urlscan.io logo urlscan.io
SecurityTrails logo

payme-cashout-secure.hsbc.com.hk Open in urlscan Pro
20.239.125.58  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://payme-cashout-secure.hsbc.com.hk/
Effective URL: https://payme-cashout-secure.hsbc.com.hk/
Submission: On June 20 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 24 HTTP transactions. The main IP is 20.239.125.58, located in Hong Kong, Hong Kong and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is payme-cashout-secure.hsbc.com.hk.
TLS certificate: Issued by DigiCert EV RSA CA G2 on May 21st 2024. Valid for: a year.
This is the only time payme-cashout-secure.hsbc.com.hk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
24 20.239.125.58 8075 (MICROSOFT...)
24 1
Apex Domain
Subdomains		 Transfer
24 hsbc.com.hk
payme-cashout-secure.hsbc.com.hk
305 KB
24 1
Domain Requested by
24 payme-cashout-secure.hsbc.com.hk payme-cashout-secure.hsbc.com.hk
24 1

This site contains no links.

Subject Issuer Validity Valid
payme-cashout-secure.hsbc.com.hk
DigiCert EV RSA CA G2		 2024-05-21 -
2025-06-21		 a year crt.sh

This page contains 1 frames:

Primary Page: https://payme-cashout-secure.hsbc.com.hk/
Frame ID: 4D54BE51434FDD2404BB9F9D936EF351
Requests: 24 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

PayMe from HSBC

Page URL History Show full URLs

  1. http://payme-cashout-secure.hsbc.com.hk/ HTTP 307
    https://payme-cashout-secure.hsbc.com.hk/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • require.*\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

24
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

305 kB
Transfer

426 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://payme-cashout-secure.hsbc.com.hk/ HTTP 307
    https://payme-cashout-secure.hsbc.com.hk/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

24 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
payme-cashout-secure.hsbc.com.hk/
Redirect Chain
  • http://payme-cashout-secure.hsbc.com.hk/
  • https://payme-cashout-secure.hsbc.com.hk/
2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
520381865613a9a793a9a49272f4f8e6a3c92d6348892270d68ede95e309f052
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
1957
Content-Type
text/html
Date
Thu, 20 Jun 2024 18:13:57 GMT
accept-ranges
bytes
access-control-allow-credentials
false
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
*
access-control-max-age
3600
content-language
de-DE
content-security-policy
frame-ancestors 'self'
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
x-envoy-upstream-service-time
2
x-frame-options
SAMEORIGIN
x-hsbc-request-correlation-id
nil
x-request-id
f69a4ba6-f0b4-41db-b895-b076dce030c2:-:-:-

