www.mtr.com.hk Open in urlscan Pro
95.101.111.161 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://drtrack.mtrmail.net/t.aspx/subid/81089931/camid/82147/linkid/30619/Default.aspx
Effective URL:
https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
Submission: On January 17 via api (January 17th 2024, 11:07:52 am UTC) from HK — Scanned from DE

Summary HTTP 50 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 9 IPs in 2 countries across 9 domains to perform 50 HTTP transactions. The main IP is 95.101.111.161, located in Frankfurt am Main, Germany and belongs to AKAMAI-ASN1, NL. The main domain is www.mtr.com.hk. The Cisco Umbrella rank of the primary domain is 312410.
TLS certificate: Issued by R3 on December 20th 2023. Valid for: 3 months.

This is the only time www.mtr.com.hk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	103.131.45.254 103.131.45.254	133054 (RSHL-AS R...) (RSHL-AS Reasonable Software House Limited)
41	95.101.111.161 95.101.111.161	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:810::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
50	9

1 103.131.45.254 (Hong Kong) 1 redirects

ASN133054 (RSHL-AS Reasonable Software House Limited, HK)
PTR: smtp145254.spread5f.me

drtrack.mtrmail.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

41 95.101.111.161 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a95-101-111-161.deploy.static.akamaitechnologies.com

www.mtr.com.hk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
41	mtr.com.hk www.mtr.com.hk — Cisco Umbrella Rank: 312410	4 MB
2	gstatic.com fonts.gstatic.com	60 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 37	178 KB
1	google.de www.google.de — Cisco Umbrella Rank: 6518	455 B
1	google.com www.google.com — Cisco Umbrella Rank: 2	455 B
1	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 38	2 KB
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	21 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 28	99 KB
1	mtrmail.net 1 redirects drtrack.mtrmail.net	492 B
50	9

	Domain	Requested by
41	www.mtr.com.hk	www.mtr.com.hk
2	fonts.gstatic.com	fonts.googleapis.com
2	www.googletagmanager.com	www.mtr.com.hk www.googletagmanager.com
1	www.google.de	www.mtr.com.hk
1	www.google.com	www.mtr.com.hk
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	www.google-analytics.com	www.googletagmanager.com
1	fonts.googleapis.com	www.mtr.com.hk
1	drtrack.mtrmail.net	1 redirects
50	9

This site contains links to these domains. Also see Links.

Domain
play.google.com
apps.apple.com
www.hsbc.com.hk
www.instagram.com
www.facebook.com
www.youtube.com

Subject Issuer	Validity	Valid
www.mtr.com.hk R3	`2023-12-20` - `2024-03-19`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
Frame ID: 8B1C678FD46FE855A02359A810DB0A7E
Requests: 52 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

MTR Mobile - Registration steps

Page URL History Show full URLs

http://drtrack.mtrmail.net/t.aspx/subid/81089931/camid/82147/linkid/30619/Default.aspx HTTP 302
https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/ Page URL

Detected technologies

GSAP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

TweenMax(?:\.min)?\.js

Akamai Bot Manager (Security) Expand

Overall confidence: 100%
Detected patterns

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

50
Requests

100 %
HTTPS

78 %
IPv6

9
Domains

9
Subdomains

9
IPs

2
Countries

4874 kB
Transfer

5727 kB
Size

10
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://play.google.com/store/apps/details?id=com.mtr.mtrmobile

Search URL Search Domain Scan URL

URL: https://apps.apple.com/us/app/mtr-mobile/id369295276

Search URL Search Domain Scan URL

URL: https://www.hsbc.com.hk/creditcard
Title: www.hsbc.com.hk/creditcard

Search URL Search Domain Scan URL

URL: https://www.hsbc.com.hk/misc/data-privacy-notice/
Title: Data Privacy Notice

Search URL Search Domain Scan URL

URL: https://www.instagram.com/mtrhk/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/mtrhk

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/mtrhongkong

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://drtrack.mtrmail.net/t.aspx/subid/81089931/camid/82147/linkid/30619/Default.aspx HTTP 302
https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

50 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
Redirect Chain

http://drtrack.mtrmail.net/t.aspx/subid/81089931/camid/82147/linkid/30619/Default.aspx
https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

38 KB
9 KB

302ms
232ms

Document
text/html

95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

f0ad6a95853d727882281b2d61d5c94f618116a1f43150c5e457891a091024b1

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 6333
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Content-Type: text/html
Date: Wed, 17 Jan 2024 11:07:45 GMT
ETag: 0x8DC174912B0EC8C
Expires: Wed, 17 Jan 2024 11:07:45 GMT
Last-Modified: Wed, 17 Jan 2024 10:42:59 GMT
Pragma: no-cache
Referrer-Policy: no-referrer-when-downgrade
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Vary: Accept-Encoding
X-Akamai-Transformed: 9 7903 0 pmb=mTOE,2
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Powered-By: ARR/3.0
X-XSS-Protection: 1; mode=block
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-meta-modified_by: WCMS
x-ms-request-id: f04fdf0b-b01e-003d-6735-4916b2000000
x-ms-version: 2009-09-19

Redirect headers

Cache-Control: private
Content-Length: 176
Content-Type: text/html; charset=utf-8
Date: Wed, 17 Jan 2024 11:07:45 GMT
Location: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET

GET
H/1.1 200
OK reset.css
www.mtr.com.hk/mtrmobile/lib/css/ 2 KB
3 KB 220ms
218ms Stylesheet
text/css 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mtr.com.hk/mtrmobile/lib/css/reset.css

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

4945b2e93d6f1f553233b8466b9b22caad5d87b36b9dc8b3e5abc7d2feea9fbe

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Wed, 17 Jan 2024 11:07:45 GMT
Content-MD5: JHLqNfYMnefHMBLXkEHzQw==
X-Powered-By: ARR/3.0
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Connection: keep-alive
Content-Length: 1026
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:02 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC1749146A420D
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: text/css
Access-Control-Allow-Origin: *
x-ms-request-id: 30d3235a-901e-0067-3735-497055000000
Vary: Accept-Encoding
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H2 200 css2
fonts.googleapis.com/ 355 KB
99 KB 58ms
35ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Noto+Sans+TC:wght@300;400;700&display=swap

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3df31ab6e17454ed9f9eebfbe0a524ad95e2e294bfe86e07cec4699c3ded7588

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 17 Jan 2024 11:07:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 17 Jan 2024 11:07:45 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 17 Jan 2024 11:07:45 GMT

GET
H/1.1 200
OK lightslider.css
www.mtr.com.hk/mtrmobile/lib/css/ 8 KB
4 KB 802ms
788ms Stylesheet
text/css 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mtr.com.hk/mtrmobile/lib/css/lightslider.css

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

cebbd09229d3eda01266779e41f9db82ead949f9618731abe3dbcef03d15f0e2

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Wed, 17 Jan 2024 11:07:46 GMT
Content-MD5: xDqe/iUdzNwx+UqBK1e5SQ==
X-Powered-By: ARR/3.0
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Connection: keep-alive
Content-Length: 2120
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:02 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC174914529EDC
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: text/css
Access-Control-Allow-Origin: *
x-ms-request-id: f19e8b78-501e-000a-6335-49c41e000000
Vary: Accept-Encoding
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK sharestyles.css
www.mtr.com.hk/mtrmobile/lib/css/ 16 KB
6 KB 825ms
811ms Stylesheet
text/css 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mtr.com.hk/mtrmobile/lib/css/sharestyles.css

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

2a79cd4383c6c244c0ff0c133640b18397db87ad9988401695b5d8fb8e48ffa0

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Wed, 17 Jan 2024 11:07:46 GMT
Content-MD5: Ldga3IStVw/ZNQGUp7Aqow==
X-Powered-By: ARR/3.0
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Connection: keep-alive
Content-Length: 4282
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:02 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC1749146EAE33
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: text/css
Access-Control-Allow-Origin: *
x-ms-request-id: 30d32431-901e-0067-6f35-497055000000
Vary: Accept-Encoding
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK mtrpoints_styles.css
www.mtr.com.hk/mtrmobile/lib/css/ 64 KB
13 KB 810ms
791ms Stylesheet
text/css 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mtr.com.hk/mtrmobile/lib/css/mtrpoints_styles.css

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

c65f874979e362518756e4644d5669c8302fb3a254bf5d82d562a3961044a593

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Wed, 17 Jan 2024 11:07:46 GMT
Content-MD5: /iuyLfqCZLK/vg9uCD1k9A==
X-Powered-By: ARR/3.0
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Connection: keep-alive
Content-Length: 11227
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:02 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC1749145D24A2
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: text/css
Access-Control-Allow-Origin: *
x-ms-request-id: bd28a38d-401e-0064-5635-499131000000
Vary: Accept-Encoding
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK jquery-3.3.1.min.js Show response
www.mtr.com.hk/mtrmobile/lib/js/ 85 KB
40 KB 808ms
789ms Script
application/x-javascript 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mtr.com.hk/mtrmobile/lib/js/jquery-3.3.1.min.js

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Wed, 17 Jan 2024 11:07:46 GMT
Content-MD5: N4CHpk4TlPxR8wC7nBGHjA==
X-Powered-By: ARR/3.0
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Connection: keep-alive
Content-Length: 38887
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 21 Nov 2023 10:43:03 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DBEA7EA3DC6BB8
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
x-ms-request-id: 3d849073-f01e-003c-35c5-1d496e000000
Vary: Accept-Encoding
x-ms-version: 2009-09-19
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK TweenMax.min.js Show response
www.mtr.com.hk/mtrmobile/lib/js/ 102 KB
46 KB 826ms
807ms Script
application/x-javascript 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mtr.com.hk/mtrmobile/lib/js/TweenMax.min.js

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

28b34a321dc99e60450413eb6f73a588338b903133cae95a1afbd80b4a95ef29

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Wed, 17 Jan 2024 11:07:46 GMT
Content-MD5: hNSnJDaIr+2bFR951fIwQg==
X-Powered-By: ARR/3.0
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Connection: keep-alive
Content-Length: 45169
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 21 Nov 2023 10:43:03 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DBEA7EA3E4F600
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
x-ms-request-id: 83e5d7c3-401e-0016-3fc5-1d967e000000
Vary: Accept-Encoding
x-ms-version: 2009-09-19
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK lightslider.js Show response
www.mtr.com.hk/mtrmobile/lib/js/ 48 KB
11 KB 436ms
216ms Script
application/x-javascript 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mtr.com.hk/mtrmobile/lib/js/lightslider.js

