urlscan.io logo urlscan.io
SecurityTrails logo

www.virtualcarddemo.hsbc.com.eg Open in urlscan Pro
2607:3c00:6404:5::3a  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.virtualcarddemo.hsbc.com.eg/
Effective URL: https://www.virtualcarddemo.hsbc.com.eg/sdportal/home.view
Submission: On February 23 via automatic, source certstream-suspicious
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 2607:3c00:6404:5::3a, located in United States and belongs to MASTER-7-AS, US. The main domain is www.virtualcarddemo.hsbc.com.eg.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on December 11th 2019. Valid for: a year.
This is the only time www.virtualcarddemo.hsbc.com.eg was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 13 2607:3c00:640... 26380 (MASTER-7-AS)
11 2
Apex Domain
Subdomains		 Transfer
13 hsbc.com.eg
www.virtualcarddemo.hsbc.com.eg
540 KB
11 1
Domain Requested by
13 www.virtualcarddemo.hsbc.com.eg 3 redirects www.virtualcarddemo.hsbc.com.eg
11 1

This site contains links to these domains. Also see Links.

Domain
www.business.hsbc.com.eg
Subject Issuer Validity Valid
www.virtualcarddemo.hsbc.com.eg
DigiCert SHA2 Extended Validation Server CA		 2019-12-11 -
2021-01-23		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.virtualcarddemo.hsbc.com.eg/sdportal/home.view
Frame ID: EEF0D9DED4F2DB095AD3F01BF02311E1
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://www.virtualcarddemo.hsbc.com.eg/ HTTP 302
    https://www.virtualcarddemo.hsbc.com.eg/sdportal/home.view Page URL

Page Statistics

11
Requests

91 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

538 kB
Transfer

927 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.virtualcarddemo.hsbc.com.eg/ HTTP 302
    https://www.virtualcarddemo.hsbc.com.eg/sdportal/home.view Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://www.virtualcarddemo.hsbc.com.eg/pkmslogout HTTP 302
  • https://www.virtualcarddemo.hsbc.com.eg/sdportal/LRR.view?TAM_OP=help&USERNAME=unauthenticated&ERROR_CODE=0x13212079&ERROR_TEXT=HPDIA0121W%20%20%20The%20requested%20operation%20is%20not%20valid.&URL=%2Fpkmslogout&REFERER=https%3A%2F%2Fwww.virtualcarddemo.hsbc.com.eg%2Fsdportal%2Fhome.view&HOSTNAME=www.virtualcarddemo.hsbc.com.eg&AUTHNLEVEL=&OLDSESSION= HTTP 302
  • https://www.virtualcarddemo.hsbc.com.eg/sdportal/invalidLogin.view?cobrandHost=hsbceg&locale=en_US&cd=3010

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set home.view
www.virtualcarddemo.hsbc.com.eg/sdportal/
Redirect Chain
  • https://www.virtualcarddemo.hsbc.com.eg/
  • https://www.virtualcarddemo.hsbc.com.eg/sdportal/home.view
2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.virtualcarddemo.hsbc.com.eg/sdportal/home.view
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2607:3c00:6404:5::3a , United States, ASN26380 (MASTER-7-AS, US),
Reverse DNS
Software
/
Resource Hash
de6fa30f1221f38dd1a8df5213ec50f2f6f6a444994bb845c09d6d4320748ff8
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Host
www.virtualcarddemo.hsbc.com.eg
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest
document
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest
document