Redirect headers

Location
https://payme-cashout-secure.hsbc.com.hk/
Non-Authoritative-Reason
HttpsUpgrades
main.css
payme-cashout-secure.hsbc.com.hk/styles/ 		112 KB
113 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/main.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
4fed8cb7ce3e7df626e15009fbd766d8cbd4d3dbffc1b8540f00d7545116f267
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:13:58 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
1
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
115042
x-request-id
fddbeb7a-aa7d-406f-b377-a363bc46ee55:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
content.css
payme-cashout-secure.hsbc.com.hk/styles/ 		23 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/content.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
fc7fa64ac6038a5c92254b78b2e53ba1282af1a5514b4f395c0b274aed321433
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:13:58 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
2
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
23839
x-request-id
b37ba518-cb74-4e69-8911-52420539ec8c:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
navBar.css
payme-cashout-secure.hsbc.com.hk/styles/ 		4 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/navBar.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
83455351f75a33c7ec5d34278c12fae8b96d60629fd89ad0f32d136970ec9463
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:13:58 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
2
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
4459
x-request-id
04ff31e5-6d98-4e6b-aa25-470d7ad99d55:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
transferToBank.css
payme-cashout-secure.hsbc.com.hk/styles/ 		14 KB
15 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/transferToBank.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
6e0dfa2f29fbbf45b90125c16d84e254f8630325aa11d351d18c9cfe5af7b031
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:13:58 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
2
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
14569
x-request-id
1fb1e7c6-e869-40d7-b186-c97d99d94741:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
footer.css
payme-cashout-secure.hsbc.com.hk/styles/ 		3 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/footer.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
9561d36a39907e5f076fca85501c6100e89b6f9021dbb7372000604cd9754584
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:13:59 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
2
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
2923
x-request-id
f00307b6-d456-4ee4-b741-9175a96b586b:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
fixValue.css
payme-cashout-secure.hsbc.com.hk/styles/ 		85 B
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/fixValue.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
59c06948c0b49ce71c5092825a13b52e5a3e5038ae61f227c488a326b033a6cf
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:13:58 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
2
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
85
x-request-id
3a5b97a2-d10b-4a74-9cee-4a15e3e877b7:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
fakeHomePage.css
payme-cashout-secure.hsbc.com.hk/styles/ 		10 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/fakeHomePage.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
bf1aa7f2ff7772f9eadb40448b7a3c078d4262e556aacc0b8cfe28bf71068ed8
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:13:59 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
2
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
9963
x-request-id
4ffeffba-8a4c-4e14-b3d9-78d9bb5fed82:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
tnc.css
payme-cashout-secure.hsbc.com.hk/styles/ 		5 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/tnc.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
581e338ba741815e67de3742527dbeac1bdffc67fbc6f7badda2fd3e3d0ada75
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:13:59 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
2
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
5207
x-request-id
d75b6748-863c-45b4-840b-d0e68f93eed6:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
emailVerify.css
payme-cashout-secure.hsbc.com.hk/styles/ 		4 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/emailVerify.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
59bcbfb26312c020537ad08298ca004e82db2819c86206a2a182a2ebe3973b71
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:13:59 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
2
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
3810
x-request-id
88979951-3d56-46d3-b9d1-4107af7a0246:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
contactUs.css
payme-cashout-secure.hsbc.com.hk/styles/ 		10 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/contactUs.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
29c4f1a19e566f823cb65d370eaf0789943a4e59e8070fa94c7b5665a1595547
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:13:59 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
2
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
10719
x-request-id
2c33a044-e2fc-437d-9ef1-cf89e0156862:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
idNv.css
payme-cashout-secure.hsbc.com.hk/styles/ 		1 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/idNv.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
7261a43f21e8f46e4ee122bfb7b5be21a325dbe7c5248389956aac22c404a225
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:13:59 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
2
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
1318
x-request-id
db547c7c-4c98-4ef4-ba56-e02ae8a9871b:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
otp.css
payme-cashout-secure.hsbc.com.hk/styles/ 		2 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/otp.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
81366a435c601cdce9180eee9eb7304fd5ab58d3c74219caafb321e322a8c42d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:13:59 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
2
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
2281
x-request-id
67d63f38-409e-4f10-bd13-2b959dbadc7d:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
qrcode.css
payme-cashout-secure.hsbc.com.hk/styles/ 		58 B
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/qrcode.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
d83d746694795afaacf5ee46f749b6bb6b4880c890d49b364b705dcb83444a77
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:13:59 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
2
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
58
x-request-id
84bef19d-698f-4a92-9777-39270cc94555:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
referralCode.css
payme-cashout-secure.hsbc.com.hk/styles/ 		4 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/referralCode.css
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
41f184ecd38d431b040f068671abc37ae17d9a6e78aafccc2b54a23c8ab196fe
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:13:59 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
1
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
4143
x-request-id
c1a50618-451c-48c7-ae00-4b72a9bb0e61:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
referralCodeInvalid.css
payme-cashout-secure.hsbc.com.hk/styles/ 		2 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/styles/referralCodeInvalid.css?v=1
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
f9404393f2c2b0d84cb2b2cd84abc40a8c48ead4cb5cf9a307a537ceb0267a69
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:13:59 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
2
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
2530
x-request-id
0837384a-3812-4170-b79e-00d40ef001e8:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
text/css
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
require.js
payme-cashout-secure.hsbc.com.hk/lib/ 		17 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
490a0312f02c4ee37289bb12389c413b72546eeed840327ef1df7578d1475b80
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:13:59 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
2
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
17888
x-request-id
7c4935b8-3a0a-4841-8fa7-49acef8349a6:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
config.js
payme-cashout-secure.hsbc.com.hk/scripts/ 		2 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/scripts/config.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
da95d9519b784edebcd26d7bde7c2fdaa35641bd4674b544d2952126323fc734
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:14:03 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
2
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
2457
x-request-id
1d9cfdf9-255f-4a11-947b-8254fed8b8e0:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
favicon.ico
payme-cashout-secure.hsbc.com.hk/ 		34 KB
35 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
e9b2a9710b43d565378c705bf5935912a61df3ad0a415d8f5bd2c96df8eab62b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:14:03 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
2
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
34426
x-request-id
173b7ebb-a88c-41c2-84b1-da2fb8b2b2d3:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
image/x-icon
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
main.js
payme-cashout-secure.hsbc.com.hk/scripts/ 		3 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/scripts/main.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
8393a4568f5e63aa9e4c9a4e25c2d6defcd0ea2c2cac531a1d0fca9ca258ed04
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:14:04 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
1
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
3547
x-request-id
10af143e-e1eb-442b-99be-321c59934211:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
jquery.js
payme-cashout-secure.hsbc.com.hk/lib/ 		63 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/lib/jquery.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:14:04 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
2
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
87665
x-request-id
8495a51e-b6b4-4d3c-8293-fe8d1948d1eb:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
i18n.js
payme-cashout-secure.hsbc.com.hk/lib/ 		1 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/lib/i18n.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
53325598963e3497ac831a647bb9807beebb3a3463e9850295fa3b69dbdab780
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:14:04 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
2
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
1415
x-request-id
2bafea7f-82a4-4b7d-a200-d034ca546a87:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
language.js
payme-cashout-secure.hsbc.com.hk/nls/ 		28 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/nls/language.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
71ab9203fb14407f0378c062ca5f04734fb6c0dd3861c683dcbe4f36d70f8929
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:14:04 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
1
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
28409
x-request-id
7422794e-bdc3-4b37-9f66-4d2e2bc8f4f5:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken
tNc.js
payme-cashout-secure.hsbc.com.hk/nls/ 		79 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://payme-cashout-secure.hsbc.com.hk/nls/tNc.js
Requested by
Host: payme-cashout-secure.hsbc.com.hk
URL: https://payme-cashout-secure.hsbc.com.hk/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
20.239.125.58 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://payme-cashout-secure.hsbc.com.hk/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 20 Jun 2024 18:14:04 GMT
content-security-policy
frame-ancestors 'self'
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
2
x-hsbc-request-correlation-id
nil
Connection
keep-alive
Content-Length
120218
x-request-id
77fb529d-07b5-4331-ae17-f4a83efaf70b:-:-:-
request-context
appId=cid-v1:962a43f6-a73e-4d35-a1d4-a418889c6de1
last-modified
Wed, 19 Jun 2024 06:31:26 GMT
server
istio-envoy
access-control-max-age
3600
access-control-allow-methods
GET, HEAD, POST, PUT, DELETE, OPTIONS
Content-Type
application/javascript
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-credentials
false
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
accept-ranges
bytes
access-control-allow-headers
Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,SESSIONID,CSRFToken

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage function| _typeof function| requirejs function| _require function| define

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

payme-cashout-secure.hsbc.com.hk
20.239.125.58
29c4f1a19e566f823cb65d370eaf0789943a4e59e8070fa94c7b5665a1595547
41f184ecd38d431b040f068671abc37ae17d9a6e78aafccc2b54a23c8ab196fe
490a0312f02c4ee37289bb12389c413b72546eeed840327ef1df7578d1475b80
4fed8cb7ce3e7df626e15009fbd766d8cbd4d3dbffc1b8540f00d7545116f267
520381865613a9a793a9a49272f4f8e6a3c92d6348892270d68ede95e309f052
53325598963e3497ac831a647bb9807beebb3a3463e9850295fa3b69dbdab780
581e338ba741815e67de3742527dbeac1bdffc67fbc6f7badda2fd3e3d0ada75
59bcbfb26312c020537ad08298ca004e82db2819c86206a2a182a2ebe3973b71
59c06948c0b49ce71c5092825a13b52e5a3e5038ae61f227c488a326b033a6cf
6e0dfa2f29fbbf45b90125c16d84e254f8630325aa11d351d18c9cfe5af7b031
71ab9203fb14407f0378c062ca5f04734fb6c0dd3861c683dcbe4f36d70f8929
7261a43f21e8f46e4ee122bfb7b5be21a325dbe7c5248389956aac22c404a225
81366a435c601cdce9180eee9eb7304fd5ab58d3c74219caafb321e322a8c42d
83455351f75a33c7ec5d34278c12fae8b96d60629fd89ad0f32d136970ec9463
8393a4568f5e63aa9e4c9a4e25c2d6defcd0ea2c2cac531a1d0fca9ca258ed04
9561d36a39907e5f076fca85501c6100e89b6f9021dbb7372000604cd9754584
bf1aa7f2ff7772f9eadb40448b7a3c078d4262e556aacc0b8cfe28bf71068ed8
d83d746694795afaacf5ee46f749b6bb6b4880c890d49b364b705dcb83444a77
da95d9519b784edebcd26d7bde7c2fdaa35641bd4674b544d2952126323fc734
e9b2a9710b43d565378c705bf5935912a61df3ad0a415d8f5bd2c96df8eab62b
f9404393f2c2b0d84cb2b2cd84abc40a8c48ead4cb5cf9a307a537ceb0267a69
fc7fa64ac6038a5c92254b78b2e53ba1282af1a5514b4f395c0b274aed321433