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

191bba8a5028c51fabf31018dac5df6841fe00754775bf9eef8e8af6bf231c8f

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Wed, 17 Jan 2024 11:07:45 GMT
Content-MD5: Ekzw2VP9oYBUSAtS70aNNA==
X-Powered-By: ARR/3.0
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Connection: keep-alive
Content-Length: 9921
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 21 Nov 2023 10:43:03 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DBEA7EA3DCE0E0
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
x-ms-request-id: 76ca3c60-201e-0062-3bc5-1da28e000000
Vary: Accept-Encoding
x-ms-version: 2009-09-19
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK page-custom.js Show response
www.mtr.com.hk/mtrmobile/lib/js/ 6 KB
3 KB 654ms
216ms Script
application/x-javascript 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mtr.com.hk/mtrmobile/lib/js/page-custom.js

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

e634ba653b5b95c1f67b4e3560a74ed978b0bf93d2af2a69cdd66a9e95c1e6ee

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Wed, 17 Jan 2024 11:07:46 GMT
Content-MD5: HDWongoxcPs2bZg1PIocNg==
X-Powered-By: ARR/3.0
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Connection: keep-alive
Content-Length: 1989
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 21 Nov 2023 10:43:03 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DBEA7EA3DCE0E0
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
x-ms-request-id: 66331260-d01e-003b-56c5-1d250d000000
Vary: Accept-Encoding
x-ms-version: 2009-09-19
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK page-mtr-points-custom.js Show response
www.mtr.com.hk/mtrmobile/lib/js/ 14 KB
4 KB 879ms
225ms Script
application/x-javascript 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mtr.com.hk/mtrmobile/lib/js/page-mtr-points-custom.js

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

782d5b314dea5fd366b4ab8a313dbe55d73b6f3b78b84cd5765cd0da8e0f1ef9

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Wed, 17 Jan 2024 11:07:46 GMT
Content-MD5: CodH4xRUcL9URXoGwwPOsA==
X-Powered-By: ARR/3.0
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Connection: keep-alive
Content-Length: 2748
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 21 Nov 2023 10:43:03 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DBEA7EA3D6EE47
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
x-ms-request-id: eebd0659-901e-0015-1235-49771a000000
Vary: Accept-Encoding
x-ms-version: 2009-09-19
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK 616e14c9 Show response
www.mtr.com.hk/akam/13/ 26 KB
10 KB 272ms
271ms Script
application/javascript 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mtr.com.hk/akam/13/616e14c9

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Resource Hash

5f5eb6a810505a54ed64b6d294c6696c5d4c4c348d4b8425b6245b473507b2c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000 ; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Jan 2024 11:07:46 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Last-Modified: Wed, 09 Feb 2022 15:12:25 GMT
ETag: "226a0270d7fc569ec280c5e647cadf65567dad1e1a3afee119ddd4294b1d584c"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 8760
Expires: Wed, 17 Jan 2024 11:07:46 GMT

GET
H/1.1 200
OK img-mtr-logo-en.png
www.mtr.com.hk/mtrmobile/lib/images/cmn/ 10 KB
11 KB 226ms
226ms Image
image/png 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/cmn/img-mtr-logo-en.png

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

826fccc3cf47bae806a0d1c07482317b818c4eb75832451efcbc65a36bdc0f62

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:46 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: Q/O7julUAw+DAOFaNK2ffw==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 9898
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:03 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC174915164718
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/png
Access-Control-Allow-Origin: *
x-ms-request-id: f19e8c0c-501e-000a-4f35-49c41e000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-mtr-logo-en-m.png
www.mtr.com.hk/mtrmobile/lib/images/cmn/ 10 KB
12 KB 224ms
224ms Image
image/png 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/cmn/img-mtr-logo-en-m.png

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

f5f19594c492237f9cad7c2564a5f02b32117567afea246aa0b595558a4c6fe7

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:46 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: ERqpWsVsTukzfBnbKpRaFg==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 10307
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:03 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC17491512C527
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/png
Access-Control-Allow-Origin: *
x-ms-request-id: f04fe06d-b01e-003d-1c35-4916b2000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-google-play.png
www.mtr.com.hk/mtrmobile/lib/images/cmn/ 19 KB
20 KB 222ms
221ms Image
image/png 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/cmn/img-google-play.png

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

192bbd071ac82b6f2fadbb74ab20246c595afbec330949fb3b61eaad558def48

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:46 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: r0L7ldvSaI2FFcLecmxsSQ==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 19194
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:03 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC174914F02718
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/png
Access-Control-Allow-Origin: *
x-ms-request-id: bd28a413-401e-0064-4c35-499131000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-app-store.png
www.mtr.com.hk/mtrmobile/lib/images/cmn/ 12 KB
14 KB 243ms
242ms Image
image/png 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/cmn/img-app-store.png

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

bfec4b47928e3f8009a00c2936ff9fce88518520035ced5aa50919c4e42b6409

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:46 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: L4Lm6px820priwK45Lvp4A==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 12488
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:02 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC174914DACD87
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/png
Access-Control-Allow-Origin: *
x-ms-request-id: 30d32495-901e-0067-4535-497055000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-phone-case.png
www.mtr.com.hk/mtrmobile/lib/images/cmn/ 394 KB
396 KB 469ms
469ms Image
image/png 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/cmn/img-phone-case.png

