascript
cache-control
max-age=604800
access-control-allow-credentials
true
content-language
en-US
x-frame-options
sameorigin
s
skm_375_02_saasip, cn01_saasgsp_ifc01_proxy_skm
access-control-allow-headers
accept,accept-encoding,accept-language,authorization,content-type,origin,applicationname,channelid,countrycode,groupmember,locale,timezone, x-requested-with
vary
Accept-Encoding
expires
Thu, 23 Mar 2023 16:37:52 GMT
ursula.css
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/themes/ursula/ 		209 KB
35 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/themes/ursula/ursula.css
Requested by
Host: www.security.online-banking.hsbc.com.cn
URL: https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:5000::172b:f953 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Apache /
Resource Hash
9edc672e6aa741e8070c60a94f6439d19ffa38010231890abddafb6bb4fef3dd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
X-Frame-Options sameorigin

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
content-encoding
gzip
date
Thu, 16 Mar 2023 16:37:52 GMT
content-length
35327
last-modified
Wed, 18 Nov 2020 01:23:02 GMT
server
Apache
etag
"342ac-5b45773d44980"
x-frame-options
sameorigin
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
vary
Accept-Encoding
cache-control
max-age=604800
access-control-allow-credentials
true
accept-ranges
bytes
s
skm_375_02_saasip, cn01_saasgsp_ifc02_proxy_skm
access-control-allow-headers
accept,accept-encoding,accept-language,authorization,content-type,origin,applicationname,channelid,countrycode,groupmember,locale,timezone
expires
Thu, 23 Mar 2023 16:37:52 GMT
lightbox.css
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/themes/ursula/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/themes/ursula/lightbox.css
Requested by
Host: www.security.online-banking.hsbc.com.cn
URL: https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:5000::172b:f953 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Apache /
Resource Hash
00c2e0475680a72840800a5ac4a42207ba587c60872e56e9c07bbce64f711f3a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
X-Frame-Options sameorigin

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
content-encoding
gzip
date
Thu, 16 Mar 2023 16:37:52 GMT
content-length
1542
last-modified
Wed, 18 Nov 2020 01:23:02 GMT
server
Apache
etag
"1865-5b45773d44980"
x-frame-options
sameorigin
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
vary
Accept-Encoding
cache-control
max-age=604800
access-control-allow-credentials
true
accept-ranges
bytes
s
skm_375_02_saasip, cn01_saasgsp_ifc02_proxy_skm
access-control-allow-headers
accept,accept-encoding,accept-language,authorization,content-type,origin,applicationname,channelid,countrycode,groupmember,locale,timezone
expires
Thu, 23 Mar 2023 16:37:52 GMT
app_logon.js
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/dtk/dojo/ 		2 MB
461 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/dtk/dojo/app_logon.js
Requested by
Host: www.security.online-banking.hsbc.com.cn
URL: https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:5000::172b:f953 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Apache /
Resource Hash
a40ac7100fce6e90b5feefb163ba4372725b190260e53582c7c36d31ed120ad3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
X-Frame-Options sameorigin

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
content-encoding
gzip
date
Thu, 16 Mar 2023 16:37:52 GMT
last-modified
Wed, 18 Nov 2020 01:22:58 GMT
server
Apache
etag
"195f74-5b45773974080"
x-frame-options
sameorigin
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/x-javascript
vary
Accept-Encoding
cache-control
max-age=604800
access-control-allow-credentials
true
accept-ranges
bytes
s
skm_375_02_saasip, cn01_saasgsp_ifc01_proxy_skm
access-control-allow-headers
accept,accept-encoding,accept-language,authorization,content-type,origin,applicationname,channelid,countrycode,groupmember,locale,timezone
expires
Thu, 23 Mar 2023 16:37:52 GMT
top_section.js
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/theme_public/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/theme_public/js/top_section.js
Requested by
Host: www.security.online-banking.hsbc.com.cn
URL: https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:5000::172b:f953 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Apache /
Resource Hash
186b7acb4a807db40b3000e00fe998edc61dbf6873dff71c6b9a854e039f9bb3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
X-Frame-Options sameorigin

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
content-encoding
gzip
date
Thu, 16 Mar 2023 16:37:52 GMT
content-length
1206
last-modified
Wed, 18 Nov 2020 01:22:58 GMT
server
Apache
etag
"bc5-5b45773974080"
x-frame-options
sameorigin
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/x-javascript
vary
Accept-Encoding
cache-control
max-age=604800
access-control-allow-credentials
true
accept-ranges
bytes
s
skm_375_02_saasip, cn01_saasgsp_ifc01_proxy_skm
access-control-allow-headers
accept,accept-encoding,accept-language,authorization,content-type,origin,applicationname,channelid,countrycode,groupmember,locale,timezone
expires
Thu, 23 Mar 2023 16:37:52 GMT
HSBCGLBL.js
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/theme_public/js/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/theme_public/js/HSBCGLBL.js
Requested by
Host: www.security.online-banking.hsbc.com.cn
URL: https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:5000::172b:f953 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Apache /
Resource Hash
25fb058df0799a3d943c74f54999c39ddc0e53f568d37d3bbf8b13b099869d4c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
X-Frame-Options sameorigin

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
content-encoding
gzip
date
Thu, 16 Mar 2023 16:37:52 GMT
content-length
3303
last-modified
Wed, 18 Nov 2020 01:22:58 GMT
server
Apache
etag
"221b-5b45773974080"
x-frame-options
sameorigin
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/x-javascript
vary
Accept-Encoding
cache-control
max-age=604800
access-control-allow-credentials
true
accept-ranges
bytes
s
skm_375_02_saasip, cn01_saasgsp_ifc02_proxy_skm
access-control-allow-headers
accept,accept-encoding,accept-language,authorization,content-type,origin,applicationname,channelid,countrycode,groupmember,locale,timezone
expires
Thu, 23 Mar 2023 16:37:52 GMT
hsbc-logo_SC.gif
www.security.online-banking.hsbc.com.cn/ContentService/gsp/saas/Components/default/doc/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.security.online-banking.hsbc.com.cn/ContentService/gsp/saas/Components/default/doc/hsbc-logo_SC.gif
Requested by
Host: www.security.online-banking.hsbc.com.cn
URL: https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:5000::172b:f953 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Apache /
Resource Hash
841097054b7f048753e299d12e8193b423e1838241203459552f1f0b1e334a34
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
X-Frame-Options sameorigin

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
date
Thu, 16 Mar 2023 16:37:53 GMT
content-length
3031
last-modified
Mon, 05 Dec 2016 07:48:42 GMT
server
Apache
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS, GET
content_resource_path
gsp/saas/Components/default/doc/hsbc-logo_SC.gif
access-control-allow-origin
*
content-type
image/gif
cache-control
max-age=2592000
access-control-allow-credentials
true
content-language
en-US
x-frame-options
sameorigin
s
skm_375_02_saasip, cn01_saasgsp_ifc01_proxy_skm
access-control-allow-headers
accept,accept-encoding,accept-language,authorization,content-type,origin,applicationname,channelid,countrycode,groupmember,locale,timezone, x-requested-with
expires
Sat, 15 Apr 2023 16:37:53 GMT
SecureKey_HardToken_v2_2.png
www.security.online-banking.hsbc.com.cn/ContentService/gsp/saas/Components/default/resources/images/content/hardToken_v2/ 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.security.online-banking.hsbc.com.cn/ContentService/gsp/saas/Components/default/resources/images/content/hardToken_v2/SecureKey_HardToken_v2_2.png
Requested by
Host: www.security.online-banking.hsbc.com.cn
URL: https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:5000::172b:f953 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Apache /
Resource Hash
eb2a77acd408043d7fa19a2d68bdada0d9e7b77c1e1f7a028f2cc6cf2f95ab43
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
X-Frame-Options sameorigin