Response headers

content-language
en-US
content-type
text/html;charset=UTF-8
date
Sun, 23 Feb 2020 00:13:36 GMT
p3p
CP="NON CUR OTPi OUR NOR UNI"
x-frame-options
SAMEORIGIN
cache-control
no-cache, no-store, max-age=0, private
expires
Thu, 01 Dec 1994 16:00:00 GMT
Set-Cookie
SD_JSESSIONID=0000IxvUlxDv1oYdFYNagyAjIPx:1a7qjmdsd; Path=/; Secure; HttpOnly BIGipServersmartdata-demo-portal-https-pool=!ISCMxRH02WwIdjTsBNGM3gHuXC8e5HV90NlkdoK45NOSuT/sXpoJBe0bccgG+lYpVtMxf+OYu9EBZLc=; Path=/; Expires=Sun, 23-Feb-2020 00:43:36 GMT; Secure; HttpOnly PD-S-SESSION-ID=1_2_0_Xviku+glaRpZHrbZOF3xHa8Q9nfSn0o0URk74tkpv9p3+STd; Path=/; Secure; HttpOnly LB1=!glARqlI3ZVz7WIjJSGPteDkJ8hafurj37QBm+YtdIYjYxaaZ2eejMmGZqMYrhNJFkeP5PCVKlllJnQ==; path=/; Httponly; Secure TS010c11e1=01d93cbca1d4107a4a17d0da6d2cd8956007e731e7d950aec414358ff52cdb1ee8d65ae259a9b5a97d7bdc3890549d26b08747803c7a198464b06bae7aa3e49a12eaa260c2529468577f9bbbcd90478d16f9e474f5e3eb5d7a5053629344136fbd772a54ced09ffc6fccb81ea3baaed0de57c21202; Path=/; HTTPOnly
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1122
Connection
Keep-Alive

Redirect headers

Location
https://www.virtualcarddemo.hsbc.com.eg/sdportal/home.view
Connection
Keep-Alive
Content-Length
0
bundle.js
www.virtualcarddemo.hsbc.com.eg/sdportal/dictionary/portalLabels/en_US/ 		29 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.virtualcarddemo.hsbc.com.eg/sdportal/dictionary/portalLabels/en_US/bundle.js
Requested by
Host: www.virtualcarddemo.hsbc.com.eg
URL: https://www.virtualcarddemo.hsbc.com.eg/sdportal/home.view
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2607:3c00:6404:5::3a , United States, ASN26380 (MASTER-7-AS, US),
Reverse DNS
Software
/
Resource Hash
b26b2b102cc5a1382403e97ba25264034490c533fa444a0b46c84c10f23c2160
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.virtualcarddemo.hsbc.com.eg/sdportal/home.view
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest
script

Response headers

date
Sun, 23 Feb 2020 00:13:36 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
p3p
CP="NON CUR OTPi OUR NOR UNI"
x-frame-options
SAMEORIGIN
content-language
en-US
cache-control
max-age=14400, private, no-transform
Connection
Keep-Alive
content-type
text/javascript;charset=UTF-8
Content-Length
9938
login.nocache.js
www.virtualcarddemo.hsbc.com.eg/sdportal/login/ 		7 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.virtualcarddemo.hsbc.com.eg/sdportal/login/login.nocache.js
Requested by
Host: www.virtualcarddemo.hsbc.com.eg
URL: https://www.virtualcarddemo.hsbc.com.eg/sdportal/home.view
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2607:3c00:6404:5::3a , United States, ASN26380 (MASTER-7-AS, US),
Reverse DNS
Software
/
Resource Hash
e01873ce44667475092d1b482a9c0601b8a05033738d66209ce3600672ce1ac5
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.virtualcarddemo.hsbc.com.eg/sdportal/home.view
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest
script

Response headers

date
Sun, 23 Feb 2020 00:13:37 GMT
Content-Encoding
gzip
p3p
CP="NON CUR OTPi OUR NOR UNI"
last-modified
Thu, 26 Sep 2019 14:54:48 GMT
x-frame-options
SAMEORIGIN
Vary
Accept-Encoding
content-language
en-US
cache-control
max-age=14400, private, no-transform
Connection
Keep-Alive
content-type
application/x-javascript
content-length
3438
invalidLogin.view
www.virtualcarddemo.hsbc.com.eg/sdportal/
Redirect Chain
  • https://www.virtualcarddemo.hsbc.com.eg/pkmslogout
  • https://www.virtualcarddemo.hsbc.com.eg/sdportal/LRR.view?TAM_OP=help&USERNAME=unauthenticated&ERROR_CODE=0x13212079&ERROR_TEXT=HPDIA0121W%20%20%20The%20requested%20operation%20is%20not%20valid.&UR...
  • https://www.virtualcarddemo.hsbc.com.eg/sdportal/invalidLogin.view?cobrandHost=hsbceg&locale=en_US&cd=3010
3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.virtualcarddemo.hsbc.com.eg/sdportal/invalidLogin.view?cobrandHost=hsbceg&locale=en_US&cd=3010
Requested by
Host: www.virtualcarddemo.hsbc.com.eg
URL: https://www.virtualcarddemo.hsbc.com.eg/sdportal/home.view
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2607:3c00:6404:5::3a , United States, ASN26380 (MASTER-7-AS, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.virtualcarddemo.hsbc.com.eg/sdportal/home.view
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

date
Sun, 23 Feb 2020 00:13:36 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
p3p
CP="NON CUR OTPi OUR NOR UNI"
x-frame-options
SAMEORIGIN
content-language
en-US
cache-control
no-cache, no-store, max-age=0, private
Connection
Keep-Alive
content-type
text/html;charset=UTF-8
Content-Length
1144

