urlscan.io logo urlscan.io
SecurityTrails logo

dco-sg-cc-uat.lp.hsbc.com.hk Open in urlscan Pro
203.112.89.18  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://dco-sg-cc-uat.lp.hsbc.com.hk/
Effective URL: https://dco-sg-cc-uat.lp.hsbc.com.hk/security/?targetAuthLevel=40&destinationURL=%27&__EntryPageParams=returnUrl:/originations/etb/iao
Submission Tags: @phishunt_io
Submission: On January 12 via api from ES
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 13 HTTP transactions. The main IP is 203.112.89.18, located in Central, Hong Kong and belongs to HSBC-HK-AS HSBC HongKong, HK. The main domain is dco-sg-cc-uat.lp.hsbc.com.hk.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on February 19th 2020. Valid for: a year.
This is the only time dco-sg-cc-uat.lp.hsbc.com.hk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
6 203.112.89.18 9221 (HSBC-HK-A...)
7 23.37.38.214 16625 (AKAMAI-AS)
13 3
Apex Domain
Subdomains		 Transfer
7 tiqcdn.com
tags.tiqcdn.com
86 KB
6 hsbc.com.hk
dco-sg-cc-uat.lp.hsbc.com.hk
405 KB
13 2
Domain Requested by
7 tags.tiqcdn.com dco-sg-cc-uat.lp.hsbc.com.hk
tags.tiqcdn.com
6 dco-sg-cc-uat.lp.hsbc.com.hk dco-sg-cc-uat.lp.hsbc.com.hk
13 2

This site contains no links.

Subject Issuer Validity Valid
dco-sg-cc-uat.lp.hsbc.com.hk
DigiCert SHA2 Extended Validation Server CA		 2020-02-19 -
2021-04-18		 a year crt.sh
*.tiqcdn.com
DigiCert SHA2 Secure Server CA		 2020-03-16 -
2021-06-15		 a year crt.sh

This page contains 1 frames:

Primary Page: https://dco-sg-cc-uat.lp.hsbc.com.hk/security/?targetAuthLevel=40&destinationURL=%27&__EntryPageParams=returnUrl:/originations/etb/iao
Frame ID: DDD40A994A3EA487527DF31BD87671B4
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://dco-sg-cc-uat.lp.hsbc.com.hk/ Page URL
  2. https://dco-sg-cc-uat.lp.hsbc.com.hk/security/?targetAuthLevel=40&destinationURL=%27&__EntryPageParams=returnUrl:... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

532 kB
Transfer

1487 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://dco-sg-cc-uat.lp.hsbc.com.hk/ Page URL
  2. https://dco-sg-cc-uat.lp.hsbc.com.hk/security/?targetAuthLevel=40&destinationURL=%27&__EntryPageParams=returnUrl:/originations/etb/iao Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Cookie set /
dco-sg-cc-uat.lp.hsbc.com.hk/ 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://dco-sg-cc-uat.lp.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
203.112.89.18 Central, Hong Kong, ASN9221 (HSBC-HK-AS HSBC HongKong, HK),
Reverse DNS
Software
Apache /
Resource Hash
e29bfcc9377718c6700aef3fa7b6837ab10db12f601d937fba225b4789fe9ebd
Security Headers
Name Value
Content-Security-Policy connect-src 'self' wss: https:; default-src 'self' blob: https:; font-src 'self' data:; frame-src 'self' https:; img-src 'self' data: blob: https:; media-src blob:; object-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' blob: https:; script-src-elem 'unsafe-inline' 'unsafe-eval' https:; style-src 'unsafe-inline' https:; style-src-elem 'unsafe-inline' https:; worker-src blob:;
Strict-Transport-Security max-age=16070400; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN DENY
X-Xss-Protection 0