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
date
Thu, 16 Mar 2023 16:37:53 GMT
content-length
12986
last-modified
Wed, 18 Nov 2020 01:22:58 GMT
server
Apache
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS, GET
content_resource_path
gsp/saas/Components/default/resources/images/content/hardToken_v2/SecureKey_HardToken_v2_2.png
access-control-allow-origin
*
content-type
image/png
cache-control
max-age=2592000
access-control-allow-credentials
true
content-language
en-US
x-frame-options
sameorigin
s
skm_375_02_saasip, cn01_saasgsp_ifc02_proxy_skm
access-control-allow-headers
accept,accept-encoding,accept-language,authorization,content-type,origin,applicationname,channelid,countrycode,groupmember,locale,timezone, x-requested-with
expires
Sat, 15 Apr 2023 16:37:53 GMT
secureKeyGenerate.png
www.security.online-banking.hsbc.com.cn/ContentService/gsp/saas/Components/default/resources/images/content/ 		0
0
security-device2.png
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/images/keylogin/ 		0
0
SecureKey_HardToken_v2_3.png
www.security.online-banking.hsbc.com.cn/ContentService/gsp/saas/Components/default/resources/images/content/hardToken_v2/ 		0
0
SecureKey_HardToken_v2_5.png
www.security.online-banking.hsbc.com.cn/ContentService/gsp/saas/Components/default/resources/images/content/hardToken_v2/ 		0
0
04Generate.png
www.security.online-banking.hsbc.com.cn/ContentService/gsp/saas/Components/default/resources/images/content/softToken/ 		0
0
05Key.png
www.security.online-banking.hsbc.com.cn/ContentService/gsp/saas/Components/default/resources/images/content/softToken/ 		0
0
security-device1.png
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/images/keylogin/ 		0
0
bottom_section_nd.js
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/theme_public/js/ 		306 B
739 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/theme_public/js/bottom_section_nd.js
Requested by
Host: www.security.online-banking.hsbc.com.cn
URL: https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:5000::172b:f953 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Apache /
Resource Hash
785e0ecf958235eff250309fb2b5f23e1f68d4ba91a4555240c10707b7beef2e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
X-Frame-Options sameorigin

