urlscan.io logo urlscan.io
SecurityTrails logo

payme-cashout-secure.hsbc.com.hk Open in urlscan Pro
20.239.125.58  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://payme-cashout-secure.hsbc.com.hk/static/hsbcpaymepay_deeplink.html?url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
Effective URL: https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
Submission: On January 22 via manual from SG — Scanned from SG
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 3 domains to perform 54 HTTP transactions. The main IP is 20.239.125.58, located in Hong Kong, Hong Kong and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is payme-cashout-secure.hsbc.com.hk.
TLS certificate: Issued by DigiCert EV RSA CA G2 on June 25th 2023. Valid for: a year.
This is the only time payme-cashout-secure.hsbc.com.hk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
48 20.239.125.58 8075 (MICROSOFT...)
3 2600:9000:229... 16509 (AMAZON-02)
1 104.69.37.107 16625 (AKAMAI-AS)
1 43.198.147.188 16509 (AMAZON-02)
54 5
48    20.239.125.58 (Hong Kong, Hong Kong)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
payme-cashout-secure.hsbc.com.hk
payme-api-secure.hsbc.com.hk
3    2600:9000:229f:8200:7:2bfb:7c00:93a1 (United States)

ASN16509 (AMAZON-02, US)
tags.tiqcdn.com
1    104.69.37.107 (Singapore, Singapore)

ASN16625 (AKAMAI-AS, US)
PTR: a104-69-37-107.deploy.static.akamaitechnologies.com
akamai.tiqcdn.com
1    43.198.147.188 (Hong Kong)

ASN16509 (AMAZON-02, US)
PTR: ec2-43-198-147-188.ap-east-1.compute.amazonaws.com
collect-ap-east-1.tealiumiq.com
Apex Domain
Subdomains		 Transfer
48 hsbc.com.hk
payme-cashout-secure.hsbc.com.hk
secure.payme.hsbc.com.hk Failed
payme-api-secure.hsbc.com.hk — Cisco Umbrella Rank: 261025
998 KB
4 tiqcdn.com
tags.tiqcdn.com — Cisco Umbrella Rank: 1194
akamai.tiqcdn.com — Cisco Umbrella Rank: 10586
28 KB
1 tealiumiq.com
collect-ap-east-1.tealiumiq.com — Cisco Umbrella Rank: 130931
790 B
54 3
Domain Requested by
40 payme-cashout-secure.hsbc.com.hk payme-cashout-secure.hsbc.com.hk
8 payme-api-secure.hsbc.com.hk payme-cashout-secure.hsbc.com.hk
3 tags.tiqcdn.com payme-cashout-secure.hsbc.com.hk
tags.tiqcdn.com
1 collect-ap-east-1.tealiumiq.com tags.tiqcdn.com
1 akamai.tiqcdn.com tags.tiqcdn.com
0 secure.payme.hsbc.com.hk Failed payme-cashout-secure.hsbc.com.hk
54 6

This site contains links to these domains. Also see Links.

Domain
payme.hsbc.com.hk
qr.payme.hsbc.com.hk
Subject Issuer Validity Valid
payme-cashout-secure.hsbc.com.hk
DigiCert EV RSA CA G2		 2023-06-25 -
2024-07-25		 a year crt.sh
payme-api-secure.hsbc.com.hk
DigiCert EV RSA CA G2		 2023-07-24 -
2024-07-25		 a year crt.sh
tags.tiqcdn.com
Amazon RSA 2048 M01		 2023-04-18 -
2024-05-17		 a year crt.sh
*.tiqcdn.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-11-16 -
2024-11-16		 a year crt.sh
*.tealiumiq.com
Amazon RSA 2048 M02		 2023-03-07 -
2024-04-04		 a year crt.sh

This page contains 1 frames:

Primary Page: https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
Frame ID: DC20FB11692D156B49465727F3E83787
Requests: 51 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://payme-cashout-secure.hsbc.com.hk/static/hsbcpaymepay_deeplink.html?url=https://qr.payme.hsbc.com.hk/2/HNYUXoG... Page URL
  2. https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • mustache(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • require.*\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

54
Requests

98 %
HTTPS

25 %
IPv6

3
Domains

6
Subdomains

5
IPs

3
Countries

1026 kB
Transfer

1047 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://payme-cashout-secure.hsbc.com.hk/static/hsbcpaymepay_deeplink.html?url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT Page URL
  2. https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

