urlscan.io logo urlscan.io
SecurityTrails logo

ex.haoma116.com Open in urlscan Pro
61.160.192.94  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://mtw.so/61RqeQ
Effective URL: http://ex.haoma116.com/traffic.html?diversionType=intercept&longurl=aHR0cHM6Ly9jaGF0LndoYXRzYXBwLmNvbS9HVHZRbDJ4TTRJT0R...
Submission Tags: @phish_report
Submission: On December 23 via api from FI — Scanned from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 6 HTTP transactions. The main IP is 61.160.192.94, located in China and belongs to CHINANET-BACKBONE No.31,Jin-rong Street, CN. The main domain is ex.haoma116.com.
This is the only time ex.haoma116.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 110.249.196.101 4837 (CHINA169-...)
3 61.160.192.94 4134 (CHINANET-...)
2 1.62.64.108 4837 (CHINA169-...)
1 119.167.229.212 4837 (CHINA169-...)
6 3
Apex Domain
Subdomains		 Transfer
3 3w.cn
static.3w.cn
monitor.3w.cn
100 KB
3 haoma116.com
ex.haoma116.com
931 KB
1 mtw.so
mtw.so
907 B
6 3
Domain Requested by
3 ex.haoma116.com ex.haoma116.com
2 static.3w.cn ex.haoma116.com
1 monitor.3w.cn static.3w.cn
1 mtw.so 1 redirects
6 4

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://ex.haoma116.com/traffic.html?diversionType=intercept&longurl=aHR0cHM6Ly9jaGF0LndoYXRzYXBwLmNvbS9HVHZRbDJ4TTRJT0R3MU1BVU1lbXlp&domain=mtw.so&cookieid=2e0156c57707460fbe7ad377f01529d1&ewmUrl=aHR0cDovL3dlaXhpbi5xcS5jb20vci9aQk1sUGZ6RXpxR3hyYmhlOTBaMg==
Frame ID: 4C8D172E8E978E4BF20F13EA54FD9798
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Document

Page URL History Show full URLs

  1. http://mtw.so/61RqeQ HTTP 302
    http://ex.haoma116.com/traffic.html?diversionType=intercept&longurl=aHR0cHM6Ly9jaGF0LndoYXRzYXBwLmN... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

3
IPs

1
Countries

1031 kB
Transfer

1027 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://mtw.so/61RqeQ HTTP 302
    http://ex.haoma116.com/traffic.html?diversionType=intercept&longurl=aHR0cHM6Ly9jaGF0LndoYXRzYXBwLmNvbS9HVHZRbDJ4TTRJT0R3MU1BVU1lbXlp&domain=mtw.so&cookieid=2e0156c57707460fbe7ad377f01529d1&ewmUrl=aHR0cDovL3dlaXhpbi5xcS5jb20vci9aQk1sUGZ6RXpxR3hyYmhlOTBaMg== Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request traffic.html
ex.haoma116.com/
Redirect Chain
  • http://mtw.so/61RqeQ
  • http://ex.haoma116.com/traffic.html?diversionType=intercept&longurl=aHR0cHM6Ly9jaGF0LndoYXRzYXBwLmNvbS9HVHZRbDJ4TTRJT0R3MU1BVU1lbXlp&domain=mtw.so&cookieid=2e0156c57707460fbe7ad377f01529d1&ewmUrl=a...
9 KB
9 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://ex.haoma116.com/traffic.html?diversionType=intercept&longurl=aHR0cHM6Ly9jaGF0LndoYXRzYXBwLmNvbS9HVHZRbDJ4TTRJT0R3MU1BVU1lbXlp&domain=mtw.so&cookieid=2e0156c57707460fbe7ad377f01529d1&ewmUrl=aHR0cDovL3dlaXhpbi5xcS5jb20vci9aQk1sUGZ6RXpxR3hyYmhlOTBaMg==
Protocol
HTTP/1.1
Server
61.160.192.94 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
Tengine /
Resource Hash
47a59e64294ce0152e3e8b616693179416524c9c2754be325e8186f3a878deb8

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Headers
X-Requested-With
Access-Control-Allow-Methods
GET,POST,OPTIONS
Age
0
Ali-Swift-Global-Savetime
1703345487
Connection
keep-alive
Content-Length
8943
Content-Type
text/html; charset=utf-8
Date
Sat, 23 Dec 2023 15:31:27 GMT
ETag
"656982c9-22ef"
EagleId
3da0c00b17033454867293780e
Last-Modified
Fri, 01 Dec 2023 06:52:57 GMT
Server
Tengine
Timing-Allow-Origin
*
Vary
Accept-Encoding
Via
cache37.l2cn1816[73,72,200-0,M], cache54.l2cn1816[73,0], kunlun3.cn6425[397,397,200-0,M], kunlun1.cn6425[401,0]
X-Cache
MISS TCP_MISS dirn:-2:-2
X-Swift-CacheTime
3600
X-Swift-SaveTime
Sat, 23 Dec 2023 15:31:27 GMT

Redirect headers

Cache-Control
must-revalidate, no-store
Connection
keep-alive
Content-Length
0
Content-Type
text/html;charset=UTF-8
Date
Sat, 23 Dec 2023 15:31:24 GMT
Location
http://ex.haoma116.com/traffic.html?diversionType=intercept&longurl=aHR0cHM6Ly9jaGF0LndoYXRzYXBwLmNvbS9HVHZRbDJ4TTRJT0R3MU1BVU1lbXlp&domain=mtw.so&cookieid=2e0156c57707460fbe7ad377f01529d1&ewmUrl=aHR0cDovL3dlaXhpbi5xcS5jb20vci9aQk1sUGZ6RXpxR3hyYmhlOTBaMg==
Pragma
no-cache
Server
dwzServer
X-Cache-Lookup
Cache Miss Cache Miss
X-NWS-LOG-UUID
1023959905824438014
icon_close.png
ex.haoma116.com/images/ 		918 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://ex.haoma116.com/images/icon_close.png
Requested by
Host: ex.haoma116.com
URL: http://ex.haoma116.com/traffic.html?diversionType=intercept&longurl=aHR0cHM6Ly9jaGF0LndoYXRzYXBwLmNvbS9HVHZRbDJ4TTRJT0R3MU1BVU1lbXlp&domain=mtw.so&cookieid=2e0156c57707460fbe7ad377f01529d1&ewmUrl=aHR0cDovL3dlaXhpbi5xcS5jb20vci9aQk1sUGZ6RXpxR3hyYmhlOTBaMg==
Protocol
HTTP/1.1
Server
61.160.192.94 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
Tengine /
Resource Hash
b56c5626e5648044774ec5aeb47fff1a8ac72478dae97814e0143adc4544f321

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://ex.haoma116.com/traffic.html?diversionType=intercept&longurl=aHR0cHM6Ly9jaGF0LndoYXRzYXBwLmNvbS9HVHZRbDJ4TTRJT0R3MU1BVU1lbXlp&domain=mtw.so&cookieid=2e0156c57707460fbe7ad377f01529d1&ewmUrl=aHR0cDovL3dlaXhpbi5xcS5jb20vci9aQk1sUGZ6RXpxR3hyYmhlOTBaMg==
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Sat, 23 Dec 2023 15:12:50 GMT
Via
cache21.l2cn1816[0,0,200-0,H], cache33.l2cn1816[0,0], kunlun2.cn6425[0,0,200-0,H], kunlun1.cn6425[1,0]
Age
1117
X-Swift-CacheTime
3600
X-Cache
HIT TCP_MEM_HIT dirn:9:727223601
Connection
keep-alive
X-Swift-SaveTime
Sat, 23 Dec 2023 15:20:34 GMT
Content-Length
918
Last-Modified
Fri, 01 Dec 2023 06:52:57 GMT
Server
Tengine
ETag
"656982c9-396"
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Type
image/png
Ali-Swift-Global-Savetime
1703344370
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With
EagleId
3da0c00b17033454874555883e
jquery-3.2.1.min.js
static.3w.cn/static/3w.cn/js/ 		85 KB
85 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://static.3w.cn/static/3w.cn/js/jquery-3.2.1.min.js
Requested by
Host: ex.haoma116.com
URL: http://ex.haoma116.com/traffic.html?diversionType=intercept&longurl=aHR0cHM6Ly9jaGF0LndoYXRzYXBwLmNvbS9HVHZRbDJ4TTRJT0R3MU1BVU1lbXlp&domain=mtw.so&cookieid=2e0156c57707460fbe7ad377f01529d1&ewmUrl=aHR0cDovL3dlaXhpbi5xcS5jb20vci9aQk1sUGZ6RXpxR3hyYmhlOTBaMg==
Protocol
HTTP/1.1
Server
1.62.64.108 , China, ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN),
Reverse DNS
Software
nginx/1.12.2 /
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://ex.haoma116.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Sat, 23 Dec 2023 15:31:33 GMT
X-Cache-Lookup
Cache Miss, Cache Miss
Last-Modified
Fri, 31 Mar 2023 03:11:15 GMT
Server
nginx/1.12.2
ETag
"64264f53-15283"
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Content-Length,Content-Range
Access-Control-Allow-Credentials
true
X-NWS-LOG-UUID
13412128872838231161
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
DNT,web-token,app-token,Authorization,Accept,Origin,Keep-Alive,User-Agent,X-Mx-ReqToken,X-Data-Type,X-Auth-Token,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Content-Length
86659
jquery.qrcode.min.js
static.3w.cn/static/home/js/ 		14 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://static.3w.cn/static/home/js/jquery.qrcode.min.js
Requested by
Host: ex.haoma116.com
URL: http://ex.haoma116.com/traffic.html?diversionType=intercept&longurl=aHR0cHM6Ly9jaGF0LndoYXRzYXBwLmNvbS9HVHZRbDJ4TTRJT0R3MU1BVU1lbXlp&domain=mtw.so&cookieid=2e0156c57707460fbe7ad377f01529d1&ewmUrl=aHR0cDovL3dlaXhpbi5xcS5jb20vci9aQk1sUGZ6RXpxR3hyYmhlOTBaMg==
Protocol
HTTP/1.1
Server
1.62.64.108 , China, ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN),
Reverse DNS
Software
nginx/1.12.2 /
Resource Hash
f4ccf02b69092819ac24575c717a080c3b6c6d6161f1b8d82bf0bb523075032d

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://ex.haoma116.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Sat, 23 Dec 2023 15:31:30 GMT
X-Cache-Lookup
Cache Miss, Cache Miss
Last-Modified
Thu, 02 Sep 2021 10:01:06 GMT
Server
nginx/1.12.2
ETag
"6130a0e2-36ab"
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Content-Length,Content-Range
Access-Control-Allow-Credentials
true
X-NWS-LOG-UUID
10442369433974186995
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
DNT,web-token,app-token,Authorization,Accept,Origin,Keep-Alive,User-Agent,X-Mx-ReqToken,X-Data-Type,X-Auth-Token,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Content-Length
13995
traffic_model3.png
ex.haoma116.com/images/ 		919 KB
920 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://ex.haoma116.com/images/traffic_model3.png
Requested by
Host: ex.haoma116.com
URL: http://ex.haoma116.com/traffic.html?diversionType=intercept&longurl=aHR0cHM6Ly9jaGF0LndoYXRzYXBwLmNvbS9HVHZRbDJ4TTRJT0R3MU1BVU1lbXlp&domain=mtw.so&cookieid=2e0156c57707460fbe7ad377f01529d1&ewmUrl=aHR0cDovL3dlaXhpbi5xcS5jb20vci9aQk1sUGZ6RXpxR3hyYmhlOTBaMg==
Protocol
HTTP/1.1
Server
61.160.192.94 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
Tengine /
Resource Hash
394aad1bb2e81a51a7564531fa344a66930d1b1a958921ba097da964351f2a7c

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://ex.haoma116.com/traffic.html?diversionType=intercept&longurl=aHR0cHM6Ly9jaGF0LndoYXRzYXBwLmNvbS9HVHZRbDJ4TTRJT0R3MU1BVU1lbXlp&domain=mtw.so&cookieid=2e0156c57707460fbe7ad377f01529d1&ewmUrl=aHR0cDovL3dlaXhpbi5xcS5jb20vci9aQk1sUGZ6RXpxR3hyYmhlOTBaMg==
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Sat, 23 Dec 2023 15:20:35 GMT
Via
cache4.l2cn1816[65,66,200-0,M], cache23.l2cn1816[68,0], kunlun7.cn6425[0,1,200-0,H], kunlun8.cn6425[7,0]
Age
652
X-Swift-CacheTime
3600
X-Cache
HIT TCP_MEM_HIT dirn:10:323085081
Connection
keep-alive
X-Swift-SaveTime
Sat, 23 Dec 2023 15:20:35 GMT
Content-Length
941524
Last-Modified
Fri, 01 Dec 2023 06:52:49 GMT
Server
Tengine
ETag
"656982c1-e5dd4"
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Type
image/png
Ali-Swift-Global-Savetime
1703344835
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With
EagleId
3da0c01217033454874763866e
monitor
monitor.3w.cn/operLog/ 		28 B
472 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://monitor.3w.cn/operLog/monitor
Requested by
Host: static.3w.cn
URL: http://static.3w.cn/static/3w.cn/js/jquery-3.2.1.min.js
Protocol
HTTP/1.1
Server
119.167.229.212 , China, ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN),
Reverse DNS
Software
Lego Server /
Resource Hash
981e3134f172cdb835c483f32e68ed2fc64d7d01c22284d689f166291f9275a0

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
http://ex.haoma116.com/
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Sat, 23 Dec 2023 15:31:37 GMT
X-Cache-Lookup
Cache Miss, Hit From Upstream Cluster, Cache Miss
Server
Lego Server
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Transfer-Encoding
chunked
Content-Type
application/json;charset=UTF-8
Access-Control-Allow-Origin
*
X-NWS-LOG-UUID
18322067002246806611
Connection
keep-alive

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery number| c2 number| c1

3 Cookies

Domain/Path Name / Value
mtw.so/ Name: JSESSIONID
Value: 85BBBBA520EDDD5609D3ACAE9F666753
.mtw.so/ Name: sitename
Value: 2e0156c57707460fbe7ad377f01529d1
mtw.so/ Name: jsessionid
Value: d5a4e09d563b4bf0848f16ced7183b61