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
content-encoding
gzip
date
Thu, 16 Mar 2023 16:37:53 GMT
content-length
235
last-modified
Wed, 18 Nov 2020 01:22:58 GMT
server
Apache
etag
"132-5b45773974080"
x-frame-options
sameorigin
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/x-javascript
vary
Accept-Encoding
cache-control
max-age=604800
access-control-allow-credentials
true
accept-ranges
bytes
s
skm_375_02_saasip, cn01_saasgsp_ifc02_proxy_skm
access-control-allow-headers
accept,accept-encoding,accept-language,authorization,content-type,origin,applicationname,channelid,countrycode,groupmember,locale,timezone
expires
Thu, 23 Mar 2023 16:37:53 GMT
api.js
www.recaptcha.net/recaptcha/ 		856 B
881 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.recaptcha.net/recaptcha/api.js?hl=zh-CN
Requested by
Host: www.security.online-banking.hsbc.com.cn
URL: https://www.security.online-banking.hsbc.com.cn/ContentService/gsp/saas/Components/htmls/googleCaptcha_wrapper.js?ECAL=zh_CN&SAGG=gsp_hbcn
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:823::2003 -, , ASN (),
Reverse DNS
Software
GSE /
Resource Hash
b5193561e05d23132a715b36610d5cdf10cae37f7b50bfc8971d95b13056b1c8
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.security.online-banking.hsbc.com.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Thu, 16 Mar 2023 16:37:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
559
x-xss-protection
1; mode=block
expires
Thu, 16 Mar 2023 16:37:53 GMT
print.css
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/themes/ursula/ 		0
0
main.js
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/app/ 		0
0
Utils.js
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/modules/logon/common/ 		0
0
nls.js
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/app/ 		0
0
ext.js
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/ 		0
0
Interstitial.js
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/modules/common/widget/ 		0
0
prefetch.js
www2.m.services.online-banking.hsbc.com.cn/ContentService/gsp/ChannelsLibrary/Components/client/cmn/prefetch/ 		37 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www2.m.services.online-banking.hsbc.com.cn/ContentService/gsp/ChannelsLibrary/Components/client/cmn/prefetch/prefetch.js?locale=zh_CN&1678984673717
Requested by
Host: www.security.online-banking.hsbc.com.cn
URL: https://www.security.online-banking.hsbc.com.cn/gsa/SECURITY_LOGON_PAGE/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.112.84.74 Central, Hong Kong, ASN9221 (HSBC-HK-AS HSBC HongKong, HK),
Reverse DNS
Software
/
Resource Hash
6312abc8ab168bc64ee0b604d883baa6d4097d1c0544fc6bafcfb00974809c23
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.security.online-banking.hsbc.com.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Thu, 16 Mar 2023 16:37:53 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Transfer-Encoding
chunked
Connection
Keep-Alive
Last-Modified
Wed, 22 Feb 2023 17:58:57 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, POST, OPTIONS, DELETE, PUT, GET
CONTENT_RESOURCE_PATH
gsp/ChannelsLibrary/Components/client/cmn/prefetch/prefetch.js
Access-Control-Allow-Origin
*
Content-Type
application/x-javascript
Vary
Accept-Encoding
Access-Control-Allow-Credentials
true
Content-Language
en-US
X-Frame-Options
DENY
S
skm_370_02_gspgw
Access-Control-Allow-Headers
accept,accept-encoding,accept-language,authorization,content-type,origin,X-HDR-Synchronizer-Token,X-HDR-DoubleSubmit-Token, x-requested-with
Keep-Alive
timeout=5, max=500
top.gif
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/themes/ursula/images/background/ 		0
0
background.jpg
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/images/background/ 		0
0
bg_gradient_red.gif
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/themes/ursula/images/masthead/ 		0
0
helpIcon.png
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/images/background/ 		0
0
icon-important.png
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/images/background/ 		0
0
forward.gif
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/themes/ursula/images/button/ 		0
0
icon-close.png
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/images/background/ 		0
0
UniversNextforHSBCW02-Bd.woff
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/themes/ursula/fonts/ 		0
0
UniversNextforHSBCW02-Rg.woff
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/themes/ursula/fonts/ 		0
0
UniversNextforHSBCW02-Lt.woff
www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/themes/ursula/fonts/ 		0
0
recaptcha__zh_cn.js
www.gstatic.com/recaptcha/releases/Trd6gj1dhC_fx0ma_AWHc1me/ 		412 KB
164 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/Trd6gj1dhC_fx0ma_AWHc1me/recaptcha__zh_cn.js
Requested by
Host: www.recaptcha.net
URL: https://www.recaptcha.net/recaptcha/api.js?hl=zh-CN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:81f::2003 -, , ASN (),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.security.online-banking.hsbc.com.cn/
Origin
https://www.security.online-banking.hsbc.com.cn
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 15 Mar 2023 13:46:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
96671
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
167036
x-xss-protection
0
last-modified
Mon, 13 Mar 2023 02:02:14 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 14 Mar 2024 13:46:42 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/ContentService/gsp/saas/Components/default/resources/images/content/secureKeyGenerate.png
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/images/keylogin/security-device2.png
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/ContentService/gsp/saas/Components/default/resources/images/content/hardToken_v2/SecureKey_HardToken_v2_3.png
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/ContentService/gsp/saas/Components/default/resources/images/content/hardToken_v2/SecureKey_HardToken_v2_5.png
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/ContentService/gsp/saas/Components/default/resources/images/content/softToken/04Generate.png
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/ContentService/gsp/saas/Components/default/resources/images/content/softToken/05Key.png
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/images/keylogin/security-device1.png
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/themes/ursula/print.css
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/app/main.js?1.0
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/modules/logon/common/Utils.js?1.0
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/app/nls.js?1.0
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/ext.js?1.0
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/modules/common/widget/Interstitial.js?1.0
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/themes/ursula/images/background/top.gif
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/images/background/background.jpg
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/themes/ursula/images/masthead/bg_gradient_red.gif
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/images/background/helpIcon.png
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/images/background/icon-important.png
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/themes/ursula/images/button/forward.gif
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/images/background/icon-close.png
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/themes/ursula/fonts/UniversNextforHSBCW02-Bd.woff
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/themes/ursula/fonts/UniversNextforHSBCW02-Rg.woff
Domain
www.security.online-banking.hsbc.com.cn
URL
https://www.security.online-banking.hsbc.com.cn/gsp/saas/Components/default/resources/script/libraries/hsbc/widget/themes/ursula/fonts/UniversNextforHSBCW02-Lt.woff