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

3b02d77c4172968f09a3ec3057a61366f5db9aaed9a7b1ab01c9fc4938b9e9e1

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:46 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: Z4QMmR/09jI2FlzcBKlRVg==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 403612
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:03 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC1749152F97BA
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/png
Access-Control-Allow-Origin: *
x-ms-request-id: 0cb7ae35-201e-003f-5f35-49a80a000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-step-01-en.jpg
www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/ 328 KB
329 KB 236ms
235ms Image
image/jpeg 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/img-step-01-en.jpg

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

52013e3332f1ffa85f40d6fadcbc9502c5ed44a43688af0a25351988622f68c7

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:46 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: S/9Cb6UOTrCE1L8dYnNfkQ==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 335705
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:12 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC17491AAB5A28
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
x-ms-request-id: f19e8c6c-501e-000a-2635-49c41e000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-step-02-en.jpg
www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/ 260 KB
262 KB 233ms
233ms Image
image/jpeg 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/img-step-02-en.jpg

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

bcb77aad9b7faf7e1a7ef064e5544870be80f729348be1996d7c9759658ef050

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:46 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: PY/0pmMm7eT7WZbfOMdeqw==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 266536
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:12 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC17491AB4CEA3
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
x-ms-request-id: f04fe12e-b01e-003d-4735-4916b2000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-step-03-en.jpg
www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/ 251 KB
254 KB 418ms
418ms Image
image/jpeg 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/img-step-03-en.jpg

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

76d32e314a9947669c90f93b4774bdcec639e26d582a7af7b92edb436b3acd9e

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:47 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: n6HJb2M6NPuca2g9MpoCBA==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 257401
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:12 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC17491ABCBCBB
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
x-ms-request-id: 30d32506-901e-0067-2935-497055000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-step-04-en.jpg
www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/ 246 KB
248 KB 232ms
232ms Image
image/jpeg 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/img-step-04-en.jpg

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

6084c98854135d84e27c01bd7d04fcb2642f0ca5c16cdfc366eab6501da0d0b4

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:47 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: WCm9DnhEKjJYRHIKelaStQ==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 252007
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:12 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC17491AC3245E
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
x-ms-request-id: 0cb7af56-201e-003f-7135-49a80a000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-step-05-en.jpg
www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/ 270 KB
272 KB 767ms
226ms Image
image/jpeg 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/img-step-05-en.jpg

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

e411ec64ad16e53b0db03557ff1668c68a9b4d75153d9556e36a58422a1724c0

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:47 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: CsmfZXZeXch0D1VTnA9d/g==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 276054
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:12 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC17491ACA9D53
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
x-ms-request-id: f19e8dc1-501e-000a-5d35-49c41e000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-step-06-en.jpg
www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/ 246 KB
248 KB 509ms
226ms Image
image/jpeg 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/img-step-06-en.jpg

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

3bdacc0fbe7cf01e9a2addbea04e9ab9a603bc8321ed31426df77aa20c159c4d

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:47 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: mtKzsxQ4caCi90zMWccPmg==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 251450
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:12 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC17491AD1C837
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
x-ms-request-id: eebd08b2-901e-0015-4135-49771a000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-hsbc-app.png
www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/ 38 KB
39 KB 254ms
254ms Image
image/png 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/img-hsbc-app.png

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

0c2070d20cfc1c0842d748f979501481aa4791d289102b1e94a645ff3f1ab7cf

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:47 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: H10S/Fxl7n6XkIsDezV5Zg==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 38700
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:12 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC17491AA197A0
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/png
Access-Control-Allow-Origin: *
x-ms-request-id: f04fe314-b01e-003d-0e35-4916b2000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK ico-mtr-app.png
www.mtr.com.hk/mtrmobile/lib/images/cmn/ 6 KB
8 KB 219ms
218ms Image
image/png 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/cmn/ico-mtr-app.png

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

34b6ce56d8f4aa4c0bc441dad23710c0ea683aa22baa2207726e91af027f9ded

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:47 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: KxQWcRU+ArrbIBeZGDseLQ==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 6476
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:02 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC1749149E69B3
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/png
Access-Control-Allow-Origin: *
x-ms-request-id: bd28a67c-401e-0064-0835-499131000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-mtr-app-qr-code.png
www.mtr.com.hk/mtrmobile/lib/images/cmn/ 54 KB
56 KB 230ms
230ms Image
image/png 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/cmn/img-mtr-app-qr-code.png

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

e912bc971b76d0295ad9bbf671900f242e5699a81282b4d5a12a5f089c9e0f55

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:47 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: VpHsDOmi5jyE1EHugCGg8A==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 55425
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:03 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC1749150BE85D
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/png
Access-Control-Allow-Origin: *
x-ms-request-id: 0cb7b22d-201e-003f-7d35-49a80a000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK ico-instagram.png
www.mtr.com.hk/mtrmobile/lib/images/cmn/ 2 KB
4 KB 223ms
223ms Image
image/png 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/cmn/ico-instagram.png

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

7bf33ec2798ced7200876911413dbd51f3ffc032931e7d8549f05d61a94343c8

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:47 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: mF3NS9W191y17rTNLh3t2g==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 2172
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:02 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC174914978CE5
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/png
Access-Control-Allow-Origin: *
x-ms-request-id: 30d32675-901e-0067-6d35-497055000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK ico-facebook.png
www.mtr.com.hk/mtrmobile/lib/images/cmn/ 498 B
2 KB 217ms
217ms Image
image/png 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/cmn/ico-facebook.png

