HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=utf-8
Location: https://secure.americanexpress.com.bh/online/login
Date: Thu, 18 Apr 2024 12:29:24 GMT
Connection: close
Content-Length: 167

HTTP/2 200 OK
etag: "356ef-604af0d1c2480"
last-modified: Wed, 06 Sep 2023 11:29:06 GMT
content-type: application/x-javascript
content-length: 36726
content-encoding: gzip
cache-control: max-age=15723, public
expires: Thu, 18 Apr 2024 16:51:29 GMT
date: Thu, 18 Apr 2024 12:29:26 GMT
strict-transport-security: max-age=31536000
x-cdn: Imperva
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
x-iinfo: 12-7121977-7115872 2CNN RT(1713443364909 1733) q(0 0 0 -1) r(0 0)
X-Firefox-Spdy: h2

HTTP/2 200 OK
etag: "72c-604af0d1c2480"
last-modified: Wed, 06 Sep 2023 11:29:06 GMT
content-type: application/x-javascript
content-length: 726
content-encoding: gzip
cache-control: max-age=15723, public
expires: Thu, 18 Apr 2024 16:51:29 GMT
date: Thu, 18 Apr 2024 12:29:26 GMT
strict-transport-security: max-age=31536000
x-cdn: Imperva
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
x-iinfo: 12-7121977-7117869 2CNN RT(1713443364909 1735) q(0 0 0 -1) r(0 0)
X-Firefox-Spdy: h2

HTTP/2 200 OK
etag: "524-615451ac04980"
last-modified: Thu, 04 Apr 2024 13:13:26 GMT
content-type: application/x-javascript
content-length: 751
content-encoding: gzip
cache-control: max-age=33255, public
expires: Thu, 18 Apr 2024 21:43:41 GMT
date: Thu, 18 Apr 2024 12:29:26 GMT
strict-transport-security: max-age=31536000
x-cdn: Imperva
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
x-iinfo: 12-7121977-7115874 2CNN RT(1713443364909 1737) q(0 0 0 -1) r(0 0)
X-Firefox-Spdy: h2

HTTP/2 200 OK
etag: "8686-615451ac04980"
last-modified: Thu, 04 Apr 2024 13:13:26 GMT
content-type: application/x-javascript
content-length: 12186
content-encoding: gzip
cache-control: max-age=33256, public
expires: Thu, 18 Apr 2024 21:43:42 GMT
date: Thu, 18 Apr 2024 12:29:26 GMT
strict-transport-security: max-age=31536000
x-cdn: Imperva
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
x-iinfo: 12-7121977-7117869 2CNN RT(1713443364909 1740) q(0 0 0 -1) r(0 0)
X-Firefox-Spdy: h2

HTTP/2 200 OK
etag: "3b271-615451ac04980"
last-modified: Thu, 04 Apr 2024 13:13:26 GMT
content-type: application/x-javascript
content-length: 64743
content-encoding: gzip
cache-control: max-age=33256, public
expires: Thu, 18 Apr 2024 21:43:42 GMT
date: Thu, 18 Apr 2024 12:29:26 GMT
strict-transport-security: max-age=31536000
x-cdn: Imperva
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
x-iinfo: 12-7121977-7117906 2CNN RT(1713443364909 1743) q(0 0 0 -1) r(0 0)
X-Firefox-Spdy: h2

HTTP/2 200 OK
etag: "9d5c0-615451ac04980"
last-modified: Thu, 04 Apr 2024 13:13:26 GMT
content-type: text/css
content-length: 95015
content-encoding: gzip
cache-control: max-age=33255, public
expires: Thu, 18 Apr 2024 21:43:41 GMT
date: Thu, 18 Apr 2024 12:29:26 GMT
strict-transport-security: max-age=31536000
x-cdn: Imperva
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
x-iinfo: 12-7121977-7103103 2CNN RT(1713443364909 1749) q(0 0 0 -1) r(0 0)
X-Firefox-Spdy: h2

HTTP/2 200 OK
content-type: font/woff
content-length: 37153
last-modified: Mon, 07 Dec 2020 17:08:13 GMT
etag: "5fce617d-9121"
timing-allow-origin: *
cache-control: max-age=31536000, must-revalidate
access-control-allow-methods: GET
accept-ranges: bytes
date: Thu, 18 Apr 2024 12:29:27 GMT
vary: Origin, Accept-Encoding
access-control-allow-origin: https://secure.americanexpress.com.bh
X-Firefox-Spdy: h2

HTTP/2 200 OK
etag: "19111c-615451ac04980"
last-modified: Thu, 04 Apr 2024 13:13:26 GMT
content-type: application/x-javascript
content-length: 438425
content-encoding: gzip
cache-control: max-age=33255, public
expires: Thu, 18 Apr 2024 21:43:41 GMT
date: Thu, 18 Apr 2024 12:29:26 GMT
strict-transport-security: max-age=31536000
x-cdn: Imperva
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
x-iinfo: 12-7121977-7115874 2CNN RT(1713443364909 1746) q(0 0 0 -1) r(0 0)
X-Firefox-Spdy: h2

HTTP/2 200 OK
content-type: text/javascript
cache-control: max-age=60
content-encoding: gzip
access-control-allow-origin: *
server-timing: bon, total;dur=12.853951
server: bon
content-length: 75781
date: Thu, 18 Apr 2024 12:29:26 GMT
set-cookie: nlbi_1589144_2147483392=FdR+TydwjWbIrLYnXj0dcwAAAADZkp6wAGC7MvseAkLZCXpw; path=/; Domain=.americanexpress.com.bh; Secure; SameSite=None
strict-transport-security: max-age=31536000
x-cdn: Imperva
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
x-iinfo: 12-7121977-7122073 NNNN CT(8 7 0) RT(1713443364909 1731) q(0 0 0 -1) r(0 1)
X-Firefox-Spdy: h2

HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Thu, 18 Apr 2024 12:29:27 GMT
expires: Thu, 18 Apr 2024 12:29:27 GMT
cache-control: private, max-age=900
last-modified: Thu, 18 Apr 2024 12:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 71828
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

HTTP/2 200 OK
etag: "2ee609-615451ac04980"
last-modified: Thu, 04 Apr 2024 13:13:26 GMT
content-type: application/x-javascript
content-length: 642516
content-encoding: gzip
cache-control: max-age=33256, public
expires: Thu, 18 Apr 2024 21:43:42 GMT
date: Thu, 18 Apr 2024 12:29:26 GMT
strict-transport-security: max-age=31536000
x-cdn: Imperva
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
x-iinfo: 12-7121977-7117869 2CNN RT(1713443364909 1748) q(0 0 0 -1) r(0 0)
X-Firefox-Spdy: h2

HTTP/2 200 OK
content-type: font/woff
content-length: 37153
last-modified: Mon, 07 Dec 2020 17:08:13 GMT
etag: "5fce617d-9121"
timing-allow-origin: *
cache-control: max-age=31536000, must-revalidate
access-control-allow-methods: GET
accept-ranges: bytes
date: Thu, 18 Apr 2024 12:29:27 GMT
vary: Origin, Accept-Encoding
access-control-allow-origin: https://secure.americanexpress.com.bh
X-Firefox-Spdy: h2

HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Thu, 18 Apr 2024 12:29:27 GMT
expires: Thu, 18 Apr 2024 12:29:27 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 93067
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

HTTP/2 200 OK
content-type: font/woff
content-length: 49856
last-modified: Mon, 07 Dec 2020 17:08:16 GMT
etag: "5fce6180-c2c0"
timing-allow-origin: *
cache-control: max-age=31536000, must-revalidate
access-control-allow-methods: GET
accept-ranges: bytes
date: Thu, 18 Apr 2024 12:29:28 GMT
vary: Origin, Accept-Encoding
access-control-allow-origin: https://secure.americanexpress.com.bh
X-Firefox-Spdy: h2

HTTP/2 200 OK
etag: "1b7c3-604af0d1c2480"
last-modified: Wed, 06 Sep 2023 11:29:06 GMT
content-type: application/x-javascript
content-length: 23139
content-encoding: gzip
cache-control: max-age=15723, public
expires: Thu, 18 Apr 2024 16:51:30 GMT
date: Thu, 18 Apr 2024 12:29:27 GMT
strict-transport-security: max-age=31536000
x-cdn: Imperva
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
x-iinfo: 12-7121977-7115874 2CNN RT(1713443364909 2924) q(0 0 0 -1) r(0 0)
X-Firefox-Spdy: h2

HTTP/1.1 200 OK
Access-Control-Allow-Headers: app-id,app-platform,app-version,device-id,device-location,ip-address
Access-Control-Allow-Methods: GET, POST, HEAD, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 7200
Date: Thu, 18 Apr 2024 12:29:28 GMT
Content-Length: 0

HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Type: application/json; charset=utf-8
Date: Thu, 18 Apr 2024 12:29:28 GMT
Content-Length: 277

HTTP/2 200 OK
cache-control: no-cache, no-store
content-type: text/plain
x-robots-tag: noindex
content-length: 0
set-cookie: visid_incap_1589144=KbjeW6DGSLyxWB4xKOLScycSIWYAAAAAQUIPAAAAAABrkCDvaoa7mCIozVyYv7po; expires=Thu, 17 Apr 2025 22:20:58 GMT; HttpOnly; path=/; Domain=.americanexpress.com.bh; Secure; SameSite=None
incap_ses_722_1589144=rbYlMY94cH6BArq1Mw8FCicSIWYAAAAAGidPQ13FokftbfW7zMIUug==; path=/; Domain=.americanexpress.com.bh; Secure; SameSite=None
strict-transport-security: max-age=31536000
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
X-Firefox-Spdy: h2

HTTP/2 200 OK
cross-origin-resource-policy: cross-origin
content-type: text/javascript; charset=UTF-8
timing-allow-origin: *
cache-control: public, max-age=1800
vary: Origin, X-Origin, Referer
content-encoding: gzip
date: Thu, 18 Apr 2024 12:29:28 GMT
server: scaffolding on HTTPServer2
content-length: 65902
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

HTTP/2 200 OK
content-type: application/json; charset=UTF-8
vary: Origin, X-Origin, Referer
content-encoding: gzip
date: Thu, 18 Apr 2024 12:29:28 GMT
server: scaffolding on HTTPServer2
cache-control: private
content-length: 23
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
access-control-allow-origin: https://secure.americanexpress.com.bh
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

HTTP/2 200 OK
date: Thu, 18 Apr 2024 12:29:28 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
x-content-type-options: nosniff
x-xss-protection: 0
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: SAMEORIGIN, DENY
content-security-policy: frame-ancestors 'self' https://secure.americanexpress.com.bh https://www.americanexpress.ae http://image.message.americanexpress.com.bh;
content-type: application/json
content-language: en-US
x-cdn: Imperva
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
content-encoding: gzip
x-iinfo: 12-7121977-7122110 NNYY CT(287 303 0) RT(1713443364909 2928) q(0 0 0 -1) r(3 3) U2
X-Firefox-Spdy: h2

HTTP/2 200 OK
date: Thu, 18 Apr 2024 12:29:28 GMT
x-frame-options: SAMEORIGIN
last-modified: Thu, 04 Apr 2024 13:13:26 GMT
etag: "4f029-615451ac04980"
accept-ranges: bytes
content-length: 323625
content-security-policy: frame-ancestors 'self' https://secure.americanexpress.com.bh https://www.americanexpress.ae http://image.message.americanexpress.com.bh;
content-type: image/png
strict-transport-security: max-age=31536000
x-cdn: Imperva
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
x-iinfo: 12-7121977-7115874 2NNN RT(1713443364909 2931) q(0 0 0 -1) r(6 6) U18
X-Firefox-Spdy: h2

HTTP/2 200 OK
date: Thu, 18 Apr 2024 12:29:28 GMT
x-frame-options: SAMEORIGIN
last-modified: Thu, 28 Mar 2024 08:32:08 GMT
etag: "3dcc8-614b45bdad200"
accept-ranges: bytes
content-length: 253128
content-security-policy: frame-ancestors 'self' https://secure.americanexpress.com.bh https://www.americanexpress.ae http://image.message.americanexpress.com.bh;
strict-transport-security: max-age=31536000
x-cdn: Imperva
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
x-iinfo: 12-7121977-7121980 PNNN RT(1713443364909 2926) q(0 0 0 -1) r(5 5) U12
X-Firefox-Spdy: h2

HTTP/2 200 OK
content-type: font/woff
content-length: 37949
last-modified: Mon, 07 Dec 2020 17:08:13 GMT
etag: "5fce617d-943d"
timing-allow-origin: *
cache-control: max-age=31536000, must-revalidate
access-control-allow-methods: GET
accept-ranges: bytes
date: Thu, 18 Apr 2024 12:29:30 GMT
vary: Origin, Accept-Encoding
access-control-allow-origin: https://secure.americanexpress.com.bh
X-Firefox-Spdy: h2

HTTP/2 200 OK
cache-control: no-cache, no-store
content-type: text/plain
x-robots-tag: noindex
content-length: 0
set-cookie: visid_incap_1589144=KbjeW6DGSLyxWB4xKOLScycSIWYAAAAAQUIPAAAAAABrkCDvaoa7mCIozVyYv7po; expires=Thu, 17 Apr 2025 22:20:58 GMT; HttpOnly; path=/; Domain=.americanexpress.com.bh; Secure; SameSite=None
incap_ses_722_1589144=dXk5eFgm4nuBArq1Mw8FCiwSIWYAAAAAhtmz6KvsBf3CfFR0+SEn9w==; path=/; Domain=.americanexpress.com.bh; Secure; SameSite=None
strict-transport-security: max-age=31536000
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
X-Firefox-Spdy: h2

HTTP/3 200 OK
accept-ranges: bytes
content-encoding: br
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-length: 57059
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 17 Apr 2024 17:31:04 GMT
expires: Thu, 17 Apr 2025 17:31:04 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 08 Apr 2024 17:52:08 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
age: 68309
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

HTTP/3 200 OK
accept-ranges: bytes
content-encoding: br
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-length: 57388
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 17 Apr 2024 17:31:04 GMT
expires: Thu, 17 Apr 2025 17:31:04 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 08 Apr 2024 17:52:08 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
age: 68309
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

HTTP/2 200 OK
date: Thu, 18 Apr 2024 12:29:29 GMT
x-frame-options: SAMEORIGIN
last-modified: Wed, 06 Sep 2023 11:30:02 GMT
etag: "693-604af1072a280"
accept-ranges: bytes
content-security-policy: frame-ancestors 'self' https://secure.americanexpress.com.bh https://www.americanexpress.ae http://image.message.americanexpress.com.bh;
content-type: image/svg+xml
strict-transport-security: max-age=31536000
x-cdn: Imperva
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
content-encoding: gzip
x-iinfo: 12-7121977-7117869 2NYN RT(1713443364909 2930) q(0 0 0 -1) r(14 14)
X-Firefox-Spdy: h2

HTTP/2 200 OK
date: Thu, 18 Apr 2024 12:29:26 GMT
x-frame-options: SAMEORIGIN
last-modified: Thu, 04 Apr 2024 13:13:34 GMT
etag: "11ec-615451b3a5b80"
accept-ranges: bytes
content-security-policy: frame-ancestors 'self' https://secure.americanexpress.com.bh https://www.americanexpress.ae http://image.message.americanexpress.com.bh;
content-type: text/html
set-cookie: visid_incap_1589144=pUlDhnFQRtyw3zXpOU6z1SQSIWYAAAAAQUIPAAAAAAAqYksTRJvPEYJCMzUVe9yB; expires=Thu, 17 Apr 2025 22:20:58 GMT; HttpOnly; path=/; Domain=.americanexpress.com.bh; Secure; SameSite=None
nlbi_1589144=rzKNTqpCN2AjO5ayXj0dcwAAAAClm3lxj+jGHwD4pE+gBj02; path=/; Domain=.americanexpress.com.bh; Secure; SameSite=None
incap_ses_722_1589144=7+cDNnDU5x24Abq1Mw8FCiYSIWYAAAAAk0MZ4YFVPTWPSGdj2NQC7g==; path=/; Domain=.americanexpress.com.bh; Secure; SameSite=None
x-incap-sess-cookie-hdr: 4nEjdbaMzAy4Abq1Mw8FCiYSIWYAAAAAgNABLO5KJbRyspzIIX/tZQ==
strict-transport-security: max-age=31536000
x-cdn: Imperva
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
content-encoding: gzip
x-iinfo: 12-7121977-7121980 NNYN CT(479 501 0) RT(1713443364909 31) q(0 0 10 0) r(15 15) U12
X-Firefox-Spdy: h2

HTTP/2 200 OK
date: Thu, 18 Apr 2024 12:29:28 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
x-content-type-options: nosniff
x-xss-protection: 0
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: SAMEORIGIN, DENY
content-security-policy: frame-ancestors 'self' https://secure.americanexpress.com.bh https://www.americanexpress.ae http://image.message.americanexpress.com.bh;
content-type: application/json
content-language: en-US
x-cdn: Imperva
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
content-encoding: gzip
x-iinfo: 12-7121977-7122112 NNYY CT(216 230 0) RT(1713443364909 2929) q(0 0 0 -1) r(3 3) U2
X-Firefox-Spdy: h2

HTTP/2 200 OK
date: Thu, 18 Apr 2024 12:29:29 GMT
x-frame-options: SAMEORIGIN
last-modified: Wed, 06 Sep 2023 11:30:40 GMT
etag: "54e-604af12b67800"
accept-ranges: bytes
content-length: 1358
content-security-policy: frame-ancestors 'self' https://secure.americanexpress.com.bh https://www.americanexpress.ae http://image.message.americanexpress.com.bh;
content-type: image/x-icon
strict-transport-security: max-age=31536000
x-cdn: Imperva
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
x-iinfo: 12-7121977-7115872 2NNN RT(1713443364909 4012) q(0 0 0 -1) r(3 3)
X-Firefox-Spdy: h2

HTTP/2 200 OK
content-type: application/json
cache-control: no-cache, no-store
access-control-allow-origin: *
server-timing: bon, total;dur=53.542280999999996
server: bon
date: Thu, 18 Apr 2024 12:29:28 GMT
set-cookie: nlbi_1589144_2147483392=qXvmLNmX5xWSGvNOXj0dcwAAAAA+b6xsiCNXTqmkANEvNSjE; path=/; Domain=.americanexpress.com.bh; Secure; SameSite=None
strict-transport-security: max-age=31536000
x-cdn: Imperva
content-security-policy-report-only: default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.aexp-static.com *.googleapis.com *.doubleclick.net *.gstatic.com use.typekit.net analytics.google.com www.googletagmanager.com www.google-analytics.com www.datocms-assets.com pro.ip-api.com maps.google.com www.google.com ; form-action 'none' ; frame-ancestors 'self' ; report-uri /csp_report
content-encoding: gzip
x-iinfo: 12-7121977-7122073 PNYN RT(1713443364909 3596) q(0 0 0 -1) r(0 0) U6
X-Firefox-Spdy: h2