Request headers

Host
dco-sg-cc-uat.lp.hsbc.com.hk
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 12 Jan 2021 04:18:01 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN DENY
Access-Control-Allow-Origin
*
Access-Control-Allow-Headers
*
Access-Control-Allow-Methods
*
Content-Security-Policy
connect-src 'self' wss: https:; default-src 'self' blob: https:; font-src 'self' data:; frame-src 'self' https:; img-src 'self' data: blob: https:; media-src blob:; object-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' blob: https:; script-src-elem 'unsafe-inline' 'unsafe-eval' https:; style-src 'unsafe-inline' https:; style-src-elem 'unsafe-inline' https:; worker-src blob:;
X-DNS-Prefetch-Control
off
Expect-CT
max-age=0
Strict-Transport-Security
max-age=16070400; includeSubDomains
X-Download-Options
noopen
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
none
Referrer-Policy
no-referrer
X-XSS-Protection
0
Content-Type
text/html; charset=utf-8
ETag
W/"8d4-ppKNn+1aJS5Wqc4es+ivjm1LkbA"
Vary
Accept-Encoding
Content-Encoding
gzip
set-cookie
_csrf=rw0JkKoEGaTIp5isP1gtkb_f; Path=/; HttpOnly; Secure
S
rproxy_hkg1vl1101_ia_sg
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Set-Cookie
LB_COOKIE_1=3617968650.60032.0000; path=/; Httponly; Secure
utag.sync.js
tags.tiqcdn.com/utag/hsbc/sg-rbwm-ib/qa/ 		1 KB
740 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/hsbc/sg-rbwm-ib/qa/utag.sync.js
Requested by
Host: dco-sg-cc-uat.lp.hsbc.com.hk
URL: https://dco-sg-cc-uat.lp.hsbc.com.hk/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.214 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-214.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
e2cbb4cd1c75c178e2bde1fc80d81f42be70cb93b0a7c1e59b203440997369a0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 12 Jan 2021 04:18:01 GMT
content-encoding
gzip
last-modified
Thu, 16 Jul 2020 16:25:19 GMT
server
AkamaiNetStorage
etag
"d80774e294733243c4bdc05a7221f266:1594916719.726285"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=300
accept-ranges
bytes
content-length
514
expires
Tue, 12 Jan 2021 04:23:01 GMT
main.c2136b15246ad712b376.css
dco-sg-cc-uat.lp.hsbc.com.hk/ 		250 KB
116 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://dco-sg-cc-uat.lp.hsbc.com.hk/main.c2136b15246ad712b376.css
Requested by
Host: dco-sg-cc-uat.lp.hsbc.com.hk
URL: https://dco-sg-cc-uat.lp.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
203.112.89.18 Central, Hong Kong, ASN9221 (HSBC-HK-AS HSBC HongKong, HK),
Reverse DNS
Software
Apache / Express
Resource Hash
a7f0337e7abcbd622cee23bab19c34b24ae1e0128996f7db6c496605f84d3205
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Origin
https://dco-sg-cc-uat.lp.hsbc.com.hk
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 12 Jan 2021 04:18:01 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Methods
*
Connection
Keep-Alive
Access-Control-Allow-Headers
*
Last-Modified
Mon, 11 Jan 2021 06:37:07 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
W/"3e8cc-176f0299a38"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=16070400; includeSubDomains
Content-Type
text/css; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=0
Accept-Ranges
bytes
S
rproxy_hkg1vl1101_ia_sg
Keep-Alive
timeout=5, max=100
main.c6c9790d2179d599a2f9.js
dco-sg-cc-uat.lp.hsbc.com.hk/ 		910 KB
273 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dco-sg-cc-uat.lp.hsbc.com.hk/main.c6c9790d2179d599a2f9.js
Requested by
Host: dco-sg-cc-uat.lp.hsbc.com.hk
URL: https://dco-sg-cc-uat.lp.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
203.112.89.18 Central, Hong Kong, ASN9221 (HSBC-HK-AS HSBC HongKong, HK),
Reverse DNS
Software
Apache / Express
Resource Hash
931881a64df3ccbd790c4b5bc6b5fce5c35498f9fdce3bda6476e1997e607080
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Origin
https://dco-sg-cc-uat.lp.hsbc.com.hk
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 12 Jan 2021 04:18:02 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Methods
*
Connection
Keep-Alive
Access-Control-Allow-Headers
*
Last-Modified
Mon, 11 Jan 2021 06:37:07 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
W/"e36ea-176f0299a38"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=16070400; includeSubDomains
Content-Type
application/javascript; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=0
Accept-Ranges
bytes
S
rproxy_hkg1vl1101_ia_sg
Keep-Alive
timeout=5, max=100
utag.js
tags.tiqcdn.com/utag/hsbc/sg-rbwm-ib/qa/ 		131 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/hsbc/sg-rbwm-ib/qa/utag.js
Requested by
Host: dco-sg-cc-uat.lp.hsbc.com.hk
URL: https://dco-sg-cc-uat.lp.hsbc.com.hk/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.214 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-214.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5aaf8620d4523c734823180e52df1c722c5606250e71e9471869f37fe5c11f7a

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 12 Jan 2021 04:18:02 GMT
content-encoding
gzip
last-modified
Thu, 16 Jul 2020 16:25:18 GMT
server
AkamaiNetStorage
etag
"897f26ae2e472cde849783ab5538b51a:1594916718.428961"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=300
accept-ranges
bytes
content-length
39349
expires
Tue, 12 Jan 2021 04:23:02 GMT
truncated
/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a3a59834fae8583a5fb9791490cae9a2ef067da1b2e6ccfcf229ec5ca29ca2ed

Request headers

Origin
https://dco-sg-cc-uat.lp.hsbc.com.hk
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
43a9665b03a307a6c8beff167ce4ea8fdbdc5f9631cabbb528601e977e748422

Request headers

Origin
https://dco-sg-cc-uat.lp.hsbc.com.hk
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
font/woff
f662d802fcd686a0c4af4106c3c172fa.png
dco-sg-cc-uat.lp.hsbc.com.hk/ 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dco-sg-cc-uat.lp.hsbc.com.hk/f662d802fcd686a0c4af4106c3c172fa.png
Requested by
Host: dco-sg-cc-uat.lp.hsbc.com.hk
URL: https://dco-sg-cc-uat.lp.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
203.112.89.18 Central, Hong Kong, ASN9221 (HSBC-HK-AS HSBC HongKong, HK),
Reverse DNS
Software
Apache / Express
Resource Hash
94231b544b8203ae56787cdc99131204f647771cd0da2658f42d0b7dfcb9fa02
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 12 Jan 2021 04:18:03 GMT
X-Content-Type-Options
nosniff
X-Powered-By
Express
Connection
Keep-Alive
Content-Length
10346
Access-Control-Allow-Headers
*
Last-Modified
Mon, 11 Jan 2021 06:37:07 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
W/"286a-176f0299a38"
Strict-Transport-Security
max-age=16070400; includeSubDomains
Access-Control-Allow-Methods
*
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=0
Accept-Ranges
bytes
S
rproxy_hkg1vl1101_ia_sg
Keep-Alive
timeout=5, max=100
eligibility
dco-sg-cc-uat.lp.hsbc.com.hk/api/etb/ 		136 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://dco-sg-cc-uat.lp.hsbc.com.hk/api/etb/eligibility
Requested by
Host: dco-sg-cc-uat.lp.hsbc.com.hk
URL: https://dco-sg-cc-uat.lp.hsbc.com.hk/main.c6c9790d2179d599a2f9.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
203.112.89.18 Central, Hong Kong, ASN9221 (HSBC-HK-AS HSBC HongKong, HK),
Reverse DNS
Software
Apache /
Resource Hash
07ff7903548898c3ca5d3c103da4cd4f389b2aee8a6c6dc136d11b94070814c3
Security Headers
Name Value
Content-Security-Policy connect-src 'self' wss: https:; default-src 'self' blob: https:; font-src 'self' data:; frame-src 'self' https:; img-src 'self' data: blob: https:; media-src blob:; object-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' blob: https:; script-src-elem 'unsafe-inline' 'unsafe-eval' https:; style-src 'unsafe-inline' https:; style-src-elem 'unsafe-inline' https:; worker-src blob:;
Strict-Transport-Security max-age=16070400; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, DENY
X-Xss-Protection 0

Request headers

Pragma
no-cache
X-HSBC-Chnl-CountryCode
SG
x-csrf-token
KqVcfZ1X-Q9-Ug0bqsSANsNJ9-0qULerW2Mw
X-HSBC-Channel-Id
OHI
ui-request-timestamp
2021-01-12T04:18:03.562Z
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
X-HSBC-Locale
en
Accept
application/json
cache-control
no-cache
X-HSBC-Chnl-Group-Member
HBSP
X-HSBC-Request-Correlation-Id
4a6b25f1-a6a6-465e-823a-79f6979dad8b
Referer
X-HSBC-Session-Correlation-Id
e00b7f1d-f5c2-47c2-b064-6cc8ff48e315
X-HSBC-Application-Type
ETB_IAO

Response headers

Date
Tue, 12 Jan 2021 04:18:03 GMT
X-Content-Type-Options
nosniff
Content-Type
application/json; charset=utf-8
X-Permitted-Cross-Domain-Policies
none
X-DNS-Prefetch-Control
off
Connection
Keep-Alive
Vary
Accept-Encoding
Content-Length
136
X-XSS-Protection
0
Access-Control-Allow-Headers
*
Referrer-Policy
no-referrer
Server
Apache
X-Frame-Options
SAMEORIGIN, DENY
ETag
W/"88-rGfhonO2AwenYRXRT+rQv77P6Cs"
Expect-CT
max-age=0
Strict-Transport-Security
max-age=16070400; includeSubDomains
Access-Control-Allow-Methods
*
X-Download-Options
noopen
Access-Control-Allow-Origin
*
Content-Security-Policy
connect-src 'self' wss: https:; default-src 'self' blob: https:; font-src 'self' data:; frame-src 'self' https:; img-src 'self' data: blob: https:; media-src blob:; object-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' blob: https:; script-src-elem 'unsafe-inline' 'unsafe-eval' https:; style-src 'unsafe-inline' https:; style-src-elem 'unsafe-inline' https:; worker-src blob:;
S
rproxy_hkg1vl1101_ia_sg
Keep-Alive
timeout=5, max=100
utag.v.js
tags.tiqcdn.com/utag/tiqapp/ 		2 B
243 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=hsbc/sg-rbwm-ib/202007161624&cb=1610425083586
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/hsbc/sg-rbwm-ib/qa/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.214 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-214.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 12 Jan 2021 04:18:03 GMT
content-encoding
gzip
last-modified
Thu, 14 Apr 2016 16:57:51 GMT
server
AkamaiNetStorage
etag
"7bc0ee636b3b83484fc3b9348863bd22:1460653071"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=600
accept-ranges
bytes
content-length
22
expires
Tue, 12 Jan 2021 04:28:03 GMT
utag.479.js
tags.tiqcdn.com/utag/hsbc/sg-rbwm-ib/qa/ 		76 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/hsbc/sg-rbwm-ib/qa/utag.479.js?utv=ut4.46.202002201317
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/hsbc/sg-rbwm-ib/qa/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.214 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-214.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
8a02e1c2db9413e52c0eaea46da281e9e84e5500c24f8590ef1253e608cdf1fc

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 12 Jan 2021 04:18:03 GMT
content-encoding
gzip
last-modified
Fri, 26 Jun 2020 03:17:25 GMT
server
AkamaiNetStorage
etag
"be37f82ee7632a2b1fa4ad80f9f606e5:1593141445.668816"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
25923
expires
Wed, 27 Jan 2021 04:18:03 GMT
utag.454.js
tags.tiqcdn.com/utag/hsbc/sg-rbwm-ib/qa/ 		43 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/hsbc/sg-rbwm-ib/qa/utag.454.js?utv=ut4.46.202004011513
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/hsbc/sg-rbwm-ib/qa/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.214 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-214.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
75f5aa0439e0891b52a34c9b7b507d70606cfc3f5f194fc3284419fcdf6dffda

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 12 Jan 2021 04:18:03 GMT
content-encoding
gzip
last-modified
Fri, 26 Jun 2020 03:17:20 GMT
server
AkamaiNetStorage
etag
"54b2939f119a0f9d45b249d7bcc22248:1593141440.077495"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
12845
expires
Wed, 27 Jan 2021 04:18:03 GMT
utag.514.js
tags.tiqcdn.com/utag/hsbc/sg-rbwm-ib/qa/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/hsbc/sg-rbwm-ib/qa/utag.514.js?utv=ut4.46.202006260317
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/hsbc/sg-rbwm-ib/qa/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.214 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-214.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
03a0c475a64549d47b8a9e1ad54716236dcfe8feb441951f2a223a43be3c42f6

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 12 Jan 2021 04:18:03 GMT
content-encoding
gzip
last-modified
Fri, 26 Jun 2020 03:17:20 GMT
server
AkamaiNetStorage
etag
"232aae9d4b0cb9c3ba018323345486e7:1593141440.685568"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
2903
expires
Wed, 27 Jan 2021 04:18:03 GMT
utag.519.js
tags.tiqcdn.com/utag/hsbc/sg-rbwm-ib/qa/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/hsbc/sg-rbwm-ib/qa/utag.519.js?utv=ut4.46.202007161413
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/hsbc/sg-rbwm-ib/qa/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.214 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-214.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
b18ab2ed9b0bc045539f1d939f945060d52bef2adc27e27ee6d3db28257ed5db

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 12 Jan 2021 04:18:03 GMT
content-encoding
gzip
last-modified
Thu, 16 Jul 2020 14:14:12 GMT
server
AkamaiNetStorage
etag
"2dfa337ef50208f61e083a570fd868a7:1594908852.75415"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
4645
expires
Wed, 27 Jan 2021 04:18:03 GMT
Primary Request /
dco-sg-cc-uat.lp.hsbc.com.hk/security/ 		148 B
858 B 		Document
General
Check archive.org
Download Go to
Full URL
https://dco-sg-cc-uat.lp.hsbc.com.hk/security/?targetAuthLevel=40&destinationURL=%27&__EntryPageParams=returnUrl:/originations/etb/iao
Requested by
Host: dco-sg-cc-uat.lp.hsbc.com.hk
URL: https://dco-sg-cc-uat.lp.hsbc.com.hk/main.c6c9790d2179d599a2f9.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
203.112.89.18 Central, Hong Kong, ASN9221 (HSBC-HK-AS HSBC HongKong, HK),
Reverse DNS
Software
Apache /
Resource Hash
a8c47476bdc67d5d6a975b0a42bc59037c8b00134fca8c2ae3449204ba29b7d0
Security Headers
Name Value
Content-Security-Policy default-src 'none'
Strict-Transport-Security max-age=16070400; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN DENY
X-Xss-Protection 0

Request headers

Host
dco-sg-cc-uat.lp.hsbc.com.hk
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
same-origin
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
_csrf=rw0JkKoEGaTIp5isP1gtkb_f; LB_COOKIE_1=3617968650.60032.0000; utag_main=v_id:0176f4d0a24900028910a6bfef8100078002507000b08$_sn:1$_se:1$_ss:1$_st:1610426882442$ses_id:1610425082442%3Bexp-session$_pn:1%3Bexp-session; tms_ref=
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 12 Jan 2021 04:18:04 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN DENY
Access-Control-Allow-Origin
*
Access-Control-Allow-Headers
*
Access-Control-Allow-Methods
*
Content-Security-Policy
default-src 'none'
X-DNS-Prefetch-Control
off
Expect-CT
max-age=0
Strict-Transport-Security
max-age=16070400; includeSubDomains
X-Download-Options
noopen
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
none
Referrer-Policy
no-referrer
X-XSS-Protection
0
Content-Type
text/html; charset=utf-8
Content-Length
148
Vary
Accept-Encoding
S
rproxy_hkg1vl1101_ia_sg
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

4 Cookies

Domain/Path Name / Value
.hsbc.com.hk/ Name: utag_main
Value: v_id:0176f4d0a24900028910a6bfef8100078002507000b08$_sn:1$_se:1$_ss:1$_st:1610426882442$ses_id:1610425082442%3Bexp-session$_pn:1%3Bexp-session
.hsbc.com.hk/ Name: tms_ref
Value:
dco-sg-cc-uat.lp.hsbc.com.hk/ Name: LB_COOKIE_1
Value: 3617968650.60032.0000
dco-sg-cc-uat.lp.hsbc.com.hk/ Name: _csrf
Value: rw0JkKoEGaTIp5isP1gtkb_f

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy connect-src 'self' wss: https:; default-src 'self' blob: https:; font-src 'self' data:; frame-src 'self' https:; img-src 'self' data: blob: https:; media-src blob:; object-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' blob: https:; script-src-elem 'unsafe-inline' 'unsafe-eval' https:; style-src 'unsafe-inline' https:; style-src-elem 'unsafe-inline' https:; worker-src blob:;
Strict-Transport-Security max-age=16070400; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN DENY
X-Xss-Protection 0