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

36222d42efd0170d13e60e1c0bf9b7defc940fd36b17bef15a3564cd4b36f724

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:47 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: goAyBF0gk5WEJ7Lhc7Rk9A==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 498
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:02 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC174914906207
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/png
Access-Control-Allow-Origin: *
x-ms-request-id: eebd09f2-901e-0015-6b35-49771a000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK ico-youtube.png
www.mtr.com.hk/mtrmobile/lib/images/cmn/ 960 B
2 KB 217ms
217ms Image
image/png 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/cmn/ico-youtube.png

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

d1f0f8c52e085ab6e6dd2b322dfef7a5789718118df1061cc000c03b11246bf1

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:48 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: 89HE64Dnwmehb31sE9aTpg==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 960
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:02 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC174914A1286C
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/png
Access-Control-Allow-Origin: *
x-ms-request-id: f04fe3b1-b01e-003d-0d35-4916b2000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 249 KB
88 KB 49ms
28ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KR5MZDK

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4355dbfee1f27c8502f9c98c7c19d9fcaa0b7929ade185296b05261508821242

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 17 Jan 2024 11:07:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 89222
x-xss-protection: 0
last-modified: Wed, 17 Jan 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 17 Jan 2024 11:07:46 GMT

GET
H/1.1 200
OK img-phone-case.png
www.mtr.com.hk/mtrmobile/lib/images/cmn/ 394 KB
396 KB 14ms
14ms Image
image/png 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/cmn/img-phone-case.png

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

3b02d77c4172968f09a3ec3057a61366f5db9aaed9a7b1ab01c9fc4938b9e9e1

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:47 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: Z4QMmR/09jI2FlzcBKlRVg==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 403612
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:03 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC1749152F97BA
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/png
Access-Control-Allow-Origin: *
x-ms-request-id: 0cb7ae35-201e-003f-5f35-49a80a000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-step-01-en.jpg
www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/ 328 KB
329 KB 14ms
14ms Image
image/jpeg 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/img-step-01-en.jpg

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

52013e3332f1ffa85f40d6fadcbc9502c5ed44a43688af0a25351988622f68c7

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:47 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: S/9Cb6UOTrCE1L8dYnNfkQ==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 335705
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:12 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC17491AAB5A28
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
x-ms-request-id: f19e8c6c-501e-000a-2635-49c41e000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-step-02-en.jpg
www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/ 260 KB
262 KB 15ms
15ms Image
image/jpeg 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/img-step-02-en.jpg

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

bcb77aad9b7faf7e1a7ef064e5544870be80f729348be1996d7c9759658ef050

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:47 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: PY/0pmMm7eT7WZbfOMdeqw==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 266536
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:12 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC17491AB4CEA3
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
x-ms-request-id: f04fe12e-b01e-003d-4735-4916b2000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-step-03-en.jpg
www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/ 251 KB
253 KB 13ms
13ms Image
image/jpeg 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/img-step-03-en.jpg

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

76d32e314a9947669c90f93b4774bdcec639e26d582a7af7b92edb436b3acd9e

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:47 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: n6HJb2M6NPuca2g9MpoCBA==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 257401
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:12 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC17491ABCBCBB
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
x-ms-request-id: 30d32506-901e-0067-2935-497055000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-step-04-en.jpg
www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/ 246 KB
248 KB 13ms
13ms Image
image/jpeg 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/img-step-04-en.jpg

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

6084c98854135d84e27c01bd7d04fcb2642f0ca5c16cdfc366eab6501da0d0b4

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:47 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: WCm9DnhEKjJYRHIKelaStQ==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 252007
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:12 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC17491AC3245E
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
x-ms-request-id: 0cb7af56-201e-003f-7135-49a80a000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-step-05-en.jpg
www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/ 270 KB
271 KB 14ms
14ms Image
image/jpeg 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/img-step-05-en.jpg

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

e411ec64ad16e53b0db03557ff1668c68a9b4d75153d9556e36a58422a1724c0

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:47 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: CsmfZXZeXch0D1VTnA9d/g==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 276054
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:12 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC17491ACA9D53
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
x-ms-request-id: f19e8dc1-501e-000a-5d35-49c41e000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-step-06-en.jpg
www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/ 246 KB
247 KB 14ms
14ms Image
image/jpeg 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/mtrpoints/hsbc-rewards/img-step-06-en.jpg

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

3bdacc0fbe7cf01e9a2addbea04e9ab9a603bc8321ed31426df77aa20c159c4d

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:47 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: mtKzsxQ4caCi90zMWccPmg==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 251450
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:12 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC17491AD1C837
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
x-ms-request-id: eebd08b2-901e-0015-4135-49771a000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-google-play.png
www.mtr.com.hk/mtrmobile/lib/images/cmn/ 19 KB
20 KB 13ms
13ms Image
image/png 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/cmn/img-google-play.png

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

192bbd071ac82b6f2fadbb74ab20246c595afbec330949fb3b61eaad558def48

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:47 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: r0L7ldvSaI2FFcLecmxsSQ==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 19194
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:03 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC174914F02718
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/png
Access-Control-Allow-Origin: *
x-ms-request-id: bd28a413-401e-0064-4c35-499131000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-app-store.png
www.mtr.com.hk/mtrmobile/lib/images/cmn/ 12 KB
14 KB 14ms
14ms Image
image/png 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/cmn/img-app-store.png

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

bfec4b47928e3f8009a00c2936ff9fce88518520035ced5aa50919c4e42b6409

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:47 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: L4Lm6px820priwK45Lvp4A==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 12488
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:02 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC174914DACD87
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/png
Access-Control-Allow-Origin: *
x-ms-request-id: 30d32495-901e-0067-4535-497055000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-header-bg.png
www.mtr.com.hk/mtrmobile/lib/images/cmn/ 110 KB
111 KB 356ms
233ms Image
image/png 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/cmn/img-header-bg.png

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/lib/css/sharestyles.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

1fa9afdefbe51257f9e1de96e65bc63c1e77bebcbd52b840ac88f9d8a476da5b

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/lib/css/sharestyles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:46 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: rvuWw45beyvg7ruI0AfYOQ==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 112554
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:03 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC174914F9267A
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/png
Access-Control-Allow-Origin: *
x-ms-request-id: eebd0753-901e-0015-7835-49771a000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-app-footer-mtrpoints.jpg
www.mtr.com.hk/mtrmobile/lib/images/cmn/ 29 KB
30 KB 218ms
218ms Image
image/jpeg 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/cmn/img-app-footer-mtrpoints.jpg

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/lib/css/sharestyles.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

ce2d6d292d578f8e9d04de6f5fa14c801ae0a47e826c03fc971ef2ab2d7d4079

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/lib/css/sharestyles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:48 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: Zz8j4VSYXtlCfmd9r+cjLg==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 29632
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:02 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC174914BA2B01
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
x-ms-request-id: bd28a6f3-401e-0064-7335-499131000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK img-footer-bg.png
www.mtr.com.hk/mtrmobile/lib/images/cmn/ 8 KB
9 KB 216ms
216ms Image
image/png 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mtr.com.hk/mtrmobile/lib/images/cmn/img-footer-bg.png

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/lib/css/sharestyles.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / ARR/3.0

Resource Hash

07f8434cbb0e272b4d4e1c06c934ac37eeba21e799448307921bd66abe1c4cad

Security Headers

Name	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/lib/css/sharestyles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
Content-Security-Policy: media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Date: Wed, 17 Jan 2024 11:07:48 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Content-MD5: qAN4U8myR0zQRKI0CBucqg==
X-Powered-By: ARR/3.0
Connection: keep-alive
Content-Length: 7905
X-XSS-Protection: 1; mode=block
x-ms-lease-status: unlocked
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 17 Jan 2024 10:43:03 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8DC174914E9233D
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: image/png
Access-Control-Allow-Origin: *
x-ms-request-id: 30d326ca-901e-0067-3b35-497055000000
x-ms-version: 2009-09-19
x-ms-meta-modified_by: WCMS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H2 200 -nF7OG829Oofr2wohFbTp9i1OCEK.woff2
fonts.gstatic.com/s/notosanstc/v35/ 24 KB
24 KB 48ms
14ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/notosanstc/v35/-nF7OG829Oofr2wohFbTp9i1OCEK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans+TC:wght@300;400;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c06498a30c738b01e8b9bd63af7b835ef8a00c6443499c1f1a2d1389da8ad932

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.mtr.com.hk
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 15 Jan 2024 18:17:29 GMT
x-content-type-options: nosniff
age: 147017
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24952
x-xss-protection: 0
last-modified: Tue, 15 Aug 2023 18:28:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 14 Jan 2025 18:17:29 GMT

GET
H2 200 -nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.119.woff2
fonts.gstatic.com/s/notosanstc/v35/ 35 KB
35 KB 23ms
8ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/notosanstc/v35/-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.119.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans+TC:wght@300;400;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d1c673ab93e90b90035f39e95c2248f683c873b87fbd62fc710fd52beb83800

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.mtr.com.hk
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 17 Jan 2024 02:21:01 GMT
x-content-type-options: nosniff
age: 31605
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35752
x-xss-protection: 0
last-modified: Tue, 15 Aug 2023 18:31:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 16 Jan 2025 02:21:01 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 270 KB
90 KB 24ms
21ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Y6KEBZX3W9&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KR5MZDK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

881c4b076088f01206a811394357f77cfb9fac060e5e66405aab12a683288b4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 17 Jan 2024 11:07:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92067
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 17 Jan 2024 11:07:46 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 34ms
7ms Script
text/javascript 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KR5MZDK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 17 Jan 2024 09:48:09 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 4777
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Wed, 17 Jan 2024 11:48:09 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/685096388/ 3 KB
2 KB 68ms
43ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/685096388/?random=1705489666482&cv=11&fst=1705489666482&bg=ffffff&guid=ON&async=1&gtm=45He41a0v77849226&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mtr.com.hk%2Fmtrmobile%2Fen%2Fmtrpoints%2Fhsbc-rewards%2F&hn=www.googleadservices.com&frm=0&tiba=MTR%20Mobile%20-%20Registration%20steps&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KR5MZDK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38d4eb33e8b9a31cf32c8f91d5d5514a352e8c727c42ee40d676468bb17d1387

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Jan 2024 11:07:46 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1271
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/685096388/ 42 B
455 B 40ms
19ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/685096388/?random=1705489666482&cv=11&fst=1705489200000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v77849226&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mtr.com.hk%2Fmtrmobile%2Fen%2Fmtrpoints%2Fhsbc-rewards%2F&frm=0&tiba=MTR%20Mobile%20-%20Registration%20steps&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_S5-xlag7Ob2mDgBrYJuFRDDtT1cUYA&random=2332887120&rmt_tld=0&ipr=y

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Jan 2024 11:07:46 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/685096388/ 42 B
455 B 41ms
20ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/685096388/?random=1705489666482&cv=11&fst=1705489200000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v77849226&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mtr.com.hk%2Fmtrmobile%2Fen%2Fmtrpoints%2Fhsbc-rewards%2F&frm=0&tiba=MTR%20Mobile%20-%20Registration%20steps&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_S5-xlag7Ob2mDgBrYJuFRDDtT1cUYA&random=2332887120&rmt_tld=1&ipr=y

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Jan 2024 11:07:46 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 9 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d554361630709572f4c9e33d02ca5ae56275756099a62195513017a0421f73c2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 157 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 80d54533f80e8233621f965ae0a7713928bdb4d491ed0eb5e90434550f1894cb

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

POST
H/1.1 200
OK pixel_616e14c9 Show response
www.mtr.com.hk/akam/13/ 0
862 B 365ms
12ms XHR
text/html 95.101.111.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mtr.com.hk/akam/13/pixel_616e14c9

Requested by

Host: www.mtr.com.hk
URL: https://www.mtr.com.hk/akam/13/616e14c9

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-161.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000 ; includeSubDomains

Request headers

Referer: https://www.mtr.com.hk/mtrmobile/en/mtrpoints/hsbc-rewards/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Wed, 17 Jan 2024 11:07:47 GMT
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
Connection: keep-alive
Content-Length: 0
Content-Type: text/html

Verdicts & Comments Add Verdict or Comment

93 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
drtrack.mtrmail.net/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: qqxxxzyaayak0se5crgeirsq
drtrack.mtrmail.net/	1969-12-31 23:59:59	Name: Tracking_campaign82147 Value: subid=81089931&linkid=30619
drtrack.mtrmail.net/	1969-12-31 23:59:59	Name: Tracking_campaigns Value: 82147=True
.www.mtr.com.hk/	1969-12-31 23:59:59	Name: ARRAffinity Value: 4357512662f8bc9e71bfac30edd038a7c4e0331584b0a7b4e92313890945c475
.www.mtr.com.hk/	1969-12-31 23:59:59	Name: ARRAffinitySameSite Value: 4357512662f8bc9e71bfac30edd038a7c4e0331584b0a7b4e92313890945c475
.mtr.com.hk/	1970-01-21 03:20:49	Name: _ga_Y6KEBZX3W9 Value: GS1.1.1705489666.1.0.1705489666.0.0.0
.mtr.com.hk/	1970-01-21 03:20:49	Name: _ga Value: GA1.3.255902339.1705489667
.mtr.com.hk/	1970-01-20 17:46:16	Name: _gid Value: GA1.3.73463356.1705489667
.doubleclick.net/	1970-01-20 17:44:50	Name: test_cookie Value: CheckForPermission
.mtr.com.hk/	1970-01-20 17:44:56	Name: ak_bmsc Value: B3B4F482F84E497123AD2400054D5D42~000000000000000000000000000000~YAAQodAXAp04dBSNAQAANRYbFxa6F9uIVITVwZ7V4xxHgkDkIaZndl5Lchyf3IUaEaZVYOGmsUO/i459qecHfL0JZKNafk8cbVVlI+9J1dYko3CFiteQhAWe25ADHV6ExiwTdXWAoTVK3toUTG9tSs/UVGLoXMSqvhrsIzLjVa3FuT8/ayobb2kF+XnByuUK1PT0cdxgQNJND9tCvOGFFWThiug4ejKDPjA4rqodpfpO8YKnKXbsxtMCJl5/DJQz4UdKXnblTTNh0s94I9cTnmfGGRjo1SsFCjSBjK7HUJm3eRwbURKJW1lFq281myXj50FjVovaH9pB8s9nefMsLI24vuojre5x3nmckLecNVtnpd1Ss1o5NFXDD1r8ctIsvzQt3xCukCOpNsJMVzRfbgxtapmioWfgD7HAUQjP73UyE2dsMcb+hn9/T5oDKaZSQWGQc84shza3QPSGanYOopze1ZkdwvWc

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://www.googletagmanager.com/gtag/js?id=G-Y6KEBZX3W9&l=dataLayer&cx=c(Line 172) Message: Refused to connect to 'https://region1.google-analytics.com/g/collect?v=2&tid=G-Y6KEBZX3W9&gtm=45je41a0v9103794024z877849226&_p=1705489665533&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=255902339.1705489667&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1705489666&sct=1&seg=0&dl=https%3A%2F%2Fwww.mtr.com.hk%2Fmtrmobile%2Fen%2Fmtrpoints%2Fhsbc-rewards%2F&dt=MTR%20Mobile%20-%20Registration%20steps&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=2124' because it violates the following Content Security Policy directive: "connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	media-src 'self' www.youtube.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ssl.google-analytics.com https://ssl.google-analytics.com www.google.com www.google-analytics.com ajax.googleapis.com www.googletagmanager.com maps.gstatic.com maps.googleapis.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net partner.googleadservices.com adservice.google.com.hk adservice.google.com tpc.googlesyndication.com; connect-src 'self' 'unsafe-inline' www.google-analytics.com maps.googleapis.com fonts.gstatic.com pagead2.googlesyndication.com;
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