54 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
hsbcpaymepay_deeplink.html
payme-cashout-secure.hsbc.com.hk/static/ 		1 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/static/hsbcpaymepay_deeplink.html?url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
0cfd20e2ebde98c495f9517eacfa3ace28e90675bbf2e3394c583dc0fc3d72c8
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
zh-SG,zh;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3600
Connection
keep-alive
Content-Length
1191
Content-Security-Policy
frame-ancestors 'self'
Content-Type
text/html
Date
Mon, 22 Jan 2024 08:39:50 GMT
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
X-Frame-Options
SAMEORIGIN
HNYUXoG66pjTYgAt3qnkFT
secure.payme.hsbc.com.hk/2/ 		0
0
Primary Request merchantPayCode.html
payme-cashout-secure.hsbc.com.hk/ 		839 B
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/static/hsbcpaymepay_deeplink.html?url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
4d77073fa8bea1e5cf143fdc6583b444fe22326cdc73478b1cba18cb8199169c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://payme-cashout-secure.hsbc.com.hk/static/hsbcpaymepay_deeplink.html?url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
zh-SG,zh;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3600
Connection
keep-alive
Content-Length
839
Content-Security-Policy
frame-ancestors 'self'
Content-Type
text/html
Date
Mon, 22 Jan 2024 08:39:51 GMT
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
X-Frame-Options
SAMEORIGIN
bootstrap.min.css
payme-cashout-secure.hsbc.com.hk/styles/paycode/ 		169 KB
170 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/paycode/bootstrap.min.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
bbea9e94fcedb233be4bbc01915b68ea1def61241c4ff14b87faff7d970ac630
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:51 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
173032
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
font.css
payme-cashout-secure.hsbc.com.hk/styles/paycode/ 		5 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/paycode/font.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5a344279b10bfd998326c1fe3a988696891ec80296b7ed3f5e3fdba85904d5af
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:51 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
5247
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
grid-layout.css
payme-cashout-secure.hsbc.com.hk/styles/paycode/ 		3 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/paycode/grid-layout.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2dd843dd3b720fa0684171e6975014361496be13ab78d6dd9e18969fd0273cca
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:51 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
2779
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
main.css
payme-cashout-secure.hsbc.com.hk/styles/paycode/ 		2 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/paycode/main.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
fcf6f9b0b968fce4ebba4e9fa73132329dbd711278fdbc83bce442176ae16372
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:51 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
1970
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
header.css
payme-cashout-secure.hsbc.com.hk/styles/paycode/ 		2 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/paycode/header.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
4ad3f3d85f52f27c63f0d03dcf1a3e1811bb88a81d7c2bcf41452e0dc8c67785
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:51 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
2113
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
footer.css
payme-cashout-secure.hsbc.com.hk/styles/paycode/ 		2 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/paycode/footer.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2f0b13819df2da3fcff98f4433d5228b07cafc40648bcff4d0012f5d4d92cd5b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:51 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
2321
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
require.js
payme-cashout-secure.hsbc.com.hk/lib/ 		17 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
490a0312f02c4ee37289bb12389c413b72546eeed840327ef1df7578d1475b80
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:51 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
17888
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
config.js
payme-cashout-secure.hsbc.com.hk/scripts/ 		2 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/scripts/config.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e66f4a5cba530862c217e73a97deb7b5c2d2eeab798a356c457917e7c90649d1
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
2433
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
main.js
payme-cashout-secure.hsbc.com.hk/scripts/ 		3 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/scripts/main.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
8393a4568f5e63aa9e4c9a4e25c2d6defcd0ea2c2cac531a1d0fca9ca258ed04
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
3547
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
jquery.js
payme-cashout-secure.hsbc.com.hk/lib/ 		86 KB
86 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/lib/jquery.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
a5f2019acdfd65999fafe7522e287ded46d19394cc022a8e92892171129162a8
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
87665
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
i18n.js
payme-cashout-secure.hsbc.com.hk/lib/ 		1 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/lib/i18n.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
53325598963e3497ac831a647bb9807beebb3a3463e9850295fa3b69dbdab780
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
1415
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
language.js
payme-cashout-secure.hsbc.com.hk/nls/ 		28 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/nls/language.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
71ab9203fb14407f0378c062ca5f04734fb6c0dd3861c683dcbe4f36d70f8929
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
28409
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
tNc.js
payme-cashout-secure.hsbc.com.hk/nls/ 		117 KB
118 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/nls/tNc.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
175ff68a062db502f844dffecd1e669918dca1cfbe9ba2574307219da4fe21a7
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
120218
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
mustache.js
payme-cashout-secure.hsbc.com.hk/lib/ 		6 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/lib/mustache.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
ba655e27ca021317588bf453731fcf1b40105a0d013e951093054191b825695a
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
5840
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
navBar.js
payme-cashout-secure.hsbc.com.hk/scripts/ 		2 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/scripts/navBar.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
dc29bc886f4dfc6389d1c81a6fd593d0255feff7ee6a247f8bc546853242b411
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
2120
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
methods.js
payme-cashout-secure.hsbc.com.hk/scripts/ 		11 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/scripts/methods.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
82939cf2672bde3c20c373944624fadb9f5d0b4c13f4ebfb05b6b6fb48653f30
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
11263
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
envConfig.js
payme-cashout-secure.hsbc.com.hk/configs/ 		2 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/configs/envConfig.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
c5c4c65a9d05b2ac83f17a1d9a1d030006c78c3c458c7d39eea16073fc18015f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
1973
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
routing.js
payme-cashout-secure.hsbc.com.hk/scripts/ 		13 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/scripts/routing.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5d28f43a3baf73e6c5f7b3511ca41d17d1afc81c014d0235ebfa2dc6efbbcd60
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
12873
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
httpService.js
payme-cashout-secure.hsbc.com.hk/scripts/ 		3 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/scripts/httpService.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
924bf0481ab7e05dcfbb227d0d1e0edbe060e65a4744e8e41e2c664d3d1ac14f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
3385
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
footer.js
payme-cashout-secure.hsbc.com.hk/scripts/ 		583 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/scripts/footer.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
375839968ad8e9caa2cc368a4316e1a095860a876c538340fd101801f9f61077
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
583
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
aesjs.js
payme-cashout-secure.hsbc.com.hk/lib/ 		42 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/lib/aesjs.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
6ad6978d586287c9c51a6c781de1b219ff38a1e739db411969c85c6a5127d1fe
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43053
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
jsencrypt.js
payme-cashout-secure.hsbc.com.hk/lib/ 		52 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/lib/jsencrypt.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
9a055faba3835623d37e302b967a1f69c40a464211705d85fe182f43ad36f59d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
53203
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
text.js
payme-cashout-secure.hsbc.com.hk/lib/ 		4 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/lib/text.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
011fc91c68dc8c313e0a54e04876938adf2c51a72626391eb6873fdab318f35c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
4553
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
jquery.history.js
payme-cashout-secure.hsbc.com.hk/lib/ 		23 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/lib/jquery.history.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
ad6f533d9700ea1340b9518421e181b2b9f4c6c9c736294d31e163bcb756adac
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
23252
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
loader.html
payme-cashout-secure.hsbc.com.hk/template/ 		200 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/template/loader.html
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/text.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
ef48854e73093d9f3712b99e48f50b0c71cd7202ce14746733eccfacd2171113
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
200
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/html
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
navBar.html
payme-cashout-secure.hsbc.com.hk/template/ 		3 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/template/navBar.html
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/text.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
ffbb2c09163430eddb7565e82ef6e9cc3efaabc6ab6e3257ec2c4c709d13dde3
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
2608
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/html
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
footer.html
payme-cashout-secure.hsbc.com.hk/template/ 		833 B
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/template/footer.html
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/text.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5c4a8a122c04132003ae1a06a91617ded6eda5b1b09f9889745b6ce70a63d7d4
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/merchantPayCode.html?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
833
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/html
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
publicKey
payme-api-secure.hsbc.com.hk/hsbcpayme_api/ 		408 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://payme-api-secure.hsbc.com.hk/hsbcpayme_api/publicKey?deviceId=web&deviceType=3&lang=undefined&_=1705912792239
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/jquery.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5eb0985ac3f69ea945f3d238b998160037ea4338069f96426c0677c8df6c7029
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Accept
*/*
Referer
https://payme-cashout-secure.hsbc.com.hk/
accept-language
zh-SG,zh;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Access-Control-Max-Age
3600
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Origin
*
Content-Type
application/json
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Connection
keep-alive
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
key
payme-api-secure.hsbc.com.hk/hsbcpayme_api/session/ 		334 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://payme-api-secure.hsbc.com.hk/hsbcpayme_api/session/key
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/jquery.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
7920bedb15c1bda01a407c1dc9223b506f51bafb51957951d15ca2c6201258d7
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Accept
*/*
Referer
https://payme-cashout-secure.hsbc.com.hk/
accept-language
zh-SG,zh;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryYCXNNXzLu8sK9Rvr

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Access-Control-Max-Age
3600
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Origin
*
SESSIONID
29347619CB35BAD07D99126206B74FFCD4302E08DABE482D359C4E7DC865E146
Content-Type
application/json
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Connection
keep-alive
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
merchantPayCode.js
payme-cashout-secure.hsbc.com.hk/scripts/ 		5 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/scripts/merchantPayCode.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3a571fa710bed201218ae05921952cd8b45ff29f982d0061c527653a5efa199
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
5145
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
utag.js
tags.tiqcdn.com/utag/hsbc/hk-rbwm-mobile-p2p/prod/ 		49 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/hsbc/hk-rbwm-mobile-p2p/prod/utag.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:229f:8200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
45937b558c26b8ece9ab175bf24cbdd6fcbda0af83f4f7c5d9f03a1b8f46ae3b

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-amz-version-id
MRj34yGfNhFV3iHnw2jSTBs.0y0HPxBZ
content-encoding
br
via
1.1 0f7e4995783c21b04a0e0537b8737dde.cloudfront.net (CloudFront)
date
Mon, 22 Jan 2024 08:38:17 GMT
last-modified
Wed, 08 Mar 2023 13:22:02 GMT
server
AmazonS3
x-amz-cf-pop
SIN2-P1
age
96
x-amz-server-side-encryption
AES256
etag
W/"288ea13149950b3e26940f3102c97eed"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=300
x-amz-cf-id
ZhST3JVCj36uXFWvBaekywd04bfccap0Yjbvl0Hv3VxBR7I6nv3I0w==
location.js
akamai.tiqcdn.com/location/ 		18 B
562 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://akamai.tiqcdn.com/location/location.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/hsbc/hk-rbwm-mobile-p2p/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.69.37.107 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-69-37-107.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
d753f8ee126736431a1cd8170dbfcf94f553eeb1d24f2baa7c66474a80d0e559

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Last-Modified
Mon, 30 Apr 2018 23:09:19 GMT
Server
AkamaiNetStorage
ETag
"6c98be5fda77913799e8ef24b86a7abd:1525129759"
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-EdgeScape-Location
Cache-Control
max-age=1296000
X-EdgeScape-Location
country_code=SG,region_code=0,city=SINGAPORE,areacode=0,zip=0,bandwidth=5000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
18
Expires
Tue, 06 Feb 2024 08:39:52 GMT
utag.637.js
tags.tiqcdn.com/utag/hsbc/hk-rbwm-mobile-p2p/prod/ 		47 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/hsbc/hk-rbwm-mobile-p2p/prod/utag.637.js?utv=ut4.47.202205131616
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/hsbc/hk-rbwm-mobile-p2p/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:229f:8200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
aefefff77e7c321ed5f8847e30ec8cd7b65f2e7e42fdf7844758901731e91045

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-amz-version-id
aQzMrjQ7Mar1Mo0nhbhSTwHgVjK34skP
content-encoding
br
via
1.1 0f7e4995783c21b04a0e0537b8737dde.cloudfront.net (CloudFront)
date
Mon, 22 Jan 2024 08:36:42 GMT
last-modified
Wed, 08 Mar 2023 13:22:02 GMT
server
AmazonS3
x-amz-cf-pop
SIN2-P1
age
191
x-amz-server-side-encryption
AES256
etag
W/"509cc929217c53d915f44ffd13ecf861"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
QameeOu40r3I0BW9DmK_dI4-i3-zc40UiiRcJD9qvlWEyRBYBP_yKQ==
merchantPayCode.html
payme-cashout-secure.hsbc.com.hk/template/ 		3 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/template/merchantPayCode.html
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/text.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
3626e33f34a62f115128c038cd4aa7d3c63105b9472e94c40ce4fca15852df80
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
2722
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/html
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
qr-code-styling.js
payme-cashout-secure.hsbc.com.hk/lib/ 		30 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/lib/qr-code-styling.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
03790ba4c9f71981a4a202e4ee3ad0b42ce0edf6b5de031cfe95234168c9110c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
31193
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
i.gif
collect-ap-east-1.tealiumiq.com/hsbc/wpb-stream-global-mobile/2/ 		43 B
790 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://collect-ap-east-1.tealiumiq.com/hsbc/wpb-stream-global-mobile/2/i.gif
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/hsbc/hk-rbwm-mobile-p2p/prod/utag.637.js?utv=ut4.47.202205131616
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
43.198.147.188 , Hong Kong, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-43-198-147-188.ap-east-1.compute.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer
https://payme-cashout-secure.hsbc.com.hk/
accept-language
zh-SG,zh;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryQq1eAq1qUwIdW2YK