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| commonProp string| launchBackURL string| globalVP string| pageCAM string| pageCUN object| dojoConfig number| adrum-start-time object| ADRUM object| script

17 Cookies

Domain/Path Name / Value
www2.m.services.online-banking.hsbc.com.cn/gpib Name: CAMToken
Value: qp0GSqVmIvP2chN660yW/ghby64=
www2.m.services.online-banking.hsbc.com.cn/gpib Name: TS01d405be
Value: 018de30b9a5a4cf3e0c087b27b260bf722cddf838d66ed7cb5bbc7a5671ab2bdaec18b3e9832ef547a93c0764182e7a4d1af654590
www.security.online-banking.hsbc.com.cn/gsa Name: CAMToken
Value: zEbogDOeip4unphZiTgY7tNgsx8=
.security.online-banking.hsbc.com.cn/gsa Name: SAASICIPCookie
Value: cmoCxWJ1vFOHr03rUJqkS/+3kXS7jduHsHSTeL/mY/UBjkCX71c+5JzN7cN9McMiTiIsFKngfCMUNibmeQSvPP7z/KApl4Wa9AJm83bOdva0B1xYpYSUP3Hf8hv/yHw1oJ93CJ0CWl5u2at6Dkhgy6Ty6TuP9LPbcFcU8qOGauM=
www.security.online-banking.hsbc.com.cn/gsa Name: TS01a68af5
Value: 018de30b9a857b7d92834651350c3843e9141f6a4a2cc888cca73d987f1799e233ae56fe4746690d748e85734b847477610b0c6cd7
.security.online-banking.hsbc.com.cn/gsa Name: TS01a64cfe
Value: 018de30b9a857b7d92834651350c3843e9141f6a4a2cc888cca73d987f1799e233ae56fe4746690d748e85734b847477610b0c6cd7
www2.m.services.online-banking.hsbc.com.cn/ Name: GSP2-PRD-MOBILE-WWW
Value: !Crt8GU8xhi7uHijMeF0cQdf86OMezGyehx2eX5TlxpDjdWQwZlNqWHUS8OMcjA+BFxPOPBArzY4VJBw=
www2.m.services.online-banking.hsbc.com.cn/ Name: TS019e0bf9
Value: 018de30b9a5a4cf3e0c087b27b260bf722cddf838d66ed7cb5bbc7a5671ab2bdaec18b3e9832ef547a93c0764182e7a4d1af654590
www2.m.services.online-banking.hsbc.com.cn/ Name: SameSite
Value: None
www2.m.services.online-banking.hsbc.com.cn/ Name: JSESSIONID
Value: 0000LjNnAU10Ys_krQbARW8R_Q8:1ceb9pbqt
www2.m.services.online-banking.hsbc.com.cn/ Name: ADRUM_BTa
Value: R:56|g:63abd769-6508-43b2-8b6e-0eae6c89e9c5|n:hostap_098c552b-7264-4d55-8e21-32d54b9dac18
www.security.online-banking.hsbc.com.cn/ Name: SameSite
Value: None
www.security.online-banking.hsbc.com.cn/ Name: JSESSIONID
Value: 0000dnznqvNbHGtRZ7rl86jFF4S:1ceaiv1l6
www.security.online-banking.hsbc.com.cn/ Name: SAAS2-PRD-DESK-WWW
Value: !Sf1E8X+J1U1NUG/MeF0cQdf86OMezHOl0NitQXY/WrnCGHDiDrM8UeWSGR+5rPzMUDat3kQDF+WlDg==
www.security.online-banking.hsbc.com.cn/ Name: TS019e0bf9
Value: 018de30b9a857b7d92834651350c3843e9141f6a4a2cc888cca73d987f1799e233ae56fe4746690d748e85734b847477610b0c6cd7
www.security.online-banking.hsbc.com.cn/ Name: ADRUM_BTa
Value: R:51|g:14ab8a5d-c5e4-43c4-a9ec-e223eb75f2d0|n:hostap_098c552b-7264-4d55-8e21-32d54b9dac18
www.security.online-banking.hsbc.com.cn/ Name: ADRUM_BT1
Value: R:51|i:633|e:9

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains max-age=16070400; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY