www.hsbc.com.hk Open in urlscan Pro
13.32.27.87  Public Scan

Upgrade-Insecure-Requests

1

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

accept-ranges

bytes

cache-control

max-age=60, s-maxage=60

content-encoding

gzip

content-length

7350

content-security-policy

default-src 'self' *.hsbc.com.hk *.mastercard.com.au *.demdex.net *.lpsnmedia.net *.liveperson.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.tiqcdn.com *.tealiumiq.com *.liveperson.net *.googletagmanager.com *.hsbc.co.uk *.hsbc.com.hk *.doubleclick.net *.googleadservices.com *.lpsnmedia.net *.optimizely.com *.facebook.net *.google.com *.gstatic.com *.appdynamics.com *.googleapis.com *.awswaf.com *.analytics.yahoo.com vjs.zencdn.net players.brightcove.net *.ads-twitter.com *.hsbc.ae *.hsbc.com.hk:* *.walkme.com bat.bing.com *.recaptcha.net *.gstatic.cn *.biocatch.com s.yimg.com tpc.googlesyndication.com connect.facebook.net tags.tiqcdn.com www.google.com.hk www.googletagmanager.com cdn.appdynamics.com www.google-analytics.com cdn-assets-prod.s3.amazonaws.com *.callsign.com *.brightcove.net *.g.doubleclick.net *.zencdn.net *.hsbc.com.cn *.sc.omtrdc.net *.google-analytics.com ssl.google-analytics.com googleads.g.doubleclick.net www.google.com *.v.liveperson.net *.googlesyndication.com; img-src data: * blob: android-webview-video-poster: android-webview:; connect-src 'self' *.tiqcdn.com *.tealiumiq.com *.hsbc.com.hk *.eum-appdynamics.com *.optimizely.com wss://*.liveperson.net *.cloud.hsbc *.awswaf.com *.analytics.yahoo.com players.brightcove.net edge.api.brightcove.com *.googleapis.com *.hsbc.ae *.omtrdc.net *.demdex.net *.hsbc.co.om *.brightcovecdn.com *.hsbc.com.hk:* *.walkme.com bat.bing.com *.biocatch.com rbwm-api.us.hsbc.com rbwm-api.hsbc.co.uk rbwm-api.hsbc.com.hk ad.doubleclick.net www.facebook.com maps.googleapis.com *.siteintercept.qualtrics.com adservice.google.com manifest.prod.boltdns.net www.google.com http://127.0.0.1:5000 http://127.0.0.1:5000/* translate.googleapis.com www.google-analytics.com www.googletagmanager.com www.google.com.hk connect.facebook.net lptag.liveperson.net accdn.lpsnmedia.net *.v.liveperson.net s.yimg.com cdn.appdynamics.com cdn-assets-prod.s3.amazonaws.com brightcove.hs.llnwd.net *.akamaihd.net *.callsign.com *.googletagmanager.com *.facebook.com *.brightcove.com *.boltdns.net *.hs.llnwd.net *.hsbc.com.cn t.co analytics.twitter.com *.api.brightcove.com analytics.google.com *.google-analytics.com *.google.com.hk *.g.doubleclick.net *.analytics.google.com *.doubleclick.net; frame-src 'self' blob: *.lpsnmedia.net *.optimizely.com *.liveperson.net *.google.com *.doubleclick.net *.analytics.yahoo.com players.brightcove.net *.walkme.com *.googletagmanager.com *.recaptcha.net www.facebook.com tpc.googlesyndication.com connect.facebook.net gateway.zscalertwo.net gateway.zscloud.net sts-aad.auth.hsbc.com lpcdn.lpsnmedia.net 8694241.fls.doubleclick.net *.online-metrix.net *.hsbc.com.hk *.demdex.net *.id.opendns.com *.tiqcdn.com *.facebook.com bid.g.doubleclick.net cdntm.hsbc.com.hk; frame-ancestors 'self' *.liveperson.net www.hsbc.com.hk *.hsbc.com.hk; font-src 'self' data: *.hsbc.com.hk *.gstatic.com *.walkme.com fonts.gstatic.com cdn.jsdelivr.net at.alicdn.com *.avast.com *.alicdn.com; worker-src 'self' blob: *.walkme.com; style-src 'self' 'unsafe-inline' *.hsbc.com.hk *.googleapis.com players.brightcove.net *.walkme.com *.askus.hsbc.co.uk; object-src 'self' blob:; child-src 'self' blob:; media-src 'self' blob: *.boltdns.net *.media.brightcove.com *.llnw.net *.llnwd.net *.akafms.net *.akamaihd.net *.cf.brightcove.com *.brightcovecdn.com lpcdn.lpsnmedia.net manifest.prod.boltdns.net ssl.gstatic.com players.brightcove.net *.hsbc.com.hk *.lpsnmedia.net; manifest-src 'self'; upgrade-insecure-requests ; report-uri /csp/report;

content-type

text/html; charset=utf-8

date

Wed, 20 Nov 2024 22:33:09 GMT

last-modified

Wed, 20 Nov 2024 13:08:39 GMT

s

dispatcher2apsoutheast1-b80

server

Apache

strict-transport-security

max-age=31536000; includeSubdomains

vary

Accept-Encoding

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

x-amz-cf-id

sO3o1DVFmMXujk5PsiKFi87CmXzWTgHeBjEWCvbFH98V8PTlYY9uvw==

x-amz-cf-pop

FRA56-C2

x-cache

Miss from cloudfront

x-content-type-options

nosniff

x-frame-options

SAMEORIGIN

x-xss-protection

1; mode=block

Redirect headers

cache-control

max-age=31536000

content-length

0

date

Wed, 20 Nov 2024 22:33:09 GMT

location

/en-hk/misc/terms-of-use/

server

CloudFront

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

x-amz-cf-id

GDzRZwjhGRXK7ONc5U_RO1tMMtl7jMWKNEgY6fwynAthYCIrr0DxMw==

x-amz-cf-pop

FRA56-C2

x-cache

Miss from cloudfront

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Referer

https://www.hsbc.com.hk/

cache-control

private, max-age=86400, stale-while-revalidate=604800

content-encoding

gzip

pragma

no-cache

via

1.1 a4079c0a5989b4b7af98433fdd07f680.cloudfront.net (CloudFront)

expires

0

alt-svc

h3=":443"; ma=86400

x-amzn-waf-challenge-id

Root=1-673e63a5-0e424d160b5bc7cb265eaf5a

x-cache

Miss from cloudfront

x-amz-cf-id

m1vaVpnfvm2Os-OPcanyIFNPtlJfRM9EGSgB0ojdETNzkqjyTI1mPw==

date

Wed, 20 Nov 2024 22:33:09 GMT

content-type

text/javascript

last-modified

Wed, 20 Nov 2024 22:33:09 +0000

vary

accept-encoding

x-amz-cf-pop

FRA56-P8

Redirect headers

access-control-max-age

86400

cache-control

max-age=86400

location

https://hsbc.e14fe838.eu-central-1.token.awswaf.com/hsbc/dxp/challenge.js

access-control-allow-methods

*

via

1.1 7ff386cc5735ee5d428e6d9e2fdc8b2c.cloudfront.net (CloudFront)

access-control-allow-origin

*

x-cache

FunctionGeneratedResponse from cloudfront

content-length

0

x-amz-cf-id

hCpjp2DRQS8SLOhlyzdHE3C8Ikpq6nRrSRtryac1AwOBhKNzYbrNiQ==

date

Wed, 20 Nov 2024 22:33:09 GMT

x-amz-cf-pop

FRA6-C1

server

CloudFront

access-control-allow-headers

*

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Referer

https://www.hsbc.com.hk/en-hk/misc/terms-of-use/

content-encoding

gzip

age

608728

x-content-type-options

nosniff

x-cache

Hit from cloudfront

x-amz-cf-id

jYg1I2iA0wH5LYCgZkD4-Hfu-1mhOsWRrJxgSPlqB_u_MnDcxvpLcA==

date

Wed, 13 Nov 2024 21:27:41 GMT

content-type

text/css

last-modified

Wed, 13 Nov 2024 17:47:30 GMT

vary

Accept-Encoding

strict-transport-security

max-age=31536000; includeSubdomains

cache-control

max-age=31536000, s-maxage=31536000

s

dispatcher3apsoutheast1-b80

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

accept-ranges

bytes

x-xss-protection

1; mode=block

x-amz-cf-pop

FRA56-C2

server

Apache

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Referer

https://www.hsbc.com.hk/

vary

accept-encoding

cache-control

max-age=300

content-encoding

br

etag

W/"ab02be21f34071e2d8c9c42c2d17d4ff"

x-amz-version-id

YO_DGt3RqtoIfLYVEBc2IGSjeU1LOhPb

age

28

via

1.1 1332d04637e8e8783a277613082f94d8.cloudfront.net (CloudFront)

x-cache

Hit from cloudfront

x-amz-cf-id

ghrPKfMVb6VDtOZCvd8KW0CXMTKopXvfbqGesRhCNG4z19sR0DCw2w==

date

Wed, 20 Nov 2024 22:32:43 GMT

content-type

application/javascript

last-modified

Fri, 15 Nov 2024 11:17:12 GMT

server

AmazonS3

x-amz-cf-pop

FRA56-P11

x-amz-server-side-encryption

AES256

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Referer

https://www.hsbc.com.hk/en-hk/misc/terms-of-use/

content-encoding

gzip

age

2568227

x-content-type-options

nosniff

x-cache

Hit from cloudfront

x-amz-cf-id

zuD2N51G-ziyOAYVI4lu-_GpjBPiqtu_ww3D0IpENc0QMtSvRRRtBg==

date

Tue, 22 Oct 2024 05:09:22 GMT

content-type

application/javascript

last-modified

Mon, 21 Oct 2024 17:14:31 GMT

vary

Accept-Encoding

strict-transport-security

max-age=31536000; includeSubdomains

cache-control

max-age=31536000, s-maxage=31536000

s

dispatcher2apeast1-b80

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

accept-ranges

bytes

content-length

11524

x-xss-protection

1; mode=block

x-amz-cf-pop

FRA56-C2

server

Apache

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Referer

https://www.hsbc.com.hk/en-hk/misc/terms-of-use/

content-encoding

gzip

age

1619709

x-content-type-options

nosniff

x-cache

Hit from cloudfront

x-amz-cf-id

RmJzvN6goN2RlhXUMty8OiayJPL_XqrBvJoHIoaSz39bXP1mHkksag==

date

Sat, 02 Nov 2024 04:38:00 GMT

content-type

image/svg+xml

vary

Accept-Encoding

last-modified

Wed, 08 Jun 2022 05:42:32 GMT

x-frame-options

SAMEORIGIN

strict-transport-security

max-age=31536000; includeSubdomains

cache-control

max-age=2592000, s-maxage=2592000

s

dispatcher2apeast1-b80

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

accept-ranges

bytes

content-length

1966

x-xss-protection

1; mode=block

x-amz-cf-pop

FRA56-C2

server

Apache

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Referer

https://www.hsbc.com.hk/en-hk/misc/terms-of-use/

content-encoding

gzip

age

116440

x-content-type-options

nosniff

x-cache

Hit from cloudfront

x-amz-cf-id

h7C7rrUUZ_1gCX82erV8guMjLU_rbohDqJZWqxlE3m7zLzRz_KN47w==

date

Tue, 19 Nov 2024 14:12:29 GMT

content-type

image/svg+xml

last-modified

Mon, 18 Nov 2024 16:13:16 GMT

vary

Accept-Encoding

strict-transport-security

max-age=31536000; includeSubdomains

cache-control

max-age=7776000, s-maxage=7776000

s

dispatcher2apeast1-b80

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

accept-ranges

bytes

content-length

463

x-xss-protection

1; mode=block

x-amz-cf-pop

FRA56-C2

server

Apache

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Referer

https://www.hsbc.com.hk/en-hk/misc/terms-of-use/

content-encoding

gzip

age

608728

x-content-type-options

nosniff

x-cache

Hit from cloudfront

x-amz-cf-id

BO3UUVM-5hKhClWWIkRFRIB1jFNL-IxWQYb2hGjKNBd7t_kQ1NLGSw==

date

Wed, 13 Nov 2024 21:27:41 GMT

content-type

application/javascript

last-modified

Wed, 13 Nov 2024 17:47:30 GMT

vary

Accept-Encoding

strict-transport-security

max-age=31536000; includeSubdomains

cache-control

max-age=31536000, s-maxage=31536000

s

dispatcher3apsoutheast1-b80

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

accept-ranges

bytes

x-xss-protection

1; mode=block

x-amz-cf-pop

FRA56-C2

server

Apache

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Referer

https://www.hsbc.com.hk/

access-control-max-age

86400

access-control-expose-headers

x-amz-meta-revision

content-encoding

gzip

cf-cache-status

HIT

etag

"3ec1225b1ec4df78f5d9c4d9c2266fac"

x-amz-version-id

ZdBRMRvygX8LYg6hkcFyaXlQqZ1FgTMc

age

110

access-control-allow-methods

GET, HEAD

date

Wed, 20 Nov 2024 22:33:10 GMT

x-amz-meta-revision

10987

content-type

text/javascript; charset=utf-8

last-modified

Wed, 20 Nov 2024 12:11:28 GMT

vary

Accept-Encoding

x-amz-id-2

nucOsYz78eA0Nv8Kf3xPuu4F4ultizRLLaBcYV8o9LWYCZO+7DBDGX5epq9TQNeygZMjUywy6Nc=

access-control-allow-headers

*

x-amz-replication-status

PENDING

cache-control

max-age=120

timing-allow-origin

*

x-amz-meta-pci_enabled

False

access-control-allow-credentials

false

x-amz-request-id

EJ7B51X2HNSF20E1

cf-ray

8e5be670f9611905-FRA

accept-ranges

bytes

access-control-allow-origin

*

content-length

138207

server

cloudflare

x-amz-server-side-encryption

AES256

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Referer

https://www.hsbc.com.hk/

vary

accept-encoding

cache-control

max-age=300

content-encoding

br

etag

W/"f9e53dac071c93004f240805925d96a0"

x-amz-version-id

vGnfbsaWGFwJZu.OqcqhqNc5mcnJrcFM

age

111

via

1.1 1332d04637e8e8783a277613082f94d8.cloudfront.net (CloudFront)

x-cache

Hit from cloudfront

x-amz-cf-id

vh0b1dH8fyIo1UAujImnuPBkmJl_SSuTqudNjd2mJ8siJhHryi94MA==

date

Wed, 20 Nov 2024 22:31:20 GMT

content-type

application/javascript

last-modified

Fri, 15 Nov 2024 11:17:12 GMT

server

AmazonS3

x-amz-cf-pop

FRA56-P11

x-amz-server-side-encryption

AES256

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Referer

https://www.hsbc.com.hk/etc.clientlibs/dpws/clientlibs-public/clientlib-default.min.066b137df59bb405b617dd2a664b4863.css

content-encoding

gzip

age

30119

x-content-type-options

nosniff

x-cache

Hit from cloudfront

x-amz-cf-id

vnad9TkllCWtq_pQURLk6ODbr8ACT59xq5TqgYXa3nL1NzoEOXgK8g==

date

Wed, 20 Nov 2024 14:11:11 GMT

content-type

image/svg+xml

last-modified

Mon, 18 Nov 2024 16:31:11 GMT

vary

Accept-Encoding

strict-transport-security

max-age=31536000; includeSubdomains

cache-control

max-age=7776000, s-maxage=7776000

s

dispatcher2apsoutheast1-b80

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

accept-ranges

bytes

content-length

401

x-xss-protection

1; mode=block

x-amz-cf-pop

FRA56-C2

server

Apache

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Origin

https://www.hsbc.com.hk

Referer

https://www.hsbc.com.hk/etc.clientlibs/dpws/clientlibs-public/clientlib-default.min.066b137df59bb405b617dd2a664b4863.css

age

6122159

x-content-type-options

nosniff

x-cache

Hit from cloudfront

x-amz-cf-id

kLozmHdhkKrxUetfEVV4TuZ4HFr_nhjr6Qf4sbYdoMViUv_37rTH3w==

date

Wed, 11 Sep 2024 01:57:11 GMT

content-type

application/font-woff

last-modified

Thu, 05 Sep 2024 14:32:36 GMT

strict-transport-security

max-age=31536000; includeSubdomains

cache-control

max-age=7776000, s-maxage=7776000

s

dispatcher2apeast1-b80

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

accept-ranges

bytes

content-length

27464

x-xss-protection

1; mode=block

x-amz-cf-pop

FRA56-C2

server

Apache

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Origin

https://www.hsbc.com.hk

Referer

https://www.hsbc.com.hk/etc.clientlibs/dpws/clientlibs-public/clientlib-default.min.066b137df59bb405b617dd2a664b4863.css

age

2106672

x-content-type-options

nosniff

x-cache

Hit from cloudfront

x-amz-cf-id

zJUISw_Hv5A5CzbqqBwKGgJoP6lYPjMPz5k9kkEIE0sPQ5xXhSgWlw==

date

Sun, 27 Oct 2024 13:21:58 GMT

content-type

application/font-woff

last-modified

Wed, 23 Oct 2024 17:00:48 GMT

strict-transport-security

max-age=31536000; includeSubdomains

cache-control

max-age=7776000, s-maxage=7776000

s

dispatcher2apsoutheast1-b80

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

accept-ranges

bytes

content-length

26884

x-xss-protection

1; mode=block

x-amz-cf-pop

FRA56-C2

server

Apache

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Origin

https://www.hsbc.com.hk

Referer

https://www.hsbc.com.hk/etc.clientlibs/dpws/clientlibs-public/clientlib-default.min.066b137df59bb405b617dd2a664b4863.css