drtrack.mtrmail.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.mtr.com.hk
103.131.45.254
2a00:1450:4001:80b::200e
2a00:1450:4001:810::2008
2a00:1450:4001:813::2003
2a00:1450:4001:827::2003
2a00:1450:4001:828::2004
2a00:1450:4001:82a::200a
2a00:1450:4001:830::2002
95.101.111.161
07f8434cbb0e272b4d4e1c06c934ac37eeba21e799448307921bd66abe1c4cad
0c2070d20cfc1c0842d748f979501481aa4791d289102b1e94a645ff3f1ab7cf
191bba8a5028c51fabf31018dac5df6841fe00754775bf9eef8e8af6bf231c8f
192bbd071ac82b6f2fadbb74ab20246c595afbec330949fb3b61eaad558def48
1fa9afdefbe51257f9e1de96e65bc63c1e77bebcbd52b840ac88f9d8a476da5b
28b34a321dc99e60450413eb6f73a588338b903133cae95a1afbd80b4a95ef29
2a79cd4383c6c244c0ff0c133640b18397db87ad9988401695b5d8fb8e48ffa0
34b6ce56d8f4aa4c0bc441dad23710c0ea683aa22baa2207726e91af027f9ded
36222d42efd0170d13e60e1c0bf9b7defc940fd36b17bef15a3564cd4b36f724
38d4eb33e8b9a31cf32c8f91d5d5514a352e8c727c42ee40d676468bb17d1387
3b02d77c4172968f09a3ec3057a61366f5db9aaed9a7b1ab01c9fc4938b9e9e1
3bdacc0fbe7cf01e9a2addbea04e9ab9a603bc8321ed31426df77aa20c159c4d
3df31ab6e17454ed9f9eebfbe0a524ad95e2e294bfe86e07cec4699c3ded7588
4355dbfee1f27c8502f9c98c7c19d9fcaa0b7929ade185296b05261508821242
4945b2e93d6f1f553233b8466b9b22caad5d87b36b9dc8b3e5abc7d2feea9fbe
4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de
52013e3332f1ffa85f40d6fadcbc9502c5ed44a43688af0a25351988622f68c7
5f5eb6a810505a54ed64b6d294c6696c5d4c4c348d4b8425b6245b473507b2c5
6084c98854135d84e27c01bd7d04fcb2642f0ca5c16cdfc366eab6501da0d0b4
76d32e314a9947669c90f93b4774bdcec639e26d582a7af7b92edb436b3acd9e
782d5b314dea5fd366b4ab8a313dbe55d73b6f3b78b84cd5765cd0da8e0f1ef9
7bf33ec2798ced7200876911413dbd51f3ffc032931e7d8549f05d61a94343c8
7d1c673ab93e90b90035f39e95c2248f683c873b87fbd62fc710fd52beb83800
80d54533f80e8233621f965ae0a7713928bdb4d491ed0eb5e90434550f1894cb
826fccc3cf47bae806a0d1c07482317b818c4eb75832451efcbc65a36bdc0f62
881c4b076088f01206a811394357f77cfb9fac060e5e66405aab12a683288b4d
bcb77aad9b7faf7e1a7ef064e5544870be80f729348be1996d7c9759658ef050
bfec4b47928e3f8009a00c2936ff9fce88518520035ced5aa50919c4e42b6409
c06498a30c738b01e8b9bd63af7b835ef8a00c6443499c1f1a2d1389da8ad932
c65f874979e362518756e4644d5669c8302fb3a254bf5d82d562a3961044a593
ce2d6d292d578f8e9d04de6f5fa14c801ae0a47e826c03fc971ef2ab2d7d4079
cebbd09229d3eda01266779e41f9db82ead949f9618731abe3dbcef03d15f0e2
d1f0f8c52e085ab6e6dd2b322dfef7a5789718118df1061cc000c03b11246bf1
d554361630709572f4c9e33d02ca5ae56275756099a62195513017a0421f73c2
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e411ec64ad16e53b0db03557ff1668c68a9b4d75153d9556e36a58422a1724c0
e634ba653b5b95c1f67b4e3560a74ed978b0bf93d2af2a69cdd66a9e95c1e6ee
e912bc971b76d0295ad9bbf671900f242e5699a81282b4d5a12a5f089c9e0f55
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0ad6a95853d727882281b2d61d5c94f618116a1f43150c5e457891a091024b1
f5f19594c492237f9cad7c2564a5f02b32117567afea246aa0b595558a4c6fe7

www.mtr.com.hk Open in urlscan Pro 95.101.111.161 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

50 Requests

100 %HTTPS

78 %IPv6

9 Domains

9 Subdomains

9 IPs

2 Countries

4874 kBTransfer

5727 kBSize

10 Cookies

7 Outgoing links

Page URL History

Redirected requests

50 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.mtr.com.hk Open in urlscan Pro
95.101.111.161 Public Scan

Screenshot
Live screenshot

Full Image

50
Requests

100 %
HTTPS

78 %
IPv6

9
Domains

9
Subdomains

9
IPs

2
Countries

4874 kB
Transfer

5727 kB
Size

10
Cookies

50 HTTP transactions
2 data transactions