Public security report
85/100
A means lowest risk and F means highest, like a school report card. How the score is calculated →
Scanned 2026-10-30 · 11 issue(s) found · 13 checks passed
CyberTrust assessed hangseng.com passively — using only information that is publicly visible on the internet: DNS records, certificates, response headers and reachable services. The result is 85/100, grade B, where A means lowest risk and F means highest, like a school report card.
Email spoofing is blocked: hangseng.com publishes a DMARC record with p=reject at 100% coverage, so mail forged from @hangseng.com should be rejected by major providers.
Strongest area: external attack surface (100/100). Weakest area: HTTP security headers (42/100).
11 issue(s) need attention (11 low), while 13 checks passed.
Infrastructure observed: mail is hosted by proofpoint, traffic is fronted by cloudfront, the web server identifies as apache.
285 subdomain(s) of hangseng.com resolve publicly.
| Area | Score | Grade | Issues |
|---|---|---|---|
| DNS hygiene | 84 | B | 2 |
| email spoofing defences (SPF/DKIM/DMARC) | 84 | B | 2 |
| external attack surface | 100 | A | 0 |
| IP threat intelligence | — | — | 0 |
| reputation and credential exposure | 100 | A | 0 |
| TLS encryption and certificates | 88 | B | 1 |
| HTTP security headers | 42 | F | 6 |
The server does not staple the certificate revocation status. Every revocation check becomes an extra round trip to the CA, which slows the first visit and, if the CA endpoint is unreachable or the visitor's network blocks it, leaves the browser without a usable revocation status.
The policy is too permissive (script-src 'unsafe-inline'; script-src 'unsafe-eval'), so injected scripts still run while giving a false sense of security.
Without DKIM, mail integrity cannot be verified and DMARC loses one of its two authentication pillars. Note we probed only 46 common selectors, so a custom selector may exist.
Without it an attacker on the network path can force a downgrade to plaintext and read or modify mail such as contracts and payment details.
Missing Secure lets cookies travel in plaintext; missing HttpOnly lets injected scripts steal sessions; missing SameSite enables CSRF. Affected: TS01f477b4.
Without it, any injected script runs: session theft, fake payment forms, or card-skimming scripts on compromised pages. CSP limits the damage even when something else fails.
Even with HSTS on, the very first visit is still exposed to SSL-stripping: the header only takes effect after one successful HTTPS visit. Browsers ship a preload list (Chromium's list is used by Chrome, Edge, Safari and Firefox) so the first connection goes straight to HTTPS.
Without it any CA may issue certificates for your domain, enabling a lookalike site with a valid padlock.
Without it, attackers can poison caches or forge answers and send visitors to a lookalike server that harvests credentials.
At 126 days the protection expires between visits, periodically reopening the window for SSL stripping.
Without it a file uploaded as an image can be executed as HTML/JavaScript on your domain, stealing same-site cookies and sessions.
Everything above is what anyone can observe from the internet. Domain owners who verify ownership additionally get the full asset inventory — every subdomain with its open ports and running services — look-alike and typosquatting domains registered against the brand, credential-exposure monitoring, and copy-paste fixes for each finding.
Verify ownership of hangseng.com (free) → Open the live interactive report →