age

1195149

x-content-type-options

nosniff

x-cache

Hit from cloudfront

x-amz-cf-id

21BSfdlGy8Hs-BenD9O_Nu_jzE1oOACp5Z4n5gfSwbHnZP_BGZx3gg==

date

Thu, 07 Nov 2024 02:34:00 GMT

content-type

application/font-woff

last-modified

Wed, 06 Nov 2024 17:44:12 GMT

strict-transport-security

max-age=31536000; includeSubdomains

cache-control

max-age=7776000, s-maxage=7776000

s

dispatcher2apeast1-b80

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

accept-ranges

bytes

content-length

26300

x-xss-protection

1; mode=block

x-amz-cf-pop

FRA56-C2

server

Apache

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Origin

https://www.hsbc.com.hk

Referer

https://www.hsbc.com.hk/etc.clientlibs/dpws/clientlibs-public/clientlib-default.min.066b137df59bb405b617dd2a664b4863.css

age

5732477

x-content-type-options

nosniff

x-cache

Hit from cloudfront

x-amz-cf-id

hK7WXOUi5xYVV5nTJuDvUnyPH_r5g_OiCy_LcPJtjW23CMtQagbuIA==

date

Sun, 15 Sep 2024 14:11:53 GMT

content-type

application/font-woff

last-modified

Thu, 12 Sep 2024 17:39:12 GMT

strict-transport-security

max-age=31536000; includeSubdomains

cache-control

max-age=7776000, s-maxage=7776000

s

dispatcher2apeast1-b80

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

accept-ranges

bytes

content-length

38384

x-xss-protection

1; mode=block

x-amz-cf-pop

FRA56-C2

server

Apache

Referer

https://www.hsbc.com.hk/en-hk/misc/terms-of-use/

X-Requested-With

XMLHttpRequest

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Accept

*/*

ADRUM

isAjax:true

content-encoding

gzip

x-content-type-options

nosniff

server-timing

cdn-upstream-layer;desc="Origin Shield",cdn-upstream-dns;dur=0,cdn-upstream-connect;dur=0,cdn-upstream-fbl;dur=40,cdn-cache-miss,cdn-pop;desc="FRA56-C2",cdn-rid;desc="z9CfGVLWPKa6Crx0svSiwRcGAZljiO628JuWFj8g_ZzfiDV3y1Wg_Q==",cdn-downstream-fbl;dur=248

x-cache

Miss from cloudfront

x-amz-cf-id

z9CfGVLWPKa6Crx0svSiwRcGAZljiO628JuWFj8g_ZzfiDV3y1Wg_Q==

date

Wed, 20 Nov 2024 22:33:10 GMT

content-type

text/html; charset=utf-8

vary

Accept-Encoding

last-modified

Wed, 20 Nov 2024 12:59:20 GMT

x-frame-options

SAMEORIGIN

strict-transport-security

max-age=31536000; includeSubdomains

content-security-policy

default-src 'self' *.hsbc.com.hk *.mastercard.com.au *.demdex.net *.lpsnmedia.net *.liveperson.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.tiqcdn.com *.tealiumiq.com *.liveperson.net *.googletagmanager.com *.hsbc.co.uk *.hsbc.com.hk *.doubleclick.net *.googleadservices.com *.lpsnmedia.net *.optimizely.com *.facebook.net *.google.com *.gstatic.com *.appdynamics.com *.googleapis.com *.awswaf.com *.analytics.yahoo.com vjs.zencdn.net players.brightcove.net *.ads-twitter.com *.hsbc.ae *.hsbc.com.hk:* *.walkme.com bat.bing.com *.recaptcha.net *.gstatic.cn *.biocatch.com s.yimg.com tpc.googlesyndication.com connect.facebook.net tags.tiqcdn.com www.google.com.hk www.googletagmanager.com cdn.appdynamics.com www.google-analytics.com cdn-assets-prod.s3.amazonaws.com *.callsign.com *.brightcove.net *.g.doubleclick.net *.zencdn.net *.hsbc.com.cn *.sc.omtrdc.net *.google-analytics.com ssl.google-analytics.com googleads.g.doubleclick.net www.google.com *.v.liveperson.net *.googlesyndication.com; img-src data: * blob: android-webview-video-poster: android-webview:; connect-src 'self' *.tiqcdn.com *.tealiumiq.com *.hsbc.com.hk *.eum-appdynamics.com *.optimizely.com wss://*.liveperson.net *.cloud.hsbc *.awswaf.com *.analytics.yahoo.com players.brightcove.net edge.api.brightcove.com *.googleapis.com *.hsbc.ae *.omtrdc.net *.demdex.net *.hsbc.co.om *.brightcovecdn.com *.hsbc.com.hk:* *.walkme.com bat.bing.com *.biocatch.com rbwm-api.us.hsbc.com rbwm-api.hsbc.co.uk rbwm-api.hsbc.com.hk ad.doubleclick.net www.facebook.com maps.googleapis.com *.siteintercept.qualtrics.com adservice.google.com manifest.prod.boltdns.net www.google.com http://127.0.0.1:5000 http://127.0.0.1:5000/* translate.googleapis.com www.google-analytics.com www.googletagmanager.com www.google.com.hk connect.facebook.net lptag.liveperson.net accdn.lpsnmedia.net *.v.liveperson.net s.yimg.com cdn.appdynamics.com cdn-assets-prod.s3.amazonaws.com brightcove.hs.llnwd.net *.akamaihd.net *.callsign.com *.googletagmanager.com *.facebook.com *.brightcove.com *.boltdns.net *.hs.llnwd.net *.hsbc.com.cn t.co analytics.twitter.com *.api.brightcove.com analytics.google.com *.google-analytics.com *.google.com.hk *.g.doubleclick.net *.analytics.google.com *.doubleclick.net; frame-src 'self' blob: *.lpsnmedia.net *.optimizely.com *.liveperson.net *.google.com *.doubleclick.net *.analytics.yahoo.com players.brightcove.net *.walkme.com *.googletagmanager.com *.recaptcha.net www.facebook.com tpc.googlesyndication.com connect.facebook.net gateway.zscalertwo.net gateway.zscloud.net sts-aad.auth.hsbc.com lpcdn.lpsnmedia.net 8694241.fls.doubleclick.net *.online-metrix.net *.hsbc.com.hk *.demdex.net *.id.opendns.com *.tiqcdn.com *.facebook.com bid.g.doubleclick.net cdntm.hsbc.com.hk; frame-ancestors 'self' *.liveperson.net www.hsbc.com.hk *.hsbc.com.hk; font-src 'self' data: *.hsbc.com.hk *.gstatic.com *.walkme.com fonts.gstatic.com cdn.jsdelivr.net at.alicdn.com *.avast.com *.alicdn.com; worker-src 'self' blob: *.walkme.com; style-src 'self' 'unsafe-inline' *.hsbc.com.hk *.googleapis.com players.brightcove.net *.walkme.com *.askus.hsbc.co.uk; object-src 'self' blob:; child-src 'self' blob:; media-src 'self' blob: *.boltdns.net *.media.brightcove.com *.llnw.net *.llnwd.net *.akafms.net *.akamaihd.net *.cf.brightcove.com *.brightcovecdn.com lpcdn.lpsnmedia.net manifest.prod.boltdns.net ssl.gstatic.com players.brightcove.net *.hsbc.com.hk *.lpsnmedia.net; manifest-src 'self'; upgrade-insecure-requests ; report-uri /csp/report;

cache-control

max-age=60, s-maxage=60

s

dispatcher2apeast1-b80

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

accept-ranges

bytes

content-length

920

x-xss-protection

1; mode=block

x-amz-cf-pop

FRA56-C2

server

Apache

Referer

https://www.hsbc.com.hk/en-hk/misc/terms-of-use/

X-Requested-With

XMLHttpRequest

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Accept

*/*

ADRUM

isAjax:true

content-encoding

gzip

x-content-type-options

nosniff

server-timing

cdn-upstream-layer;desc="Origin Shield",cdn-upstream-dns;dur=0,cdn-upstream-connect;dur=0,cdn-upstream-fbl;dur=32,cdn-cache-miss,cdn-pop;desc="FRA56-C2",cdn-rid;desc="ecry_NeFTTIMwf-wp6RZz9s0T0U4lToOvvJxMtYbvWh_gdLe5H_y3g==",cdn-downstream-fbl;dur=247

x-cache

Miss from cloudfront

x-amz-cf-id

ecry_NeFTTIMwf-wp6RZz9s0T0U4lToOvvJxMtYbvWh_gdLe5H_y3g==

date

Wed, 20 Nov 2024 22:33:10 GMT

content-type

text/html; charset=utf-8

vary

Accept-Encoding

last-modified

Wed, 20 Nov 2024 12:59:30 GMT

x-frame-options

SAMEORIGIN

strict-transport-security

max-age=31536000; includeSubdomains

content-security-policy

default-src 'self' *.hsbc.com.hk *.mastercard.com.au *.demdex.net *.lpsnmedia.net *.liveperson.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.tiqcdn.com *.tealiumiq.com *.liveperson.net *.googletagmanager.com *.hsbc.co.uk *.hsbc.com.hk *.doubleclick.net *.googleadservices.com *.lpsnmedia.net *.optimizely.com *.facebook.net *.google.com *.gstatic.com *.appdynamics.com *.googleapis.com *.awswaf.com *.analytics.yahoo.com vjs.zencdn.net players.brightcove.net *.ads-twitter.com *.hsbc.ae *.hsbc.com.hk:* *.walkme.com bat.bing.com *.recaptcha.net *.gstatic.cn *.biocatch.com s.yimg.com tpc.googlesyndication.com connect.facebook.net tags.tiqcdn.com www.google.com.hk www.googletagmanager.com cdn.appdynamics.com www.google-analytics.com cdn-assets-prod.s3.amazonaws.com *.callsign.com *.brightcove.net *.g.doubleclick.net *.zencdn.net *.hsbc.com.cn *.sc.omtrdc.net *.google-analytics.com ssl.google-analytics.com googleads.g.doubleclick.net www.google.com *.v.liveperson.net *.googlesyndication.com; img-src data: * blob: android-webview-video-poster: android-webview:; connect-src 'self' *.tiqcdn.com *.tealiumiq.com *.hsbc.com.hk *.eum-appdynamics.com *.optimizely.com wss://*.liveperson.net *.cloud.hsbc *.awswaf.com *.analytics.yahoo.com players.brightcove.net edge.api.brightcove.com *.googleapis.com *.hsbc.ae *.omtrdc.net *.demdex.net *.hsbc.co.om *.brightcovecdn.com *.hsbc.com.hk:* *.walkme.com bat.bing.com *.biocatch.com rbwm-api.us.hsbc.com rbwm-api.hsbc.co.uk rbwm-api.hsbc.com.hk ad.doubleclick.net www.facebook.com maps.googleapis.com *.siteintercept.qualtrics.com adservice.google.com manifest.prod.boltdns.net www.google.com http://127.0.0.1:5000 http://127.0.0.1:5000/* translate.googleapis.com www.google-analytics.com www.googletagmanager.com www.google.com.hk connect.facebook.net lptag.liveperson.net accdn.lpsnmedia.net *.v.liveperson.net s.yimg.com cdn.appdynamics.com cdn-assets-prod.s3.amazonaws.com brightcove.hs.llnwd.net *.akamaihd.net *.callsign.com *.googletagmanager.com *.facebook.com *.brightcove.com *.boltdns.net *.hs.llnwd.net *.hsbc.com.cn t.co analytics.twitter.com *.api.brightcove.com analytics.google.com *.google-analytics.com *.google.com.hk *.g.doubleclick.net *.analytics.google.com *.doubleclick.net; frame-src 'self' blob: *.lpsnmedia.net *.optimizely.com *.liveperson.net *.google.com *.doubleclick.net *.analytics.yahoo.com players.brightcove.net *.walkme.com *.googletagmanager.com *.recaptcha.net www.facebook.com tpc.googlesyndication.com connect.facebook.net gateway.zscalertwo.net gateway.zscloud.net sts-aad.auth.hsbc.com lpcdn.lpsnmedia.net 8694241.fls.doubleclick.net *.online-metrix.net *.hsbc.com.hk *.demdex.net *.id.opendns.com *.tiqcdn.com *.facebook.com bid.g.doubleclick.net cdntm.hsbc.com.hk; frame-ancestors 'self' *.liveperson.net www.hsbc.com.hk *.hsbc.com.hk; font-src 'self' data: *.hsbc.com.hk *.gstatic.com *.walkme.com fonts.gstatic.com cdn.jsdelivr.net at.alicdn.com *.avast.com *.alicdn.com; worker-src 'self' blob: *.walkme.com; style-src 'self' 'unsafe-inline' *.hsbc.com.hk *.googleapis.com players.brightcove.net *.walkme.com *.askus.hsbc.co.uk; object-src 'self' blob:; child-src 'self' blob:; media-src 'self' blob: *.boltdns.net *.media.brightcove.com *.llnw.net *.llnwd.net *.akafms.net *.akamaihd.net *.cf.brightcove.com *.brightcovecdn.com lpcdn.lpsnmedia.net manifest.prod.boltdns.net ssl.gstatic.com players.brightcove.net *.hsbc.com.hk *.lpsnmedia.net; manifest-src 'self'; upgrade-insecure-requests ; report-uri /csp/report;

cache-control

max-age=60, s-maxage=60

s

dispatcher2apeast1-b80

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

accept-ranges

bytes

content-length

967

x-xss-protection

1; mode=block

x-amz-cf-pop

FRA56-C2

server

Apache

Referer

https://www.hsbc.com.hk/en-hk/misc/terms-of-use/

X-Requested-With

XMLHttpRequest

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Accept

*/*

ADRUM

isAjax:true

content-encoding

gzip

x-content-type-options

nosniff

x-cache

Miss from cloudfront

x-amz-cf-id

fDaq6iOhlc-tVYzdO3e5t-y1y4XunizSJTbOgTgUUskud9fMLSAAhw==

date

Wed, 20 Nov 2024 22:33:10 GMT

content-type

text/html; charset=utf-8

vary

Accept-Encoding

last-modified

Wed, 20 Nov 2024 12:59:20 GMT

x-frame-options

SAMEORIGIN

strict-transport-security

max-age=31536000; includeSubdomains

content-security-policy

default-src 'self' *.hsbc.com.hk *.mastercard.com.au *.demdex.net *.lpsnmedia.net *.liveperson.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.tiqcdn.com *.tealiumiq.com *.liveperson.net *.googletagmanager.com *.hsbc.co.uk *.hsbc.com.hk *.doubleclick.net *.googleadservices.com *.lpsnmedia.net *.optimizely.com *.facebook.net *.google.com *.gstatic.com *.appdynamics.com *.googleapis.com *.awswaf.com *.analytics.yahoo.com vjs.zencdn.net players.brightcove.net *.ads-twitter.com *.hsbc.ae *.hsbc.com.hk:* *.walkme.com bat.bing.com *.recaptcha.net *.gstatic.cn *.biocatch.com s.yimg.com tpc.googlesyndication.com connect.facebook.net tags.tiqcdn.com www.google.com.hk www.googletagmanager.com cdn.appdynamics.com www.google-analytics.com cdn-assets-prod.s3.amazonaws.com *.callsign.com *.brightcove.net *.g.doubleclick.net *.zencdn.net *.hsbc.com.cn *.sc.omtrdc.net *.google-analytics.com ssl.google-analytics.com googleads.g.doubleclick.net www.google.com *.v.liveperson.net *.googlesyndication.com; img-src data: * blob: android-webview-video-poster: android-webview:; connect-src 'self' *.tiqcdn.com *.tealiumiq.com *.hsbc.com.hk *.eum-appdynamics.com *.optimizely.com wss://*.liveperson.net *.cloud.hsbc *.awswaf.com *.analytics.yahoo.com players.brightcove.net edge.api.brightcove.com *.googleapis.com *.hsbc.ae *.omtrdc.net *.demdex.net *.hsbc.co.om *.brightcovecdn.com *.hsbc.com.hk:* *.walkme.com bat.bing.com *.biocatch.com rbwm-api.us.hsbc.com rbwm-api.hsbc.co.uk rbwm-api.hsbc.com.hk ad.doubleclick.net www.facebook.com maps.googleapis.com *.siteintercept.qualtrics.com adservice.google.com manifest.prod.boltdns.net www.google.com http://127.0.0.1:5000 http://127.0.0.1:5000/* translate.googleapis.com www.google-analytics.com www.googletagmanager.com www.google.com.hk connect.facebook.net lptag.liveperson.net accdn.lpsnmedia.net *.v.liveperson.net s.yimg.com cdn.appdynamics.com cdn-assets-prod.s3.amazonaws.com brightcove.hs.llnwd.net *.akamaihd.net *.callsign.com *.googletagmanager.com *.facebook.com *.brightcove.com *.boltdns.net *.hs.llnwd.net *.hsbc.com.cn t.co analytics.twitter.com *.api.brightcove.com analytics.google.com *.google-analytics.com *.google.com.hk *.g.doubleclick.net *.analytics.google.com *.doubleclick.net; frame-src 'self' blob: *.lpsnmedia.net *.optimizely.com *.liveperson.net *.google.com *.doubleclick.net *.analytics.yahoo.com players.brightcove.net *.walkme.com *.googletagmanager.com *.recaptcha.net www.facebook.com tpc.googlesyndication.com connect.facebook.net gateway.zscalertwo.net gateway.zscloud.net sts-aad.auth.hsbc.com lpcdn.lpsnmedia.net 8694241.fls.doubleclick.net *.online-metrix.net *.hsbc.com.hk *.demdex.net *.id.opendns.com *.tiqcdn.com *.facebook.com bid.g.doubleclick.net cdntm.hsbc.com.hk; frame-ancestors 'self' *.liveperson.net www.hsbc.com.hk *.hsbc.com.hk; font-src 'self' data: *.hsbc.com.hk *.gstatic.com *.walkme.com fonts.gstatic.com cdn.jsdelivr.net at.alicdn.com *.avast.com *.alicdn.com; worker-src 'self' blob: *.walkme.com; style-src 'self' 'unsafe-inline' *.hsbc.com.hk *.googleapis.com players.brightcove.net *.walkme.com *.askus.hsbc.co.uk; object-src 'self' blob:; child-src 'self' blob:; media-src 'self' blob: *.boltdns.net *.media.brightcove.com *.llnw.net *.llnwd.net *.akafms.net *.akamaihd.net *.cf.brightcove.com *.brightcovecdn.com lpcdn.lpsnmedia.net manifest.prod.boltdns.net ssl.gstatic.com players.brightcove.net *.hsbc.com.hk *.lpsnmedia.net; manifest-src 'self'; upgrade-insecure-requests ; report-uri /csp/report;

cache-control

max-age=60, s-maxage=60

s

dispatcher3apsoutheast1-b80

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

accept-ranges

bytes

content-length

1620

x-xss-protection

1; mode=block

x-amz-cf-pop

FRA56-C2

server

Apache

Referer

https://www.hsbc.com.hk/en-hk/misc/terms-of-use/

X-Requested-With

XMLHttpRequest

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Accept

*/*

ADRUM

isAjax:true

content-encoding

gzip

x-content-type-options

nosniff

server-timing

cdn-upstream-layer;desc="Origin Shield",cdn-upstream-dns;dur=0,cdn-upstream-connect;dur=0,cdn-upstream-fbl;dur=2,cdn-cache-miss,cdn-pop;desc="FRA56-C2",cdn-rid;desc="zmGnL4TJX-iuAM1fY0ukmp_dbCUYg4Act3GIva10gXFsdyncKnNrhA==",cdn-downstream-fbl;dur=208

x-cache

Miss from cloudfront

x-amz-cf-id

zmGnL4TJX-iuAM1fY0ukmp_dbCUYg4Act3GIva10gXFsdyncKnNrhA==

date

Wed, 20 Nov 2024 22:33:10 GMT

content-type

text/html; charset=utf-8

vary

Accept-Encoding

last-modified

Wed, 20 Nov 2024 12:59:20 GMT

x-frame-options

SAMEORIGIN

strict-transport-security

max-age=31536000; includeSubdomains

content-security-policy

default-src 'self' *.hsbc.com.hk *.mastercard.com.au *.demdex.net *.lpsnmedia.net *.liveperson.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.tiqcdn.com *.tealiumiq.com *.liveperson.net *.googletagmanager.com *.hsbc.co.uk *.hsbc.com.hk *.doubleclick.net *.googleadservices.com *.lpsnmedia.net *.optimizely.com *.facebook.net *.google.com *.gstatic.com *.appdynamics.com *.googleapis.com *.awswaf.com *.analytics.yahoo.com vjs.zencdn.net players.brightcove.net *.ads-twitter.com *.hsbc.ae *.hsbc.com.hk:* *.walkme.com bat.bing.com *.recaptcha.net *.gstatic.cn *.biocatch.com s.yimg.com tpc.googlesyndication.com connect.facebook.net tags.tiqcdn.com www.google.com.hk www.googletagmanager.com cdn.appdynamics.com www.google-analytics.com cdn-assets-prod.s3.amazonaws.com *.callsign.com *.brightcove.net *.g.doubleclick.net *.zencdn.net *.hsbc.com.cn *.sc.omtrdc.net *.google-analytics.com ssl.google-analytics.com googleads.g.doubleclick.net www.google.com *.v.liveperson.net *.googlesyndication.com; img-src data: * blob: android-webview-video-poster: android-webview:; connect-src 'self' *.tiqcdn.com *.tealiumiq.com *.hsbc.com.hk *.eum-appdynamics.com *.optimizely.com wss://*.liveperson.net *.cloud.hsbc *.awswaf.com *.analytics.yahoo.com players.brightcove.net edge.api.brightcove.com *.googleapis.com *.hsbc.ae *.omtrdc.net *.demdex.net *.hsbc.co.om *.brightcovecdn.com *.hsbc.com.hk:* *.walkme.com bat.bing.com *.biocatch.com rbwm-api.us.hsbc.com rbwm-api.hsbc.co.uk rbwm-api.hsbc.com.hk ad.doubleclick.net www.facebook.com maps.googleapis.com *.siteintercept.qualtrics.com adservice.google.com manifest.prod.boltdns.net www.google.com http://127.0.0.1:5000 http://127.0.0.1:5000/* translate.googleapis.com www.google-analytics.com www.googletagmanager.com www.google.com.hk connect.facebook.net lptag.liveperson.net accdn.lpsnmedia.net *.v.liveperson.net s.yimg.com cdn.appdynamics.com cdn-assets-prod.s3.amazonaws.com brightcove.hs.llnwd.net *.akamaihd.net *.callsign.com *.googletagmanager.com *.facebook.com *.brightcove.com *.boltdns.net *.hs.llnwd.net *.hsbc.com.cn t.co analytics.twitter.com *.api.brightcove.com analytics.google.com *.google-analytics.com *.google.com.hk *.g.doubleclick.net *.analytics.google.com *.doubleclick.net; frame-src 'self' blob: *.lpsnmedia.net *.optimizely.com *.liveperson.net *.google.com *.doubleclick.net *.analytics.yahoo.com players.brightcove.net *.walkme.com *.googletagmanager.com *.recaptcha.net www.facebook.com tpc.googlesyndication.com connect.facebook.net gateway.zscalertwo.net gateway.zscloud.net sts-aad.auth.hsbc.com lpcdn.lpsnmedia.net 8694241.fls.doubleclick.net *.online-metrix.net *.hsbc.com.hk *.demdex.net *.id.opendns.com *.tiqcdn.com *.facebook.com bid.g.doubleclick.net cdntm.hsbc.com.hk; frame-ancestors 'self' *.liveperson.net www.hsbc.com.hk *.hsbc.com.hk; font-src 'self' data: *.hsbc.com.hk *.gstatic.com *.walkme.com fonts.gstatic.com cdn.jsdelivr.net at.alicdn.com *.avast.com *.alicdn.com; worker-src 'self' blob: *.walkme.com; style-src 'self' 'unsafe-inline' *.hsbc.com.hk *.googleapis.com players.brightcove.net *.walkme.com *.askus.hsbc.co.uk; object-src 'self' blob:; child-src 'self' blob:; media-src 'self' blob: *.boltdns.net *.media.brightcove.com *.llnw.net *.llnwd.net *.akafms.net *.akamaihd.net *.cf.brightcove.com *.brightcovecdn.com lpcdn.lpsnmedia.net manifest.prod.boltdns.net ssl.gstatic.com players.brightcove.net *.hsbc.com.hk *.lpsnmedia.net; manifest-src 'self'; upgrade-insecure-requests ; report-uri /csp/report;

cache-control

max-age=60, s-maxage=60

s

dispatcher3apsoutheast1-b80

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

accept-ranges

bytes

content-length

928

x-xss-protection

1; mode=block

x-amz-cf-pop

FRA56-C2

server

Apache

Referer

https://www.hsbc.com.hk/en-hk/misc/terms-of-use/

X-Requested-With

XMLHttpRequest

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Accept

*/*

ADRUM

isAjax:true

content-encoding

gzip

x-content-type-options

nosniff

x-cache

Miss from cloudfront

x-amz-cf-id

wr9tRq5seRPV2RiSMJngl39HlVxh0geHkbQymwnNjIltNyqBici3PQ==

date

Wed, 20 Nov 2024 22:33:10 GMT

content-type

text/html; charset=utf-8

vary

Accept-Encoding

last-modified

Wed, 20 Nov 2024 12:59:29 GMT

x-frame-options

SAMEORIGIN

strict-transport-security

max-age=31536000; includeSubdomains

content-security-policy

default-src 'self' *.hsbc.com.hk *.mastercard.com.au *.demdex.net *.lpsnmedia.net *.liveperson.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.tiqcdn.com *.tealiumiq.com *.liveperson.net *.googletagmanager.com *.hsbc.co.uk *.hsbc.com.hk *.doubleclick.net *.googleadservices.com *.lpsnmedia.net *.optimizely.com *.facebook.net *.google.com *.gstatic.com *.appdynamics.com *.googleapis.com *.awswaf.com *.analytics.yahoo.com vjs.zencdn.net players.brightcove.net *.ads-twitter.com *.hsbc.ae *.hsbc.com.hk:* *.walkme.com bat.bing.com *.recaptcha.net *.gstatic.cn *.biocatch.com s.yimg.com tpc.googlesyndication.com connect.facebook.net tags.tiqcdn.com www.google.com.hk www.googletagmanager.com cdn.appdynamics.com www.google-analytics.com cdn-assets-prod.s3.amazonaws.com *.callsign.com *.brightcove.net *.g.doubleclick.net *.zencdn.net *.hsbc.com.cn *.sc.omtrdc.net *.google-analytics.com ssl.google-analytics.com googleads.g.doubleclick.net www.google.com *.v.liveperson.net *.googlesyndication.com; img-src data: * blob: android-webview-video-poster: android-webview:; connect-src 'self' *.tiqcdn.com *.tealiumiq.com *.hsbc.com.hk *.eum-appdynamics.com *.optimizely.com wss://*.liveperson.net *.cloud.hsbc *.awswaf.com *.analytics.yahoo.com players.brightcove.net edge.api.brightcove.com *.googleapis.com *.hsbc.ae *.omtrdc.net *.demdex.net *.hsbc.co.om *.brightcovecdn.com *.hsbc.com.hk:* *.walkme.com bat.bing.com *.biocatch.com rbwm-api.us.hsbc.com rbwm-api.hsbc.co.uk rbwm-api.hsbc.com.hk ad.doubleclick.net www.facebook.com maps.googleapis.com *.siteintercept.qualtrics.com adservice.google.com manifest.prod.boltdns.net www.google.com http://127.0.0.1:5000 http://127.0.0.1:5000/* translate.googleapis.com www.google-analytics.com www.googletagmanager.com www.google.com.hk connect.facebook.net lptag.liveperson.net accdn.lpsnmedia.net *.v.liveperson.net s.yimg.com cdn.appdynamics.com cdn-assets-prod.s3.amazonaws.com brightcove.hs.llnwd.net *.akamaihd.net *.callsign.com *.googletagmanager.com *.facebook.com *.brightcove.com *.boltdns.net *.hs.llnwd.net *.hsbc.com.cn t.co analytics.twitter.com *.api.brightcove.com analytics.google.com *.google-analytics.com *.google.com.hk *.g.doubleclick.net *.analytics.google.com *.doubleclick.net; frame-src 'self' blob: *.lpsnmedia.net *.optimizely.com *.liveperson.net *.google.com *.doubleclick.net *.analytics.yahoo.com players.brightcove.net *.walkme.com *.googletagmanager.com *.recaptcha.net www.facebook.com tpc.googlesyndication.com connect.facebook.net gateway.zscalertwo.net gateway.zscloud.net sts-aad.auth.hsbc.com lpcdn.lpsnmedia.net 8694241.fls.doubleclick.net *.online-metrix.net *.hsbc.com.hk *.demdex.net *.id.opendns.com *.tiqcdn.com *.facebook.com bid.g.doubleclick.net cdntm.hsbc.com.hk; frame-ancestors 'self' *.liveperson.net www.hsbc.com.hk *.hsbc.com.hk; font-src 'self' data: *.hsbc.com.hk *.gstatic.com *.walkme.com fonts.gstatic.com cdn.jsdelivr.net at.alicdn.com *.avast.com *.alicdn.com; worker-src 'self' blob: *.walkme.com; style-src 'self' 'unsafe-inline' *.hsbc.com.hk *.googleapis.com players.brightcove.net *.walkme.com *.askus.hsbc.co.uk; object-src 'self' blob:; child-src 'self' blob:; media-src 'self' blob: *.boltdns.net *.media.brightcove.com *.llnw.net *.llnwd.net *.akafms.net *.akamaihd.net *.cf.brightcove.com *.brightcovecdn.com lpcdn.lpsnmedia.net manifest.prod.boltdns.net ssl.gstatic.com players.brightcove.net *.hsbc.com.hk *.lpsnmedia.net; manifest-src 'self'; upgrade-insecure-requests ; report-uri /csp/report;

cache-control

max-age=60, s-maxage=60

s

dispatcher2apsoutheast1-b80

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

accept-ranges

bytes

content-length

1287

x-xss-protection

1; mode=block

x-amz-cf-pop

FRA56-C2

server

Apache

Referer

https://www.hsbc.com.hk/en-hk/misc/terms-of-use/

X-Requested-With

XMLHttpRequest

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Accept

*/*

ADRUM

isAjax:true

content-encoding

gzip

x-content-type-options

nosniff

server-timing

cdn-upstream-layer;desc="Origin Shield",cdn-upstream-dns;dur=0,cdn-upstream-connect;dur=0,cdn-upstream-fbl;dur=2,cdn-cache-miss,cdn-pop;desc="FRA56-C2",cdn-rid;desc="-Q538PyMDjEulZoW9wUbAhsc4ByymFtGWmDKDmvt6MfYfSfmXQXtWw==",cdn-downstream-fbl;dur=221

x-cache

Miss from cloudfront

x-amz-cf-id

-Q538PyMDjEulZoW9wUbAhsc4ByymFtGWmDKDmvt6MfYfSfmXQXtWw==

date

Wed, 20 Nov 2024 22:33:10 GMT

content-type

text/html; charset=utf-8

vary

Accept-Encoding

last-modified

Wed, 20 Nov 2024 12:59:21 GMT

x-frame-options

SAMEORIGIN

strict-transport-security

max-age=31536000; includeSubdomains

content-security-policy

default-src 'self' *.hsbc.com.hk *.mastercard.com.au *.demdex.net *.lpsnmedia.net *.liveperson.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.tiqcdn.com *.tealiumiq.com *.liveperson.net *.googletagmanager.com *.hsbc.co.uk *.hsbc.com.hk *.doubleclick.net *.googleadservices.com *.lpsnmedia.net *.optimizely.com *.facebook.net *.google.com *.gstatic.com *.appdynamics.com *.googleapis.com *.awswaf.com *.analytics.yahoo.com vjs.zencdn.net players.brightcove.net *.ads-twitter.com *.hsbc.ae *.hsbc.com.hk:* *.walkme.com bat.bing.com *.recaptcha.net *.gstatic.cn *.biocatch.com s.yimg.com tpc.googlesyndication.com connect.facebook.net tags.tiqcdn.com www.google.com.hk www.googletagmanager.com cdn.appdynamics.com www.google-analytics.com cdn-assets-prod.s3.amazonaws.com *.callsign.com *.brightcove.net *.g.doubleclick.net *.zencdn.net *.hsbc.com.cn *.sc.omtrdc.net *.google-analytics.com ssl.google-analytics.com googleads.g.doubleclick.net www.google.com *.v.liveperson.net *.googlesyndication.com; img-src data: * blob: android-webview-video-poster: android-webview:; connect-src 'self' *.tiqcdn.com *.tealiumiq.com *.hsbc.com.hk *.eum-appdynamics.com *.optimizely.com wss://*.liveperson.net *.cloud.hsbc *.awswaf.com *.analytics.yahoo.com players.brightcove.net edge.api.brightcove.com *.googleapis.com *.hsbc.ae *.omtrdc.net *.demdex.net *.hsbc.co.om *.brightcovecdn.com *.hsbc.com.hk:* *.walkme.com bat.bing.com *.biocatch.com rbwm-api.us.hsbc.com rbwm-api.hsbc.co.uk rbwm-api.hsbc.com.hk ad.doubleclick.net www.facebook.com maps.googleapis.com *.siteintercept.qualtrics.com adservice.google.com manifest.prod.boltdns.net www.google.com http://127.0.0.1:5000 http://127.0.0.1:5000/* translate.googleapis.com www.google-analytics.com www.googletagmanager.com www.google.com.hk connect.facebook.net lptag.liveperson.net accdn.lpsnmedia.net *.v.liveperson.net s.yimg.com cdn.appdynamics.com cdn-assets-prod.s3.amazonaws.com brightcove.hs.llnwd.net *.akamaihd.net *.callsign.com *.googletagmanager.com *.facebook.com *.brightcove.com *.boltdns.net *.hs.llnwd.net *.hsbc.com.cn t.co analytics.twitter.com *.api.brightcove.com analytics.google.com *.google-analytics.com *.google.com.hk *.g.doubleclick.net *.analytics.google.com *.doubleclick.net; frame-src 'self' blob: *.lpsnmedia.net *.optimizely.com *.liveperson.net *.google.com *.doubleclick.net *.analytics.yahoo.com players.brightcove.net *.walkme.com *.googletagmanager.com *.recaptcha.net www.facebook.com tpc.googlesyndication.com connect.facebook.net gateway.zscalertwo.net gateway.zscloud.net sts-aad.auth.hsbc.com lpcdn.lpsnmedia.net 8694241.fls.doubleclick.net *.online-metrix.net *.hsbc.com.hk *.demdex.net *.id.opendns.com *.tiqcdn.com *.facebook.com bid.g.doubleclick.net cdntm.hsbc.com.hk; frame-ancestors 'self' *.liveperson.net www.hsbc.com.hk *.hsbc.com.hk; font-src 'self' data: *.hsbc.com.hk *.gstatic.com *.walkme.com fonts.gstatic.com cdn.jsdelivr.net at.alicdn.com *.avast.com *.alicdn.com; worker-src 'self' blob: *.walkme.com; style-src 'self' 'unsafe-inline' *.hsbc.com.hk *.googleapis.com players.brightcove.net *.walkme.com *.askus.hsbc.co.uk; object-src 'self' blob:; child-src 'self' blob:; media-src 'self' blob: *.boltdns.net *.media.brightcove.com *.llnw.net *.llnwd.net *.akafms.net *.akamaihd.net *.cf.brightcove.com *.brightcovecdn.com lpcdn.lpsnmedia.net manifest.prod.boltdns.net ssl.gstatic.com players.brightcove.net *.hsbc.com.hk *.lpsnmedia.net; manifest-src 'self'; upgrade-insecure-requests ; report-uri /csp/report;

cache-control

max-age=60, s-maxage=60

s

dispatcher3apsoutheast1-b80

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

accept-ranges

bytes

content-length

1570

x-xss-protection

1; mode=block

x-amz-cf-pop

FRA56-C2

server

Apache

Referer

https://www.hsbc.com.hk/en-hk/misc/terms-of-use/

X-Requested-With

XMLHttpRequest

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Accept

*/*

ADRUM

isAjax:true

content-encoding

gzip

x-content-type-options

nosniff

x-cache

Miss from cloudfront

x-amz-cf-id

OLzj1ukQsPlsXUH7Oef0DvBaaDLjlzvYeWTwELKQsgDoE6kkM7FIcQ==

date

Wed, 20 Nov 2024 22:33:10 GMT

content-type

text/html; charset=utf-8

vary

Accept-Encoding

last-modified

Wed, 20 Nov 2024 12:59:27 GMT

x-frame-options

SAMEORIGIN

strict-transport-security

max-age=31536000; includeSubdomains

content-security-policy

default-src 'self' *.hsbc.com.hk *.mastercard.com.au *.demdex.net *.lpsnmedia.net *.liveperson.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.tiqcdn.com *.tealiumiq.com *.liveperson.net *.googletagmanager.com *.hsbc.co.uk *.hsbc.com.hk *.doubleclick.net *.googleadservices.com *.lpsnmedia.net *.optimizely.com *.facebook.net *.google.com *.gstatic.com *.appdynamics.com *.googleapis.com *.awswaf.com *.analytics.yahoo.com vjs.zencdn.net players.brightcove.net *.ads-twitter.com *.hsbc.ae *.hsbc.com.hk:* *.walkme.com bat.bing.com *.recaptcha.net *.gstatic.cn *.biocatch.com s.yimg.com tpc.googlesyndication.com connect.facebook.net tags.tiqcdn.com www.google.com.hk www.googletagmanager.com cdn.appdynamics.com www.google-analytics.com cdn-assets-prod.s3.amazonaws.com *.callsign.com *.brightcove.net *.g.doubleclick.net *.zencdn.net *.hsbc.com.cn *.sc.omtrdc.net *.google-analytics.com ssl.google-analytics.com googleads.g.doubleclick.net www.google.com *.v.liveperson.net *.googlesyndication.com; img-src data: * blob: android-webview-video-poster: android-webview:; connect-src 'self' *.tiqcdn.com *.tealiumiq.com *.hsbc.com.hk *.eum-appdynamics.com *.optimizely.com wss://*.liveperson.net *.cloud.hsbc *.awswaf.com *.analytics.yahoo.com players.brightcove.net edge.api.brightcove.com *.googleapis.com *.hsbc.ae *.omtrdc.net *.demdex.net *.hsbc.co.om *.brightcovecdn.com *.hsbc.com.hk:* *.walkme.com bat.bing.com *.biocatch.com rbwm-api.us.hsbc.com rbwm-api.hsbc.co.uk rbwm-api.hsbc.com.hk ad.doubleclick.net www.facebook.com maps.googleapis.com *.siteintercept.qualtrics.com adservice.google.com manifest.prod.boltdns.net www.google.com http://127.0.0.1:5000 http://127.0.0.1:5000/* translate.googleapis.com www.google-analytics.com www.googletagmanager.com www.google.com.hk connect.facebook.net lptag.liveperson.net accdn.lpsnmedia.net *.v.liveperson.net s.yimg.com cdn.appdynamics.com cdn-assets-prod.s3.amazonaws.com brightcove.hs.llnwd.net *.akamaihd.net *.callsign.com *.googletagmanager.com *.facebook.com *.brightcove.com *.boltdns.net *.hs.llnwd.net *.hsbc.com.cn t.co analytics.twitter.com *.api.brightcove.com analytics.google.com *.google-analytics.com *.google.com.hk *.g.doubleclick.net *.analytics.google.com *.doubleclick.net; frame-src 'self' blob: *.lpsnmedia.net *.optimizely.com *.liveperson.net *.google.com *.doubleclick.net *.analytics.yahoo.com players.brightcove.net *.walkme.com *.googletagmanager.com *.recaptcha.net www.facebook.com tpc.googlesyndication.com connect.facebook.net gateway.zscalertwo.net gateway.zscloud.net sts-aad.auth.hsbc.com lpcdn.lpsnmedia.net 8694241.fls.doubleclick.net *.online-metrix.net *.hsbc.com.hk *.demdex.net *.id.opendns.com *.tiqcdn.com *.facebook.com bid.g.doubleclick.net cdntm.hsbc.com.hk; frame-ancestors 'self' *.liveperson.net www.hsbc.com.hk *.hsbc.com.hk; font-src 'self' data: *.hsbc.com.hk *.gstatic.com *.walkme.com fonts.gstatic.com cdn.jsdelivr.net at.alicdn.com *.avast.com *.alicdn.com; worker-src 'self' blob: *.walkme.com; style-src 'self' 'unsafe-inline' *.hsbc.com.hk *.googleapis.com players.brightcove.net *.walkme.com *.askus.hsbc.co.uk; object-src 'self' blob:; child-src 'self' blob:; media-src 'self' blob: *.boltdns.net *.media.brightcove.com *.llnw.net *.llnwd.net *.akafms.net *.akamaihd.net *.cf.brightcove.com *.brightcovecdn.com lpcdn.lpsnmedia.net manifest.prod.boltdns.net ssl.gstatic.com players.brightcove.net *.hsbc.com.hk *.lpsnmedia.net; manifest-src 'self'; upgrade-insecure-requests ; report-uri /csp/report;

cache-control

max-age=60, s-maxage=60

s

dispatcher3apsoutheast1-b80

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

accept-ranges

bytes

content-length

1605

x-xss-protection

1; mode=block

x-amz-cf-pop

FRA56-C2

server

Apache

Referer

https://www.hsbc.com.hk/en-hk/misc/terms-of-use/

X-Requested-With

XMLHttpRequest

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Accept

*/*

ADRUM

isAjax:true

content-encoding

gzip

x-content-type-options

nosniff

x-cache

Miss from cloudfront

x-amz-cf-id

jV0jLP4UCyPrGULaf0PIWu5vYfzZ88NNjD69j9jGI95GNgfDSQCciQ==

date

Wed, 20 Nov 2024 22:33:10 GMT

content-type

text/html; charset=utf-8

vary

Accept-Encoding

last-modified

Wed, 20 Nov 2024 12:59:20 GMT

x-frame-options

SAMEORIGIN

strict-transport-security

max-age=31536000; includeSubdomains

content-security-policy

default-src 'self' *.hsbc.com.hk *.mastercard.com.au *.demdex.net *.lpsnmedia.net *.liveperson.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.tiqcdn.com *.tealiumiq.com *.liveperson.net *.googletagmanager.com *.hsbc.co.uk *.hsbc.com.hk *.doubleclick.net *.googleadservices.com *.lpsnmedia.net *.optimizely.com *.facebook.net *.google.com *.gstatic.com *.appdynamics.com *.googleapis.com *.awswaf.com *.analytics.yahoo.com vjs.zencdn.net players.brightcove.net *.ads-twitter.com *.hsbc.ae *.hsbc.com.hk:* *.walkme.com bat.bing.com *.recaptcha.net *.gstatic.cn *.biocatch.com s.yimg.com tpc.googlesyndication.com connect.facebook.net tags.tiqcdn.com www.google.com.hk www.googletagmanager.com cdn.appdynamics.com www.google-analytics.com cdn-assets-prod.s3.amazonaws.com *.callsign.com *.brightcove.net *.g.doubleclick.net *.zencdn.net *.hsbc.com.cn *.sc.omtrdc.net *.google-analytics.com ssl.google-analytics.com googleads.g.doubleclick.net www.google.com *.v.liveperson.net *.googlesyndication.com; img-src data: * blob: android-webview-video-poster: android-webview:; connect-src 'self' *.tiqcdn.com *.tealiumiq.com *.hsbc.com.hk *.eum-appdynamics.com *.optimizely.com wss://*.liveperson.net *.cloud.hsbc *.awswaf.com *.analytics.yahoo.com players.brightcove.net edge.api.brightcove.com *.googleapis.com *.hsbc.ae *.omtrdc.net *.demdex.net *.hsbc.co.om *.brightcovecdn.com *.hsbc.com.hk:* *.walkme.com bat.bing.com *.biocatch.com rbwm-api.us.hsbc.com rbwm-api.hsbc.co.uk rbwm-api.hsbc.com.hk ad.doubleclick.net www.facebook.com maps.googleapis.com *.siteintercept.qualtrics.com adservice.google.com manifest.prod.boltdns.net www.google.com http://127.0.0.1:5000 http://127.0.0.1:5000/* translate.googleapis.com www.google-analytics.com www.googletagmanager.com www.google.com.hk connect.facebook.net lptag.liveperson.net accdn.lpsnmedia.net *.v.liveperson.net s.yimg.com cdn.appdynamics.com cdn-assets-prod.s3.amazonaws.com brightcove.hs.llnwd.net *.akamaihd.net *.callsign.com *.googletagmanager.com *.facebook.com *.brightcove.com *.boltdns.net *.hs.llnwd.net *.hsbc.com.cn t.co analytics.twitter.com *.api.brightcove.com analytics.google.com *.google-analytics.com *.google.com.hk *.g.doubleclick.net *.analytics.google.com *.doubleclick.net; frame-src 'self' blob: *.lpsnmedia.net *.optimizely.com *.liveperson.net *.google.com *.doubleclick.net *.analytics.yahoo.com players.brightcove.net *.walkme.com *.googletagmanager.com *.recaptcha.net www.facebook.com tpc.googlesyndication.com connect.facebook.net gateway.zscalertwo.net gateway.zscloud.net sts-aad.auth.hsbc.com lpcdn.lpsnmedia.net 8694241.fls.doubleclick.net *.online-metrix.net *.hsbc.com.hk *.demdex.net *.id.opendns.com *.tiqcdn.com *.facebook.com bid.g.doubleclick.net cdntm.hsbc.com.hk; frame-ancestors 'self' *.liveperson.net www.hsbc.com.hk *.hsbc.com.hk; font-src 'self' data: *.hsbc.com.hk *.gstatic.com *.walkme.com fonts.gstatic.com cdn.jsdelivr.net at.alicdn.com *.avast.com *.alicdn.com; worker-src 'self' blob: *.walkme.com; style-src 'self' 'unsafe-inline' *.hsbc.com.hk *.googleapis.com players.brightcove.net *.walkme.com *.askus.hsbc.co.uk; object-src 'self' blob:; child-src 'self' blob:; media-src 'self' blob: *.boltdns.net *.media.brightcove.com *.llnw.net *.llnwd.net *.akafms.net *.akamaihd.net *.cf.brightcove.com *.brightcovecdn.com lpcdn.lpsnmedia.net manifest.prod.boltdns.net ssl.gstatic.com players.brightcove.net *.hsbc.com.hk *.lpsnmedia.net; manifest-src 'self'; upgrade-insecure-requests ; report-uri /csp/report;

cache-control

max-age=60, s-maxage=60

s

dispatcher3apeast1-b80

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

accept-ranges

bytes

content-length

1089

x-xss-protection

1; mode=block

x-amz-cf-pop

FRA56-C2

server

Apache

Referer

https://www.hsbc.com.hk/en-hk/misc/terms-of-use/

X-Requested-With

XMLHttpRequest

User-Agent

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Accept

*/*

ADRUM

isAjax:true

content-encoding

gzip

x-content-type-options

nosniff

server-timing

cdn-upstream-layer;desc="Origin Shield",cdn-upstream-dns;dur=0,cdn-upstream-connect;dur=69,cdn-upstream-fbl;dur=106,cdn-cache-miss,cdn-pop;desc="FRA56-C2",cdn-rid;desc="dRVU5MURNuoUH1AfKXLMscGWRF_YAp-Oj4K5LSdoWZVEeRWAZWwLqg==",cdn-downstream-fbl;dur=315

x-cache

Miss from cloudfront

x-amz-cf-id

dRVU5MURNuoUH1AfKXLMscGWRF_YAp-Oj4K5LSdoWZVEeRWAZWwLqg==

date

Wed, 20 Nov 2024 22:33:10 GMT

content-type

text/html; charset=utf-8

vary

Accept-Encoding

last-modified

Wed, 20 Nov 2024 12:59:29 GMT

x-frame-options

SAMEORIGIN

strict-transport-security

max-age=31536000; includeSubdomains

content-security-policy

default-src 'self' *.hsbc.com.hk *.mastercard.com.au *.demdex.net *.lpsnmedia.net *.liveperson.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.tiqcdn.com *.tealiumiq.com *.liveperson.net *.googletagmanager.com *.hsbc.co.uk *.hsbc.com.hk *.doubleclick.net *.googleadservices.com *.lpsnmedia.net *.optimizely.com *.facebook.net *.google.com *.gstatic.com *.appdynamics.com *.googleapis.com *.awswaf.com *.analytics.yahoo.com vjs.zencdn.net players.brightcove.net *.ads-twitter.com *.hsbc.ae *.hsbc.com.hk:* *.walkme.com bat.bing.com *.recaptcha.net *.gstatic.cn *.biocatch.com s.yimg.com tpc.googlesyndication.com connect.facebook.net tags.tiqcdn.com www.google.com.hk www.googletagmanager.com cdn.appdynamics.com www.google-analytics.com cdn-assets-prod.s3.amazonaws.com *.callsign.com *.brightcove.net *.g.doubleclick.net *.zencdn.net *.hsbc.com.cn *.sc.omtrdc.net *.google-analytics.com ssl.google-analytics.com googleads.g.doubleclick.net www.google.com *.v.liveperson.net *.googlesyndication.com; img-src data: * blob: android-webview-video-poster: android-webview:; connect-src 'self' *.tiqcdn.com *.tealiumiq.com *.hsbc.com.hk *.eum-appdynamics.com *.optimizely.com wss://*.liveperson.net *.cloud.hsbc *.awswaf.com *.analytics.yahoo.com players.brightcove.net edge.api.brightcove.com *.googleapis.com *.hsbc.ae *.omtrdc.net *.demdex.net *.hsbc.co.om *.brightcovecdn.com *.hsbc.com.hk:* *.walkme.com bat.bing.com *.biocatch.com rbwm-api.us.hsbc.com rbwm-api.hsbc.co.uk rbwm-api.hsbc.com.hk ad.doubleclick.net www.facebook.com maps.googleapis.com *.siteintercept.qualtrics.com adservice.google.com manifest.prod.boltdns.net www.google.com http://127.0.0.1:5000 http://127.0.0.1:5000/* translate.googleapis.com www.google-analytics.com www.googletagmanager.com www.google.com.hk connect.facebook.net lptag.liveperson.net accdn.lpsnmedia.net *.v.liveperson.net s.yimg.com cdn.appdynamics.com cdn-assets-prod.s3.amazonaws.com brightcove.hs.llnwd.net *.akamaihd.net *.callsign.com *.googletagmanager.com *.facebook.com *.brightcove.com *.boltdns.net *.hs.llnwd.net *.hsbc.com.cn t.co analytics.twitter.com *.api.brightcove.com analytics.google.com *.google-analytics.com *.google.com.hk *.g.doubleclick.net *.analytics.google.com *.doubleclick.net; frame-src 'self' blob: *.lpsnmedia.net *.optimizely.com *.liveperson.net *.google.com *.doubleclick.net *.analytics.yahoo.com players.brightcove.net *.walkme.com *.googletagmanager.com *.recaptcha.net www.facebook.com tpc.googlesyndication.com connect.facebook.net gateway.zscalertwo.net gateway.zscloud.net sts-aad.auth.hsbc.com lpcdn.lpsnmedia.net 8694241.fls.doubleclick.net *.online-metrix.net *.hsbc.com.hk *.demdex.net *.id.opendns.com *.tiqcdn.com *.facebook.com bid.g.doubleclick.net cdntm.hsbc.com.hk; frame-ancestors 'self' *.liveperson.net www.hsbc.com.hk *.hsbc.com.hk; font-src 'self' data: *.hsbc.com.hk *.gstatic.com *.walkme.com fonts.gstatic.com cdn.jsdelivr.net at.alicdn.com *.avast.com *.alicdn.com; worker-src 'self' blob: *.walkme.com; style-src 'self' 'unsafe-inline' *.hsbc.com.hk *.googleapis.com players.brightcove.net *.walkme.com *.askus.hsbc.co.uk; object-src 'self' blob:; child-src 'self' blob:; media-src 'self' blob: *.boltdns.net *.media.brightcove.com *.llnw.net *.llnwd.net *.akafms.net *.akamaihd.net *.cf.brightcove.com *.brightcovecdn.com lpcdn.lpsnmedia.net manifest.prod.boltdns.net ssl.gstatic.com players.brightcove.net *.hsbc.com.hk *.lpsnmedia.net; manifest-src 'self'; upgrade-insecure-requests ; report-uri /csp/report;

cache-control

max-age=60, s-maxage=60

s

dispatcher3apeast1-b80

via

1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)

accept-ranges

bytes

content-length

624

x-xss-protection

1; mode=block

x-amz-cf-pop

FRA56-C2

server

Apache