Redirect headers

location
https://www.virtualcarddemo.hsbc.com.eg/sdportal/invalidLogin.view?cobrandHost=hsbceg&locale=en_US&cd=3010
date
Sun, 23 Feb 2020 00:13:36 GMT
cache-control
no-cache, no-store, max-age=0, private
content-length
0
x-frame-options
SAMEORIGIN
content-language
en-US
p3p
CP="NON CUR OTPi OUR NOR UNI"
861E05DB806C6BD1C701955E1CF9D20A.cache.js
www.virtualcarddemo.hsbc.com.eg/sdportal/login/ 		374 KB
132 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.virtualcarddemo.hsbc.com.eg/sdportal/login/861E05DB806C6BD1C701955E1CF9D20A.cache.js
Requested by
Host: www.virtualcarddemo.hsbc.com.eg
URL: https://www.virtualcarddemo.hsbc.com.eg/sdportal/login/login.nocache.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2607:3c00:6404:5::3a , United States, ASN26380 (MASTER-7-AS, US),
Reverse DNS
Software
/
Resource Hash
13b773c2016459525f866cae146f704d33de415939f5d0cb997ec3108cbfd35d
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.virtualcarddemo.hsbc.com.eg/sdportal/home.view
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest
script

Response headers

date
Sun, 23 Feb 2020 00:13:37 GMT
Content-Encoding
gzip
p3p
CP="NON CUR OTPi OUR NOR UNI"
last-modified
Thu, 26 Sep 2019 15:38:08 GMT
x-frame-options
SAMEORIGIN
Vary
Accept-Encoding
content-language
en-US
cache-control
max-age=14400, private, no-transform
Connection
Keep-Alive
content-type
application/x-javascript
content-length
134118
cobrandDetailsService.rpc
www.virtualcarddemo.hsbc.com.eg/sdportal/login/ 		3 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.virtualcarddemo.hsbc.com.eg/sdportal/login/cobrandDetailsService.rpc
Requested by
Host:
URL: login-0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2607:3c00:6404:5::3a , United States, ASN26380 (MASTER-7-AS, US),
Reverse DNS
Software
/
Resource Hash
77947b917bbbd913784c5df8780dac19491105201a8e4a498558b07baac6beef
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

X-GWT-Module-Base
https://www.virtualcarddemo.hsbc.com.eg/sdportal/login/
X-GWT-Permutation
861E05DB806C6BD1C701955E1CF9D20A
Origin
https://www.virtualcarddemo.hsbc.com.eg
Referer
https://www.virtualcarddemo.hsbc.com.eg/sdportal/home.view
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type
text/x-gwt-rpc; charset=UTF-8

Response headers

pragma
no-cache
date
Sun, 23 Feb 2020 00:13:37 GMT
p3p
CP="NON CUR OTPi OUR NOR UNI"
x-frame-options
SAMEORIGIN
Vary
Accept-Encoding
content-language
en-US
cache-control
no-cache, no-store, max-age=0, private
content-disposition
attachment
content-type
application/json; charset=utf-8
content-length
2663
expires
Sat, 1 January 2000 12:00:00 GMT
cp-app.css
www.virtualcarddemo.hsbc.com.eg/sdportal/portalstatic/hsbceg/css/ 		164 KB
35 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.virtualcarddemo.hsbc.com.eg/sdportal/portalstatic/hsbceg/css/cp-app.css
Requested by
Host:
URL: login-0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2607:3c00:6404:5::3a , United States, ASN26380 (MASTER-7-AS, US),
Reverse DNS
Software
/
Resource Hash
ae2342b9bf646f832a3b1c88d80b123436a9e1853a74b5fb056fdbc16cf1bdab
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.virtualcarddemo.hsbc.com.eg/sdportal/home.view
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest
style

