Submitted URL: http://www.uwants.com/attachment.php?aid=6107019
Effective URL: https://www.uwants.com/attachment.php?aid=6107019
Submission: On March 16 via manual from IN — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 4 HTTP transactions. The main IP is 104.18.7.51, located in and belongs to CLOUDFLARENET, US. The main domain is www.uwants.com. The Cisco Umbrella rank of the primary domain is 185843.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 14th 2022. Valid for: a year.
This is the only time www.uwants.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 104.18.6.51 13335 (CLOUDFLAR...)
3 104.18.7.51 13335 (CLOUDFLAR...)
4 2
Apex Domain
Subdomains
Transfer
4 uwants.com
www.uwants.com — Cisco Umbrella Rank: 185843
4 KB
0 overture.com Failed
cmh.hk.overture.com Failed
4 2
Domain Requested by
4 www.uwants.com 1 redirects www.uwants.com
0 cmh.hk.overture.com Failed www.uwants.com
4 2

This site contains links to these domains. Also see Links.

Domain
www.customs.gov.hk
secure1.info.gov.hk
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-06-14 -
2023-06-14
a year crt.sh

This page contains 1 frames:

Primary Page: https://www.uwants.com/attachment.php?aid=6107019
Frame ID: 4F3AB4993D66592E7A3EE529D3742C99
Requests: 4 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://www.uwants.com/attachment.php?aid=6107019 HTTP 302
    https://www.uwants.com/attachment.php?aid=6107019 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

4
Requests

75 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

3 kB
Transfer

6 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.uwants.com/attachment.php?aid=6107019 HTTP 302
    https://www.uwants.com/attachment.php?aid=6107019 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request attachment.php
www.uwants.com/
Redirect Chain
  • http://www.uwants.com/attachment.php?aid=6107019
  • https://www.uwants.com/attachment.php?aid=6107019
4 KB
3 KB
Document
General
Full URL
https://www.uwants.com/attachment.php?aid=6107019
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.7.51 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b360fa32cdcb8ce4218e94dcd6ab1e80d4a378d1c67232dc2ada69409622bb4f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7a8d511d58b18fd0-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Thu, 16 Mar 2023 13:24:31 GMT
nwtc_isnew
6413188f0d04c6.29690395
server
cloudflare
vary
Accept-Encoding

Redirect headers

CF-Cache-Status
DYNAMIC
CF-RAY
7a8d511b6850bba1-FRA
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Date
Thu, 16 Mar 2023 13:24:30 GMT
Location
https://www.uwants.com/attachment.php?aid=6107019
Server
cloudflare
Transfer-Encoding
chunked
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
overture.css
www.uwants.com/
1 KB
475 B
Stylesheet
General
Full URL
https://www.uwants.com/overture.css
Requested by
Host: www.uwants.com
URL: https://www.uwants.com/attachment.php?aid=6107019
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.7.51 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e03e2a11d992e8c654a4d634ca8bd858589cb0bd7fb589bb4910092d2a85796d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.uwants.com/attachment.php?aid=6107019
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Thu, 16 Mar 2023 13:24:31 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Fri, 04 Jan 2019 09:10:09 GMT
server
cloudflare
etag
W/"5c2f22f1-479"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000
cf-ray
7a8d511f0a988fd0-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Fri, 15 Mar 2024 13:24:31 GMT
attachment.js.php
www.uwants.com/
311 B
266 B
Script
General
Full URL
https://www.uwants.com/attachment.js.php
Requested by
Host: www.uwants.com
URL: https://www.uwants.com/attachment.php?aid=6107019
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.7.51 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8d272d49190238b4ac0eef160576d728565c033e8ae4de5fcd8cd5faad6d8873

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.uwants.com/attachment.php?aid=6107019
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Thu, 16 Mar 2023 13:24:31 GMT
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cf-ray
7a8d511f0a998fd0-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
/
cmh.hk.overture.com/js_flat_1_0/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
cmh.hk.overture.com
URL
http://cmh.hk.overture.com/js_flat_1_0/?config=6808370699&source=uwants_hk_ctxt&ctxtId=bank_finance_property_invest&ctxtUrl=https%3A%2F%2Fwww.uwants.com%2Fattachment.php%3Faid%3D6107019&ctxtCat=hk_default_entertainment&type=g31computer&maxCount=2

Verdicts & Comments Add Verdict or Comment

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| loadAd function| loadBtn object| randomAd string| jsact number| randomKey number| j number| no_ads undefined| descr undefined| unused1 undefined| clickURL undefined| title undefined| sitehost undefined| unused2 string| banner_ads string| banner_ads_top string| thread_ads

3 Cookies

Domain/Path Name / Value
.uwants.com/ Name: nwtc
Value: 6413188f0d04c6.29690395
.uwants.com/ Name: cdb_lastrequest
Value: DKdXPoeDrv7nlQZTqOs%2FfslN
.uwants.com/ Name: cdb_sid
Value: UuMBCq

3 Console Messages

Source Level URL
Text
javascript warning URL: https://www.uwants.com/attachment.php?aid=6107019(Line 28)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, http://cmh.hk.overture.com/js_flat_1_0/?config=6808370699&source=uwants_hk_ctxt&ctxtId=bank_finance_property_invest&ctxtUrl=https%3A%2F%2Fwww.uwants.com%2Fattachment.php%3Faid%3D6107019&ctxtCat=hk_default_entertainment&type=g31computer&maxCount=2, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
security error URL: https://www.uwants.com/attachment.php?aid=6107019(Line 28)
Message:
Mixed Content: The page at 'https://www.uwants.com/attachment.php?aid=6107019' was loaded over HTTPS, but requested an insecure script 'http://cmh.hk.overture.com/js_flat_1_0/?config=6808370699&source=uwants_hk_ctxt&ctxtId=bank_finance_property_invest&ctxtUrl=https%3A%2F%2Fwww.uwants.com%2Fattachment.php%3Faid%3D6107019&ctxtCat=hk_default_entertainment&type=g31computer&maxCount=2'. This request has been blocked; the content must be served over HTTPS.
javascript warning URL: https://www.uwants.com/attachment.php?aid=6107019(Line 28)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, http://cmh.hk.overture.com/js_flat_1_0/?config=6808370699&source=uwants_hk_ctxt&ctxtId=bank_finance_property_invest&ctxtUrl=https%3A%2F%2Fwww.uwants.com%2Fattachment.php%3Faid%3D6107019&ctxtCat=hk_default_entertainment&type=g31computer&maxCount=2, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cmh.hk.overture.com
www.uwants.com
cmh.hk.overture.com
104.18.6.51
104.18.7.51
8d272d49190238b4ac0eef160576d728565c033e8ae4de5fcd8cd5faad6d8873
b360fa32cdcb8ce4218e94dcd6ab1e80d4a378d1c67232dc2ada69409622bb4f
e03e2a11d992e8c654a4d634ca8bd858589cb0bd7fb589bb4910092d2a85796d