Response headers

date
Mon, 22 Jan 2024 08:39:53 GMT
x-serverid
uconnect_i-0ac8925e9ffe2e9c2
x-tid
018d3053774600c7439d3abd70b803074007806c00b08
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-acc
hsbc:wpb-stream-global-mobile:2:datacloud
x-region
ap-east-1
content-length
43
pragma
no-cache
x-did
018d3053774600c7439d3abd70b803074007806c00b08
vary
Origin
content-type
image/gif
access-control-allow-origin
https://payme-cashout-secure.hsbc.com.hk
x-ulver
561372926e4c5bbf82a4ddd57ec35ee6f95c163c-SNAPSHOT
access-control-expose-headers
X-Region
cache-control
no-transform,private,no-cache,no-store,max-age=0,s-maxage=0
access-control-allow-credentials
true
x-uuid
30aecf67-bda8-4ca2-9d05-986352eaed34
expires
Mon, 22 Jan 2024 08:39:53 GMT
utag.v.js
tags.tiqcdn.com/utag/tiqapp/ 		2 B
431 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=hsbc/hk-rbwm-mobile-p2p/202205131616&cb=1705912792937
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/hsbc/hk-rbwm-mobile-p2p/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:229f:8200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-amz-version-id
2XUX04X5QEw0.xFya64khU._sHTRl_Pz
date
Mon, 22 Jan 2024 08:37:57 GMT
via
1.1 0f7e4995783c21b04a0e0537b8737dde.cloudfront.net (CloudFront)
x-amz-cf-pop
SIN2-P1
age
115
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
2
last-modified
Sat, 11 Mar 2023 06:57:46 GMT
server
AmazonS3
etag
"7bc0ee636b3b83484fc3b9348863bd22"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=300
accept-ranges
bytes
x-amz-cf-id
9z6Z4vPdzBZxpD0RhKxfqbefJGTWJYiM9Gpm9WEgWB4T6vMKfvIdGQ==
popper.js
payme-cashout-secure.hsbc.com.hk/lib/ 		21 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/lib/popper.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
ad5ec000b329dd9cac0aeee167ddff5fcf398c94d4ff21ab6fd2cc0ef74ddedc
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:52 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
21550
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
bootstrap.min.js
payme-cashout-secure.hsbc.com.hk/lib/ 		57 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/lib/bootstrap.min.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
b315503f1f5d6f8c62896324a5b81aef724502f7f1642bf01d64ead233e01480
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:53 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
58509
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
configs
payme-api-secure.hsbc.com.hk/hsbcpayme_api/ 		8 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://payme-api-secure.hsbc.com.hk/hsbcpayme_api/configs?encData=2351925933b21801e4db3e56f29212c6a78923b390ec8713d9ba30e216ed4e52ae66b95a0ebd25ae79877b7426d346d7d207e997904ed7607df39791a8928de8f4ae3ba68d6bfc8c50854804522032cc3f7ffd8db1b2240640e616fab04bf8eb2f26dc9e3561a19feeba3f2bd1ecf75c54fb58befaa3b8ca31d1b115c576c219e1b8c04dc37e8935b4df1024fa9cc34b07ebd0e8e4377977498b0710795ff585&_=1705912792240
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/jquery.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
d1338b9cb5ff59a60bf073f1c09e5d0bdbab1dab00427e50c702098cdc632f1d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Accept
application/vnd.hsbcpayme.app-2.9.99+json
SESSIONID
29347619CB35BAD07D99126206B74FFCD4302E08DABE482D359C4E7DC865E146
Referer
https://payme-cashout-secure.hsbc.com.hk/
accept-language
zh-SG,zh;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:53 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Access-Control-Max-Age
3600
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Origin
*
Content-Type
application/vnd.hsbcpayme.app-2.9.99+json
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Connection
keep-alive
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
configs
payme-api-secure.hsbc.com.hk/hsbcpayme_api/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://payme-api-secure.hsbc.com.hk/hsbcpayme_api/configs?encData=2351925933b21801e4db3e56f29212c6a78923b390ec8713d9ba30e216ed4e52ae66b95a0ebd25ae79877b7426d346d7d207e997904ed7607df39791a8928de8f4ae3ba68d6bfc8c50854804522032cc3f7ffd8db1b2240640e616fab04bf8eb2f26dc9e3561a19feeba3f2bd1ecf75c54fb58befaa3b8ca31d1b115c576c219e1b8c04dc37e8935b4df1024fa9cc34b07ebd0e8e4377977498b0710795ff585&_=1705912792240
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Accept
*/*
Access-Control-Request-Headers
sessionid
Access-Control-Request-Method
GET
Origin
https://payme-cashout-secure.hsbc.com.hk
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3600
Connection
keep-alive
Content-Length
0
Content-Security-Policy
frame-ancestors 'self'
Date
Mon, 22 Jan 2024 08:39:53 GMT
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Frame-Options
SAMEORIGIN
UniversNextforHSBC-Regular.otf
payme-cashout-secure.hsbc.com.hk/fonts/UniversNextforHSBC/ 		93 KB
95 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/fonts/UniversNextforHSBC/UniversNextforHSBC-Regular.otf
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/styles/paycode/font.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e54c92cd99e4d5d6c2453fca42a9fc2348891427924160a39c2288693aa392b0
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://payme-cashout-secure.hsbc.com.hk/styles/paycode/font.css
Origin
https://payme-cashout-secure.hsbc.com.hk
accept-language
zh-SG,zh;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:53 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
95112
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/x-font-opentype
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
UniversNextforHSBC-Bold.otf
payme-cashout-secure.hsbc.com.hk/fonts/UniversNextforHSBC/ 		97 KB
98 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/fonts/UniversNextforHSBC/UniversNextforHSBC-Bold.otf
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/styles/paycode/font.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
0db6b7651db0f1cfdcdcd01040702f3b7633cb3e2e498cf89ddd81d11ac5ee28
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://payme-cashout-secure.hsbc.com.hk/styles/paycode/font.css
Origin
https://payme-cashout-secure.hsbc.com.hk
accept-language
zh-SG,zh;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:53 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
98856
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/x-font-opentype
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
configs
payme-api-secure.hsbc.com.hk/hsbcpayme_api/ 		8 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://payme-api-secure.hsbc.com.hk/hsbcpayme_api/configs?encData=2351925933b21801e4db3e56f29212c6a78923b390ec8713d9ba30e216ed4e52ae66b95a0ebd25ae79877b7426d346d7d207e997904ed7607df39791a8928de8f4ae3ba68d6bfc8c50854804522032cc3f7ffd8db1b2240640e616fab04bf8eb55c7c190def63f6982b663c89649d9c713e215e1d39923339b81eb55e1aa9db5c430a4772e00052ee14b9c2988aec549937661ba8aa152bd29a799273c84b849&_=1705912792241
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/jquery.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
d1338b9cb5ff59a60bf073f1c09e5d0bdbab1dab00427e50c702098cdc632f1d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Accept
application/vnd.hsbcpayme.app-2.9.99+json
SESSIONID
29347619CB35BAD07D99126206B74FFCD4302E08DABE482D359C4E7DC865E146
Referer
https://payme-cashout-secure.hsbc.com.hk/
accept-language
zh-SG,zh;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:53 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Access-Control-Max-Age
3600
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Origin
*
Content-Type
application/vnd.hsbcpayme.app-2.9.99+json
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Connection
keep-alive
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
configs
payme-api-secure.hsbc.com.hk/hsbcpayme_api/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://payme-api-secure.hsbc.com.hk/hsbcpayme_api/configs?encData=2351925933b21801e4db3e56f29212c6a78923b390ec8713d9ba30e216ed4e52ae66b95a0ebd25ae79877b7426d346d7d207e997904ed7607df39791a8928de8f4ae3ba68d6bfc8c50854804522032cc3f7ffd8db1b2240640e616fab04bf8eb55c7c190def63f6982b663c89649d9c713e215e1d39923339b81eb55e1aa9db5c430a4772e00052ee14b9c2988aec549937661ba8aa152bd29a799273c84b849&_=1705912792241
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Accept
*/*
Access-Control-Request-Headers
sessionid
Access-Control-Request-Method
GET
Origin
https://payme-cashout-secure.hsbc.com.hk
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3600
Connection
keep-alive
Content-Length
0
Content-Security-Policy
frame-ancestors 'self'
Date
Mon, 22 Jan 2024 08:39:53 GMT
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Frame-Options
SAMEORIGIN
configs
payme-api-secure.hsbc.com.hk/hsbcpayme_api/ 		8 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://payme-api-secure.hsbc.com.hk/hsbcpayme_api/configs?encData=2351925933b21801e4db3e56f29212c6a78923b390ec8713d9ba30e216ed4e52ae66b95a0ebd25ae79877b7426d346d7d207e997904ed7607df39791a8928de8f4ae3ba68d6bfc8c50854804522032cc3f7ffd8db1b2240640e616fab04bf8eb7a46ff2d8ded491a26e667b49985ffd2c9094c62edb3cb41803a559e396cb49cb32428a376a9749cf77ac21a2e0d6d60896e092b97be68c53e4b477f62d53c1f&_=1705912792242
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/jquery.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
d1338b9cb5ff59a60bf073f1c09e5d0bdbab1dab00427e50c702098cdc632f1d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Accept
application/vnd.hsbcpayme.app-2.9.99+json
SESSIONID
29347619CB35BAD07D99126206B74FFCD4302E08DABE482D359C4E7DC865E146
Referer
https://payme-cashout-secure.hsbc.com.hk/
accept-language
zh-SG,zh;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:53 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Access-Control-Max-Age
3600
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Origin
*
Content-Type
application/vnd.hsbcpayme.app-2.9.99+json
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Connection
keep-alive
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
configs
payme-api-secure.hsbc.com.hk/hsbcpayme_api/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://payme-api-secure.hsbc.com.hk/hsbcpayme_api/configs?encData=2351925933b21801e4db3e56f29212c6a78923b390ec8713d9ba30e216ed4e52ae66b95a0ebd25ae79877b7426d346d7d207e997904ed7607df39791a8928de8f4ae3ba68d6bfc8c50854804522032cc3f7ffd8db1b2240640e616fab04bf8eb7a46ff2d8ded491a26e667b49985ffd2c9094c62edb3cb41803a559e396cb49cb32428a376a9749cf77ac21a2e0d6d60896e092b97be68c53e4b477f62d53c1f&_=1705912792242
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Accept
*/*
Access-Control-Request-Headers
sessionid
Access-Control-Request-Method
GET
Origin
https://payme-cashout-secure.hsbc.com.hk
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3600
Connection
keep-alive
Content-Length
0
Content-Security-Policy
frame-ancestors 'self'
Date
Mon, 22 Jan 2024 08:39:53 GMT
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Frame-Options
SAMEORIGIN
payme-logo_full_color.svg
payme-cashout-secure.hsbc.com.hk/images/paycode/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://payme-cashout-secure.hsbc.com.hk/images/paycode/payme-logo_full_color.svg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
60eeb739c7289255c0e4c9e8a6efd6f61422790f7e41359c70d8f0d24e1b8b5a
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:53 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
6785
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
ic_paya_business_grey_detail.svg
payme-cashout-secure.hsbc.com.hk/images/frontPage/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://payme-cashout-secure.hsbc.com.hk/images/frontPage/ic_paya_business_grey_detail.svg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5ff8c1a8f5ead10bd1e5fcbfd65b71b4c927ba660fb7bf6a928ca8a1de5f3e4f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:53 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
4032
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
app_icon_60px.png
payme-cashout-secure.hsbc.com.hk/images/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://payme-cashout-secure.hsbc.com.hk/images/app_icon_60px.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
834f05a3c22e7adc3b30edfa2f256245c977774a144926497d3b0270b8584d2f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://payme-cashout-secure.hsbc.com.hk/?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:53 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
3621
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
image/png
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
ic_paya_business_grey_detail.svg
payme-cashout-secure.hsbc.com.hk/images/frontPage/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://payme-cashout-secure.hsbc.com.hk/images/frontPage/ic_paya_business_grey_detail.svg
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/qr-code-styling.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5ff8c1a8f5ead10bd1e5fcbfd65b71b4c927ba660fb7bf6a928ca8a1de5f3e4f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://payme-cashout-secure.hsbc.com.hk/?page=merchantPayCode&url=https://qr.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT
Origin
https://payme-cashout-secure.hsbc.com.hk
accept-language
zh-SG,zh;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Mon, 22 Jan 2024 08:39:53 GMT
Content-Security-Policy
frame-ancestors 'self'
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
4032
Request-Context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
Last-Modified
Mon, 15 Jan 2024 11:23:35 GMT
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Credentials
false
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
secure.payme.hsbc.com.hk
URL
hsbcpaymepay://secure.payme.hsbc.com.hk/2/HNYUXoG66pjTYgAt3qnkFT

Verdicts & Comments Add Verdict or Comment

68 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _typeof function| requirejs function| _require function| define function| $ function| jQuery object| Hex object| Base64 function| ASN1 object| global boolean| isChangeLanguageDynamic boolean| isMobile boolean| isWOS boolean| isAOS boolean| isIOS string| deviceModel object| nls object| tncNls object| jsencrypt function| methods object| envConfig function| navBar object| routing function| httpService function| desktopFooter boolean| browserOnline boolean| isSanctionedCountry string| lastStatePath object| aesnpmjs object| storage boolean| storageSupported string| publicKey string| encryptedkeyComp_2 string| sessionSID string| sessionID string| sessionIV string| sessionKey number| failRegisterCount boolean| disableBtnThread boolean| captChaResult boolean| changeLanguage number| fbFailCount object| urlParam function| tagAllPageData string| locale string| page string| currentPageArg boolean| utag_condload object| utag boolean| __tealium_twc_switch object| utag_cfg_ovrd object| utag_data object| TMS object| Evnt string| mn object| utag_extn object| tealium object| e number| f string| items string| hsbc_audience_id string| hsbc_audience_name string| storageData string| url object| p2MPayLinkUserInfo object| secretAmtConfig string| openAppAtFront boolean| redirectToApp

6 Cookies

Domain/Path Name / Value
payme-cashout-secure.hsbc.com.hk/ Name: SameSite
Value: None
.hsbc.com.hk/ Name: tms_ref
Value: https://payme-cashout-secure.hsbc.com.hk/static/hsbcpaymepay_deeplink.html
.tealiumiq.com/ Name: TAPID
Value: hsbc/wpb-stream-global-mobile>018d3053774600c7439d3abd70b803074007806c00b08|
.hsbc.com.hk/ Name: utag_main
Value: v_id:018d3053774600c7439d3abd70b803074007806c00b08$_sn:1$_se:1$_ss:1$_st:1705914592903$ses_id:1705912792903%3Bexp-session$_pn:1%3Bexp-session$dc_group:75$dc_visit:1$dc_event:1%3Bexp-session$dc_region:ap-east-1%3Bexp-session
payme-cashout-secure.hsbc.com.hk/ Name: ADRUM_BTa
Value: R:64|g:b74abc8b-807b-4d44-8be0-45da1446f359|n:hostap_098c552b-7264-4d55-8e21-32d54b9dac18
payme-cashout-secure.hsbc.com.hk/ Name: ADRUM_BT1
Value: R:64|i:2917558|e:47

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

akamai.tiqcdn.com
collect-ap-east-1.tealiumiq.com
payme-api-secure.hsbc.com.hk
payme-cashout-secure.hsbc.com.hk
secure.payme.hsbc.com.hk
tags.tiqcdn.com
secure.payme.hsbc.com.hk
104.69.37.107
20.239.125.58
2600:9000:229f:8200:7:2bfb:7c00:93a1
43.198.147.188
011fc91c68dc8c313e0a54e04876938adf2c51a72626391eb6873fdab318f35c
03790ba4c9f71981a4a202e4ee3ad0b42ce0edf6b5de031cfe95234168c9110c
0cfd20e2ebde98c495f9517eacfa3ace28e90675bbf2e3394c583dc0fc3d72c8
0db6b7651db0f1cfdcdcd01040702f3b7633cb3e2e498cf89ddd81d11ac5ee28
175ff68a062db502f844dffecd1e669918dca1cfbe9ba2574307219da4fe21a7
2dd843dd3b720fa0684171e6975014361496be13ab78d6dd9e18969fd0273cca
2f0b13819df2da3fcff98f4433d5228b07cafc40648bcff4d0012f5d4d92cd5b
3626e33f34a62f115128c038cd4aa7d3c63105b9472e94c40ce4fca15852df80
375839968ad8e9caa2cc368a4316e1a095860a876c538340fd101801f9f61077
45937b558c26b8ece9ab175bf24cbdd6fcbda0af83f4f7c5d9f03a1b8f46ae3b
490a0312f02c4ee37289bb12389c413b72546eeed840327ef1df7578d1475b80
4ad3f3d85f52f27c63f0d03dcf1a3e1811bb88a81d7c2bcf41452e0dc8c67785
4d77073fa8bea1e5cf143fdc6583b444fe22326cdc73478b1cba18cb8199169c
53325598963e3497ac831a647bb9807beebb3a3463e9850295fa3b69dbdab780
5a344279b10bfd998326c1fe3a988696891ec80296b7ed3f5e3fdba85904d5af
5c4a8a122c04132003ae1a06a91617ded6eda5b1b09f9889745b6ce70a63d7d4
5d28f43a3baf73e6c5f7b3511ca41d17d1afc81c014d0235ebfa2dc6efbbcd60
5eb0985ac3f69ea945f3d238b998160037ea4338069f96426c0677c8df6c7029
5ff8c1a8f5ead10bd1e5fcbfd65b71b4c927ba660fb7bf6a928ca8a1de5f3e4f
60eeb739c7289255c0e4c9e8a6efd6f61422790f7e41359c70d8f0d24e1b8b5a
6ad6978d586287c9c51a6c781de1b219ff38a1e739db411969c85c6a5127d1fe
71ab9203fb14407f0378c062ca5f04734fb6c0dd3861c683dcbe4f36d70f8929
7920bedb15c1bda01a407c1dc9223b506f51bafb51957951d15ca2c6201258d7
82939cf2672bde3c20c373944624fadb9f5d0b4c13f4ebfb05b6b6fb48653f30
834f05a3c22e7adc3b30edfa2f256245c977774a144926497d3b0270b8584d2f
8393a4568f5e63aa9e4c9a4e25c2d6defcd0ea2c2cac531a1d0fca9ca258ed04
924bf0481ab7e05dcfbb227d0d1e0edbe060e65a4744e8e41e2c664d3d1ac14f
9a055faba3835623d37e302b967a1f69c40a464211705d85fe182f43ad36f59d
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a5f2019acdfd65999fafe7522e287ded46d19394cc022a8e92892171129162a8
ad5ec000b329dd9cac0aeee167ddff5fcf398c94d4ff21ab6fd2cc0ef74ddedc
ad6f533d9700ea1340b9518421e181b2b9f4c6c9c736294d31e163bcb756adac
aefefff77e7c321ed5f8847e30ec8cd7b65f2e7e42fdf7844758901731e91045
b315503f1f5d6f8c62896324a5b81aef724502f7f1642bf01d64ead233e01480
ba655e27ca021317588bf453731fcf1b40105a0d013e951093054191b825695a
bbea9e94fcedb233be4bbc01915b68ea1def61241c4ff14b87faff7d970ac630
c5c4c65a9d05b2ac83f17a1d9a1d030006c78c3c458c7d39eea16073fc18015f
d1338b9cb5ff59a60bf073f1c09e5d0bdbab1dab00427e50c702098cdc632f1d
d753f8ee126736431a1cd8170dbfcf94f553eeb1d24f2baa7c66474a80d0e559
dc29bc886f4dfc6389d1c81a6fd593d0255feff7ee6a247f8bc546853242b411
e3a571fa710bed201218ae05921952cd8b45ff29f982d0061c527653a5efa199
e54c92cd99e4d5d6c2453fca42a9fc2348891427924160a39c2288693aa392b0
e66f4a5cba530862c217e73a97deb7b5c2d2eeab798a356c457917e7c90649d1
ef48854e73093d9f3712b99e48f50b0c71cd7202ce14746733eccfacd2171113
fcf6f9b0b968fce4ebba4e9fa73132329dbd711278fdbc83bce442176ae16372
ffbb2c09163430eddb7565e82ef6e9cc3efaabc6ab6e3257ec2c4c709d13dde3