Response headers

date
Sun, 23 Feb 2020 00:13:38 GMT
Content-Encoding
gzip
p3p
CP="NON CUR OTPi OUR NOR UNI"
last-modified
Thu, 26 Sep 2019 15:30:40 GMT
x-frame-options
SAMEORIGIN
Vary
Accept-Encoding
content-language
en-US
cache-control
max-age=14400, private, no-transform
Connection
Keep-Alive
content-type
text/css
content-length
34424
runtimeSettingsService.rpc
www.virtualcarddemo.hsbc.com.eg/sdportal/login/ 		45 B
1014 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.virtualcarddemo.hsbc.com.eg/sdportal/login/runtimeSettingsService.rpc
Requested by
Host:
URL: login-0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2607:3c00:6404:5::3a , United States, ASN26380 (MASTER-7-AS, US),
Reverse DNS
Software
/
Resource Hash
d8abad35f689788ba281599fc7114f893637f237b3ced8c0565641c86ca8b121
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

X-GWT-Module-Base
https://www.virtualcarddemo.hsbc.com.eg/sdportal/login/
X-GWT-Permutation
861E05DB806C6BD1C701955E1CF9D20A
Origin
https://www.virtualcarddemo.hsbc.com.eg
Referer
https://www.virtualcarddemo.hsbc.com.eg/sdportal/home.view
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type
text/x-gwt-rpc; charset=UTF-8

Response headers

pragma
no-cache
date
Sun, 23 Feb 2020 00:13:37 GMT
p3p
CP="NON CUR OTPi OUR NOR UNI"
x-frame-options
SAMEORIGIN
content-language
en-US
cache-control
no-cache, no-store, max-age=0, private
content-disposition
attachment
content-type
application/json; charset=utf-8
content-length
45
expires
Sat, 1 January 2000 12:00:00 GMT
login-top.jpg
www.virtualcarddemo.hsbc.com.eg/sdportal/portalstatic/hsbceg/images/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.virtualcarddemo.hsbc.com.eg/sdportal/portalstatic/hsbceg/images/login-top.jpg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2607:3c00:6404:5::3a , United States, ASN26380 (MASTER-7-AS, US),
Reverse DNS
Software
/
Resource Hash
accc9fa5d7d1e46adf9fc112a68b8351ac90e8cbb2ea4b7f8480bec2939408d9
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.virtualcarddemo.hsbc.com.eg/sdportal/portalstatic/hsbceg/css/cp-app.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest
image

Response headers

date
Sun, 23 Feb 2020 00:13:38 GMT
last-modified
Thu, 26 Sep 2019 15:31:32 GMT
p3p
CP="NON CUR OTPi OUR NOR UNI"
x-frame-options
SAMEORIGIN
content-language
en-US
cache-control
max-age=14400, private, no-transform
content-type
image/jpeg
content-length
4175
login-body.jpg
www.virtualcarddemo.hsbc.com.eg/sdportal/portalstatic/hsbceg/images/ 		341 KB
342 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.virtualcarddemo.hsbc.com.eg/sdportal/portalstatic/hsbceg/images/login-body.jpg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2607:3c00:6404:5::3a , United States, ASN26380 (MASTER-7-AS, US),
Reverse DNS
Software
/
Resource Hash
e7db543208ca847d7bd404984b1f9bb150350fe0123117ed73516af09754355b
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.virtualcarddemo.hsbc.com.eg/sdportal/portalstatic/hsbceg/css/cp-app.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest
image

Response headers

date
Sun, 23 Feb 2020 00:13:38 GMT
last-modified
Thu, 26 Sep 2019 15:31:32 GMT
p3p
CP="NON CUR OTPi OUR NOR UNI"
x-frame-options
SAMEORIGIN
content-language
en-US
cache-control
max-age=14400, private, no-transform
content-type
image/jpeg
content-length
349315

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| portalLabelsBundle object| portalStrings function| login object| __gwt_activeModules function| __gwt_getMetaProperty function| __gwt_isKnownPropertyValue object| __gwt_stylesLoaded object| LocalizedMessages object| serverValuesMap object| commonResources function| GwtPotentialElementShim

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN