English

session

consent_flags

usr_city

usr_country

city

dotcomtrack

pageLanguage

installation-id

gi_ls

transientID

usr_state

continent

GI_WEB_SDK_SONIC_DEVICE_ID

countryCode

The domain 'help.max.com' uses the commercial generic top-level domain (.com) and includes subdomain 'help'. The second-level label 'max' is 3 characters long containing 1 vowel alongside two consonants. It segments into 1 word: max. 'max' most strongly signals Tagalog. You will also see it in Afrikaans and Swedish contexts.

html/61/06/61065be5-0fc0-47df-bac4-a975eeeb1b2c.html.gz

appId=cid-v1:38480607-157f-41c1-a204-977504c52ed2

script-src 'self' blob: data: https: 'unsafe-inline' 'unsafe-eval';    connect-src 'self' ws: https:;    style-src 'self' 'unsafe-inline' https:;    font-src 'self' https: data:;    object-src 'none';    worker-src blob:;    img-src 'self' blob: data: https:;    frame-src 'self' blob: data: https:;    base-uri 'self';    form-action 'self';    frame-ancestors 'none';    upgrade-insecure-requests;

width=device-width, initial-scale=1, minimum-scale=1, shrink-to-fit=no

viewport

twitter:title

robots

https://beam-images.warnermediacdn.com/2025-07/Splash%20Screen%20HD%20720x480.jpg?host=wbd-dotcom-drupal-prd-us-east-1.s3.amazonaws.com

twitter:image

twitter:image:alt

twitter:card

twitter:site

We’re working to make HBO Max available wherever you are. 

description

twitter:description

next-head-count

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;worker-src blob: 'self';frame-ancestors 'none';

child-src https:  chrome-untrusted://new-tab-page/ chrome-untrusted://ntp-microsoft-auth/;connect-src chrome://resources chrome://theme 'self';default-src 'self';font-src chrome://resources 'self';img-src chrome://resources chrome://theme chrome://image chrome://favicon2 chrome://app-icon chrome://extension-icon chrome://fileicon blob: data: 'self';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources chrome://webui-test 'self';style-src chrome://resources chrome://theme 'self' 'unsafe-inline';trusted-types parse-html-subset sanitize-inner-html static-types webui-test-script webui-test-html polymer-html-literal polymer-template-event-attribute-policy lit-html-desktop;frame-ancestors 'none';

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;frame-ancestors 'none';

base-uri 'none';child-src https:;form-action https://ogs.google.com https://*.corp.google.com;object-src 'none';script-src 'self' 'unsafe-inline' https:;frame-ancestors chrome://new-tab-page/

Amazon EC2 Abuse

IP Management

Amazon AWS Network Operations

Amazon.com, Inc.

AWS RPKI Management POC

IP Routing

Amazon EC2 Network Operations

AMAZO-4


      Sentry.init({
        debug: false,
        environment: "prd",
        dsn: "https://6368c6b4e86aa9994326a99a11172d4b@o137140.ingest.us.sentry.io/4506990222966784"
      });
      Sentry.confi


    (function getGeoRedirect({
  countryLangUris,
  geoRedirectUrl,
  isUserOutOfRegion,
  userCountry,
  countryMappings
}) {
  const setCookieValue = (key, name) => {
    document.cookie = `${key}=


      import { NewSDK as LabsSDK, getSDKVersion } from "/js/labs-sdk-2.4.0.js";
      import ABTesting from '/js/ab-testing-module-0.252.2-pr-1419-06f6607d.js';

      const transientId = ABTesting.g

(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src

!function(a){var e="https://s.go-mpulse.net/boomerang/",t="addEventListener";if("False"=="True")a.BOOMR_config=a.BOOMR_config||{},a.BOOMR_config.PageParams=a.BOOMR_config.PageParams||{},a.BOOMR_config


    var OneTrust = {
     geolocationResponse: {
      countryCode: 'DE',
      stateCode: ''

    }
  };
  


  function OptanonWrapper() {
    if (document.getElementById('onetrust-banner-sdk')) {
      var acceptBtn = document.getElementById("onetrust-accept-btn-handler");
      var cookieSettingsBtn = doc

{"props":{"pageProps":{"mediaAppId":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJuZXR3b3JrIjoiaGJvbWF4IiwicHJvZHVjdCI6IndlYnNpdGVjbGlwcyIsInBsYXRmb3JtIjoid2ViIiwiYXBwSWQiOiJoYm9tYXgtd2Vic2l0ZWNsaXBzLXdlYi

window.sha256=function sha256(c){function f(r,t){return r>>>t|r<<32-t}for(var a,d,p=Math.pow,e=p(2,32),g="length",u="",k=[],h=8*c[g],b=sha256.h=sha256.h||[],q=sha256.k=sha256.k||[],m=q[g],l={},n=2;64>

function get30MinutesFromNow(){var a=new Date,b=30;b=b*60*1E3;a.setTime(a.getTime()+b);return a.toUTCString()}function setUtmCookie(a,b,c){document.cookie="utm_"+a+"\x3d"+b+";domain\x3dhbomax.com;path

(function(){var b="usr_country",c="DE";if(c&&""!==c){var a=2592E3;a*=1E3;var d=new Date;d.setTime(d.getTime()+a);a=google_tag_manager["rm"]["99168722"](635).split(".").slice(-2).join(".");b=[b+"\x3d"+

(function(){var b="usr_state",c="undefined";if(c&&""!==c){var a=2592E3;a*=1E3;var d=new Date;d.setTime(d.getTime()+a);a=google_tag_manager["rm"]["99168722"](636).split(".").slice(-2).join(".");b=[b+"\

(function(){var b="usr_city",c="falkenstein";if(c&&""!==c){var a=2592E3;a*=1E3;var d=new Date;d.setTime(d.getTime()+a);a=google_tag_manager["rm"]["99168722"](637).split(".").slice(-2).join(".");b=[b+"

(function(){var c="consent_flags",b=",,";if(b&&b!==""&&b!=="undefined"){var a=600,d=new Date;d.setTime(d.getTime()+a*1E3);a="www.hbomax.com";a=a.split(".").slice(-2).join(".");c=[c+"\x3d"+b,"expires\x

Script

Open-Graph-Protocol

OneTrust

Akamai Bot Manager

Microsoft ASP.NET

Google Tag Manager

Google Analytics

Availability | HBO Max

Google

Sentry

⚠️ High Risk - https://help.max.com/us/answer/detail/000002578

Requests	IP Address	Location	AS Autonomous System
49	75.2.44.249	United States	AS16509AMAZON-02
0	104.18.86.42	United States	AS13335CLOUDFLARENET
0	104.122.25.126	Frankfurt am Main, Hesse, Germany	AS16625AKAMAI-AS
0	142.250.181.232	United States	AS15169GOOGLE
0	13.248.241.232	United States	AS16509AMAZON-02
0	35.190.77.172	United States	AS396982GOOGLE-CLOUD-PLATFORM
0	23.36.162.209	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
0	151.101.66.217	San Francisco, California, United States	AS54113FASTLY
0	142.250.184.226	United States	AS15169GOOGLE
0	23.36.162.200	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
49	50	-	-

Security Scan Report: help.max.com

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Domain & IP Information

Detected Technologies6

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History