egshges.com Open in urlscan Pro
156.248.55.46 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.239995.cc/
Effective URL:
http://egshges.com/client/
Submission: On December 04 via api (December 4th 2024, 1:16:35 pm UTC) from US — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 5 countries across 9 domains to perform 12 HTTP transactions. The main IP is 156.248.55.46, located in Hong Kong, Hong Kong and belongs to HIITL-AS-AP Hong Kong FireLine Network LTD, HK. The main domain is egshges.com.

This is the only time egshges.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	15.197.162.184 15.197.162.184	16509 (AMAZON-02) (AMAZON-02)
4	156.248.55.46 156.248.55.46	136950 (HIITL-AS-...) (HIITL-AS-AP Hong Kong FireLine Network LTD)
1	2404:2280:1cc... 2404:2280:1cc:0:715::3fb	24429 (TAOBAO Zh...) (TAOBAO Zhejiang Taobao Network Co.)
1	104.16.185.241 104.16.185.241	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.18.175.46 52.18.175.46	16509 (AMAZON-02) (AMAZON-02)
1	172.67.74.152 172.67.74.152	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.32.99.103 13.32.99.103	16509 (AMAZON-02) (AMAZON-02)
12	7

1 15.197.162.184 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a6008b9e03ae11d1d.awsglobalaccelerator.com

www.239995.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 156.248.55.46 (Hong Kong, Hong Kong)

ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK)

egshges.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:2280:1cc:0:715::3fb (Singapore)

ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN)

at.alicdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.185.241 (None, )

ASN13335 (CLOUDFLARENET, US)

ipv4.icanhazip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.18.175.46 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-175-46.eu-west-1.compute.amazonaws.com

checkip.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.74.152 (United States)

ASN13335 (CLOUDFLARENET, US)

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.99.103 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-103.fra60.r.cloudfront.net

m1.openfpcdn.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	egshges.com egshges.com	504 KB
1	openfpcdn.io m1.openfpcdn.io — Cisco Umbrella Rank: 87538	436 B
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2001	297 B
1	amazonaws.com checkip.amazonaws.com — Cisco Umbrella Rank: 6707	277 B
1	icanhazip.com ipv4.icanhazip.com — Cisco Umbrella Rank: 11318	392 B
1	alicdn.com at.alicdn.com — Cisco Umbrella Rank: 15149	19 KB
1	239995.cc 1 redirects www.239995.cc	252 B
0	whatismyipaddress.com Failed bot.whatismyipaddress.com Failed
0	amap.com Failed webapi.amap.com Failed
12	9

	Domain	Requested by
4	egshges.com	egshges.com
1	m1.openfpcdn.io	egshges.com
1	api.ipify.org	egshges.com
1	checkip.amazonaws.com	egshges.com
1	ipv4.icanhazip.com	egshges.com
1	at.alicdn.com	egshges.com
1	www.239995.cc	1 redirects
0	bot.whatismyipaddress.com Failed	egshges.com
0	webapi.amap.com Failed	egshges.com
12	9

This site contains no links.

Subject Issuer	Validity	Valid
*.tbcdn.cn GlobalSign Organization Validation CA - SHA256 - G3	`2024-06-19` - `2025-07-21`	a year	crt.sh
icanhazip.com WE1	`2024-10-29` - `2025-01-27`	3 months	crt.sh
ipify.org WE1	`2024-11-13` - `2025-02-11`	3 months	crt.sh
openfpcdn.io Amazon RSA 2048 M02	`2024-11-27` - `2025-12-27`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://egshges.com/client/
Frame ID: 813606B4EA8F3AA62797E0A6AE5527C5
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.239995.cc/ HTTP 307
https://www.239995.cc/ HTTP 302
http://egshges.com/client/ HTTP 307
https://egshges.com/client/ HTTP 307
http://egshges.com/client/ Page URL

Detected technologies

Zip (Payment processors) Expand

Overall confidence: 100%
Detected patterns

zip\.co

Page Statistics

12
Requests

33 %
HTTPS

14 %
IPv6

9
Domains

9
Subdomains

7
IPs

5
Countries

525 kB
Transfer

1948 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.239995.cc/ HTTP 307
https://www.239995.cc/ HTTP 302
http://egshges.com/client/ HTTP 307
https://egshges.com/client/ HTTP 307
http://egshges.com/client/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
egshges.com/client/
Redirect Chain

http://www.239995.cc/
https://www.239995.cc/
http://egshges.com/client/
https://egshges.com/client/
http://egshges.com/client/

885 B
1 KB

984ms
493ms

Document
text/html

156.248.55.46
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to

Full URL: http://egshges.com/client/
Protocol: HTTP/1.1
Server: 156.248.55.46 Hong Kong, Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software: nginx /
Resource Hash: c7f7bc6dda0e87b6a43a8ddee8e2cbf0a0be5347b820a00ea59a846f10feeb90

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Length: 885
Content-Type: text/html
Date: Wed, 04 Dec 2024 13:16:25 GMT
ETag: "67362902-375"
Last-Modified: Thu, 14 Nov 2024 16:44:50 GMT
Server: nginx

Redirect headers

Location: http://egshges.com/client/#/chat-page?kefuId=193619&type=0
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 font_830376_qzecyukz0s.css
at.alicdn.com/t/ 30 KB
19 KB 64ms
26ms Stylesheet
text/css 2404:2280:1cc:0:715::3fb
TAOBAO Zhejiang T...

General

Check archive.org

Show headers Download Go to

Full URL: https://at.alicdn.com/t/font_830376_qzecyukz0s.css
Requested by: Host: egshges.com
URL: http://egshges.com/client/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2404:2280:1cc:0:715::3fb , Singapore, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software: Tengine /
Resource Hash: 339a0f4d6b6b77b8da7983f5b348faea325073952bf633f53dcf56642f6d7bf0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: http://egshges.com/

Response headers

content-md5: WuCcFnBH1ZcyDfhhNllCog==
x-oss-storage-class: Standard
content-encoding: gzip
etag: W/"5AE09C167047D597320DF861365942A2"
age: 7099691
x-oss-object-type: Normal
x-cache: HIT TCP_MEM_HIT dirn:-2:-2
date: Fri, 13 Sep 2024 09:08:14 GMT
x-oss-server-time: 4
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Origin
last-modified: Sat, 25 Dec 2021 04:35:34 GMT
cache-control: max-age=63072000
x-swift-cachetime: 57927308
timing-allow-origin: *
x-oss-hash-crc64ecma: 7070895678695692031
via: ens-cache8.l2de3[0,0,200-0,H], ens-cache12.l2de3[0,0], ens-cache5.de5[0,0,200-0,H], ens-cache5.de5[1,0]
ali-swift-global-savetime: 1726218494
x-swift-savetime: Mon, 11 Nov 2024 22:13:06 GMT
access-control-allow-origin: *
eagleid: a3b55c9917333181859574052e
x-oss-request-id: 66E400FE9F70D63833F9E612
server: Tengine

GET
H/1.1 200
OK index.f66eff97.js Show response
egshges.com/client/assets/ 2 MB
445 KB 458ms
458ms Script
application/javascript 156.248.55.46
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to

Full URL: http://egshges.com/client/assets/index.f66eff97.js
Requested by: Host: egshges.com
URL: http://egshges.com/client/
Protocol: HTTP/1.1
Server: 156.248.55.46 Hong Kong, Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software: nginx /
Resource Hash: 9ac59f6dfbca7da58904346f41a0744f8d3da8d1a8247e8d267558c45d912a7f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: http://egshges.com
Referer: http://egshges.com/client/

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=2592000
Content-Encoding: gzip
ETag: W/"67362902-182868"
Connection: keep-alive
Expires: Fri, 03 Jan 2025 13:16:26 GMT
Date: Wed, 04 Dec 2024 13:16:26 GMT
Content-Type: application/javascript
Last-Modified: Thu, 14 Nov 2024 16:44:50 GMT
Server: nginx
Vary: Accept-Encoding

GET
H/1.1 200
OK index.c9c1aab3.css
egshges.com/client/assets/ 371 KB
57 KB 304ms
304ms Stylesheet
text/css 156.248.55.46
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to

Full URL: http://egshges.com/client/assets/index.c9c1aab3.css
Requested by: Host: egshges.com
URL: http://egshges.com/client/
Protocol: HTTP/1.1
Server: 156.248.55.46 Hong Kong, Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software: nginx /
Resource Hash: c9c1aab31ae1cfbf9bed7dca9650ace1f3f7b49629ed55f2521db08c5b4016fa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: http://egshges.com/client/

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=2592000
Content-Encoding: gzip
ETag: W/"67362902-5cde1"
Connection: keep-alive
Expires: Fri, 03 Jan 2025 13:16:26 GMT
Date: Wed, 04 Dec 2024 13:16:26 GMT
Content-Type: text/css
Last-Modified: Thu, 14 Nov 2024 16:44:50 GMT
Server: nginx
Vary: Accept-Encoding

GET maps
webapi.amap.com/ 0
0

GET
H3 200 / Show response
ipv4.icanhazip.com/ 11 B
392 B 46ms
23ms XHR
text/plain 104.16.185.241
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv4.icanhazip.com/
Requested by: Host: egshges.com
URL: http://egshges.com/client/assets/index.f66eff97.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.185.241 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c485f2759dd60843c487cbe1076a52f439fe27b95b4181738eb902c59d0f918

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer: http://egshges.com/

Response headers

access-control-allow-methods: GET
cf-ray: 8ecc1240aa3c6993-FRA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 11
server-timing: cfExtPri
date: Wed, 04 Dec 2024 13:16:30 GMT
content-type: text/plain
vary: Accept-Encoding
server: cloudflare
priority: u=1,i

GET
H/1.1 200 / Show response
checkip.amazonaws.com/ 11 B
277 B 79ms
29ms XHR
application/json 52.18.175.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://checkip.amazonaws.com/
Requested by: Host: egshges.com
URL: http://egshges.com/client/assets/index.f66eff97.js
Protocol: HTTP/1.1
Server: 52.18.175.46 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-175-46.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 3c485f2759dd60843c487cbe1076a52f439fe27b95b4181738eb902c59d0f918

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer: http://egshges.com/

Response headers

Access-Control-Allow-Origin: *
Content-Length: 11
Date: Wed, 04 Dec 2024 13:16:30 GMT
Content-Type: application/json
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Connection: keep-alive
Server: nginx

GET /
bot.whatismyipaddress.com/ 0
0

GET
H2 200 / Show response
api.ipify.org/ 10 B
297 B 121ms
95ms XHR
text/plain 172.67.74.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/
Requested by: Host: egshges.com
URL: http://egshges.com/client/assets/index.f66eff97.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.74.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c68bb2bd26efdb9bf1f9540c55b6eb35e59d6319c49516c3eaefed5230738bd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer: http://egshges.com/

Response headers

cf-cache-status: DYNAMIC
cf-ray: 8ecc1240baa2dca4-FRA
access-control-allow-origin: *
server-timing: cfL4;desc="?proto=TCP&rtt=6180&min_rtt=5933&rtt_var=1023&sent=8&recv=11&lost=0&retrans=0&sent_bytes=4027&recv_bytes=2205&delivery_rate=638184&cwnd=241&unsent_bytes=0&cid=14cb64f3b2e70590&ts=98&x=0"
content-length: 10
date: Wed, 04 Dec 2024 13:16:30 GMT
content-type: text/plain
vary: Origin
server: cloudflare

POST title
egshges.com/api/kefu/client/get/robot-reply/main/ 0
0

GET
H2 200 npm-monitoring Show response
m1.openfpcdn.io/fingerprintjs/v3.4.2/ 0
436 B 34ms
8ms XHR
text/plain 13.32.99.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m1.openfpcdn.io/fingerprintjs/v3.4.2/npm-monitoring

Requested by

Host: egshges.com
URL: http://egshges.com/client/assets/index.f66eff97.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.99.103 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-99-103.fra60.r.cloudfront.net

Software

CloudFront /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: http://egshges.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: public, max-age=630084, s-maxage=31205766
age: 7287016
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
via: 1.1 fa8c9f29fb8ef5c537a2a53f4de05240.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 0
alt-svc: h3=":443"; ma=86400
date: Wed, 11 Sep 2024 05:06:14 GMT
content-type: text/plain; charset=utf-8
x-amz-cf-pop: FRA60-P3
server: CloudFront
x-amz-cf-id: dVrrZBEWmMnCKcMlYG-psgwayvNkfEgA7AUuKD6p3DoufBYcIR4kyQ==

POST
H/1.1 200 login
egshges.com/api/kefu/client/ 45 B
377 B 258ms
256ms XHR
application/json 156.248.55.46
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to

Full URL: http://egshges.com/api/kefu/client/login
Requested by: Host: egshges.com
URL: http://egshges.com/client/assets/index.f66eff97.js
Protocol: HTTP/1.1
Server: 156.248.55.46 Hong Kong, Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: http://egshges.com/client/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykdmkHCzPinRgUjCA

Response headers

Transfer-Encoding: chunked
Content-Encoding: gzip
Date: Wed, 04 Dec 2024 13:16:30 GMT
Content-Type: application/json
Vary: Accept-Encoding
Server: nginx
Connection: keep-alive

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: webapi.amap.com
URL: https://webapi.amap.com/maps?callback=___onAPILoaded&v=2.0&key=db32c37cb8f3c2344722c986a083bf4a&plugin=AMap.PlaceSearch,AMap.CitySearch,AMap.Autocomplete

Domain: bot.whatismyipaddress.com
URL: http://bot.whatismyipaddress.com/

Domain: egshges.com
URL: http://egshges.com/api/kefu/client/get/robot-reply/main/title

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://bot.whatismyipaddress.com/ Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
rendering	warning	URL: http://egshges.com/client/#/chat-page?kefuId=193619&type=0 Message: [GroupMarkerNotSet(crbug.com/242999)!:A0A0E400742C0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.ipify.org
at.alicdn.com
bot.whatismyipaddress.com
checkip.amazonaws.com
egshges.com
ipv4.icanhazip.com
m1.openfpcdn.io
webapi.amap.com
www.239995.cc
bot.whatismyipaddress.com
egshges.com
webapi.amap.com
104.16.185.241
13.32.99.103
15.197.162.184
156.248.55.46
172.67.74.152
2404:2280:1cc:0:715::3fb
52.18.175.46
339a0f4d6b6b77b8da7983f5b348faea325073952bf633f53dcf56642f6d7bf0
3c485f2759dd60843c487cbe1076a52f439fe27b95b4181738eb902c59d0f918
6c68bb2bd26efdb9bf1f9540c55b6eb35e59d6319c49516c3eaefed5230738bd
9ac59f6dfbca7da58904346f41a0744f8d3da8d1a8247e8d267558c45d912a7f
c7f7bc6dda0e87b6a43a8ddee8e2cbf0a0be5347b820a00ea59a846f10feeb90
c9c1aab31ae1cfbf9bed7dca9650ace1f3f7b49629ed55f2521db08c5b4016fa
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

egshges.com Open in urlscan Pro 156.248.55.46 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

33 %HTTPS

14 %IPv6

9 Domains

9 Subdomains

7 IPs

5 Countries

525 kBTransfer

1948 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

egshges.com Open in urlscan Pro
156.248.55.46 Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

33 %
HTTPS

14 %
IPv6

9
Domains

9
Subdomains

7
IPs

5
Countries

525 kB
Transfer

1948 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions