canddy.xyz Open in urlscan Pro
34.73.83.172  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response canddy.xyz/	21 KB 5 KB	108ms 23ms	Document text/html	34.73.83.172 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://canddy.xyz/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.73.83.172 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 172.83.73.34.bc.googleusercontent.com Software Netlify / Resource Hash 851343b16173359448875068ef05469e617a9cab282e8cd7ab3cf106426001d3 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language en-US,en;q=0.9 Response headers age 44437 cache-control public, max-age=0, must-revalidate content-encoding br content-length 4790 content-type text/html; charset=UTF-8 date Wed, 22 Mar 2023 03:01:22 GMT etag "d1f733433b3ff6fc38232965824622f5-ssl-df" server Netlify strict-transport-security max-age=31536000 vary Accept-Encoding x-nf-request-id 01GW4YK96PAYWKGCM8MA6BMVE0
GET H2	200	6daaaf1.js Show response d2bb5k76l7oivo.cloudfront.net/	23 KB 7 KB	201ms 122ms	Script application/javascript	2600:9000:2140:5600:d:e9c:2500:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d2bb5k76l7oivo.cloudfront.net/6daaaf1.js Requested by Host: canddy.xyz URL: https://canddy.xyz/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2140:5600:d:e9c:2500:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash d212a5a732e0632cb7a63412830a021c8c0a4aaa835a604ef008c1b0e4b00300 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Wed, 22 Mar 2023 14:52:42 GMT content-encoding br via 1.1 94fb69b274bb5ab206667cb69fcc5932.cloudfront.net (CloudFront) last-modified Wed, 11 Jan 2023 21:50:46 GMT server AmazonS3 x-amz-cf-pop EWR52-C1 age 1760 etag W/"8ab72c4473621e1b30a24ec89af90bcf" vary Accept-Encoding x-cache Error from cloudfront content-type application/javascript x-amz-cf-id UVHc9nHAyKMfQ79ju4bSNnILGp_NYLvxFkF0bGFRLNrUj36JoevW_A==
GET H2	200	js Show response www.googletagmanager.com/gtag/	112 KB 44 KB	54ms 26ms	Script application/javascript	2607:f8b0:4004:c19::61 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-261313093-1 Requested by Host: canddy.xyz URL: https://canddy.xyz/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c19::61 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 4cc53d2ab40b2972a68692b572019203d7a9c4d4c47f77c46363b7d2ee21372e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Wed, 22 Mar 2023 15:21:59 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 44712 x-xss-protection 0 last-modified Wed, 22 Mar 2023 15:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 22 Mar 2023 15:21:59 GMT
GET H2	200	424377364.png www13.0zz0.com/2023/03/12/20/	205 KB 205 KB	63ms 14ms	Image image/png	2606:4700:3036::6815:1d27 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www13.0zz0.com/2023/03/12/20/424377364.png Requested by Host: canddy.xyz URL: https://canddy.xyz/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::6815:1d27 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c62905a7b7815457987ee604d6c9c3b7f0ca31b0d9f056c5a369c5b2d11aae2d Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Wed, 22 Mar 2023 15:21:59 GMT strict-transport-security max-age=15552000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 5935 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 209424 last-modified Sun, 12 Mar 2023 20:38:52 GMT server cloudflare etag "33210-5f6b9fb820ed2" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uRwWRRGrW9BM%2FCcC4G3Tl24MAugp8XjY%2BlCdPbIKl8TxBjCHw%2FbfEBPzEHTKgCib8yZkKZhNV5UjB8Kujm7eUiUZ7uEeQF%2FPLYCbW%2FloNHr9oN4ld%2BlkGs%2FekrigOrFncxI3xL%2FQ4%2FsP5YWopg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=28800 accept-ranges bytes cf-ray 7abf6d75df8b32fa-EWR
GET H2	200	439231651.png www6.0zz0.com/2023/03/14/12/	268 KB 269 KB	36ms 20ms	Image image/png	2606:4700:3036::6815:1d27 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www6.0zz0.com/2023/03/14/12/439231651.png Requested by Host: canddy.xyz URL: https://canddy.xyz/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::6815:1d27 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 76f61b135b52459ddc3e4d74c587da3fef890b45403124d61557fc5b27a338fc Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Wed, 22 Mar 2023 15:22:00 GMT strict-transport-security max-age=15552000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6151 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 274311 last-modified Tue, 14 Mar 2023 12:29:21 GMT server cloudflare etag "42f87-5f6db608e88ad" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AzmO0TmABTQkzBwmMncMdaHz3M7M9l9mtdR94lkvdFq%2BfwPN47g7tVocn61wOGuV5QXQn3YShPjwBrW9mlHHlMrmWISmSNrC24bX93G%2F2cn%2BUCiMvJKiB0ENNf7WAWJpp6BT0oXCMsmg2seE"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=28800 accept-ranges bytes cf-ray 7abf6d761fc832fa-EWR
GET H2	200	116846962.png www2.0zz0.com/2023/03/14/12/	282 KB 282 KB	338ms 287ms	Image image/png	2606:4700:3036::6815:1d27 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www2.0zz0.com/2023/03/14/12/116846962.png Requested by Host: canddy.xyz URL: https://canddy.xyz/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::6815:1d27 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0cf1c03f718ef0041e211ef3f6d84cc111f1ae7c6ec320db9e33b959390da310 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Wed, 22 Mar 2023 15:22:00 GMT strict-transport-security max-age=15552000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status REVALIDATED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 288471 last-modified Tue, 14 Mar 2023 12:35:16 GMT server cloudflare etag "466d7-5f6db75b43d4f" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Odv0PKCFbQ5tgFDoMq9MmXQ3rmejQgSauHm8F1iSRKhHSSYUoBxrYpJ0DV7E%2Bb4fdJ84FhxICRF0b6HioCOz%2FOff9PFqLZONNPXwL4JHL5Ym1TJca3nlr1eirrUer7idSdIm%2BchSwH68IR%2BV"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=28800 accept-ranges bytes cf-ray 7abf6d763fef32fa-EWR
GET H2	200	182841435.png www11.0zz0.com/2023/03/14/12/	592 KB 593 KB	369ms 312ms	Image image/png	2606:4700:3036::6815:1d27 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www11.0zz0.com/2023/03/14/12/182841435.png Requested by Host: canddy.xyz URL: https://canddy.xyz/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::6815:1d27 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ad6fdaf1a5b959abe92596eb31da0bfe6dbcbb3e7d536253a9e31127e397e8e8 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Wed, 22 Mar 2023 15:22:00 GMT strict-transport-security max-age=15552000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status REVALIDATED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 606678 last-modified Tue, 14 Mar 2023 12:45:36 GMT server cloudflare etag "941d6-5f6db9aad9a9a" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tShxu5mgubpNg7nngINK6WqhKuBKjnRWxdczXihyQpshNlR3v0bwq%2F6qXicQ7KhpTwxWNMRGKgHHirwWVFwTzD6z2AFBK%2FEHoaLLj1BNSON8OQ%2FDNo7IMKoH0qarn2sorTZXhrnOSlTe3WkPLQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=28800 accept-ranges bytes cf-ray 7abf6d76782e32fa-EWR
GET H2	200	749743625.png www13.0zz0.com/2023/03/15/16/	290 KB 291 KB	46ms 44ms	Image image/png	2606:4700:3036::6815:1d27 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www13.0zz0.com/2023/03/15/16/749743625.png Requested by Host: canddy.xyz URL: https://canddy.xyz/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::6815:1d27 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 55718ffc3e54a81e9b809232403d6d059b8dd1d1737413951183bad97fa2c69a Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Wed, 22 Mar 2023 15:22:00 GMT strict-transport-security max-age=15552000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 5936 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 297352 last-modified Wed, 15 Mar 2023 16:06:00 GMT server cloudflare etag "48988-5f6f285359a1e" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wgfL7GwGEj8Y%2BkZX8G6ZjuzRB3zs7d559IsvLlcNqr2Tx8jXRxEKimTjGXD0hTGFKfclLtOkkcBMk26kSz0WXwoNmyG8%2Bw9SHLDkEv%2B4vUgvBXWOF%2BTkXc1CKWs4cfKK%2Fv8cNsuJ8P1OOq2TJA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=28800 accept-ranges bytes cf-ray 7abf6d762fd932fa-EWR
GET H2	200	182458031.png www2.0zz0.com/2023/03/14/12/	301 KB 302 KB	321ms 277ms	Image image/png	2606:4700:3036::6815:1d27 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www2.0zz0.com/2023/03/14/12/182458031.png Requested by Host: canddy.xyz URL: https://canddy.xyz/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::6815:1d27 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5643133b8896f26b849740de15924bf8b4f590875b1fa9051cbd4f190a4ab54f Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Wed, 22 Mar 2023 15:22:00 GMT strict-transport-security max-age=15552000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status REVALIDATED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 308409 last-modified Tue, 14 Mar 2023 12:33:05 GMT server cloudflare etag "4b4b9-5f6db6ddd046d" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZYlJK3CFdr4lvYRZX9Y52%2Fi4e23gufdzymvTJztzAMrt5No%2F6EvIHOhSA4AcE21n%2FN%2FRPqUoWQtg2v7Y8H3QaB2T%2Bg1tS5mCubu299xOB837c0crMR2JIVaTm1eDhc131M7ordkXZCOsfSxG"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=28800 accept-ranges bytes cf-ray 7abf6d763ff032fa-EWR
GET H2	200	334556257.png www10.0zz0.com/2023/03/15/16/	317 KB 318 KB	55ms 12ms	Image image/png	2606:4700:3036::6815:1d27 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www10.0zz0.com/2023/03/15/16/334556257.png Requested by Host: canddy.xyz URL: https://canddy.xyz/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::6815:1d27 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 32cfdcbce7fd266985e141fe30f285dd4e42a6786421b1006b984b05cfcabd0f Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Wed, 22 Mar 2023 15:22:00 GMT strict-transport-security max-age=15552000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6798 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 325051 last-modified Wed, 15 Mar 2023 16:25:08 GMT server cloudflare etag "4f5bb-5f6f2c9948225" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pz%2BXp8rEFIr3VCYRbqM1jw0CKP5opUjCLwW4TU8hqLPqfhyU8lzfAMyjZNT68lNSZku3cUXEt6aMqrc5%2B2DHriYY2UzmECaslVq2qA%2BlFsUwWxDcyMDRq0FrxvZ001sZqMVKMZHUpur9CSikmg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=28800 accept-ranges bytes cf-ray 7abf6d763ff132fa-EWR
GET H2	200	fun-games-mystery-box--ki-508004-1.jpg i.mmo.cm/is/image/mmoimg/se-product-max/	18 KB 19 KB	270ms 17ms	Image image/webp	2600:141b:5000::b81c:be18 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://i.mmo.cm/is/image/mmoimg/se-product-max/fun-games-mystery-box--ki-508004-1.jpg Requested by Host: canddy.xyz URL: https://canddy.xyz/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2600:141b:5000::b81c:be18 New York, United States, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software Unknown / Resource Hash 7b0a1c6cb286fff48e0fd1bd89947123161193372e8a98a47b34d9fefc4800d5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Wed, 22 Mar 2023 15:22:00 GMT last-modified Thu, 15 Apr 2021 11:55:03 GMT -x-adobe-smart-imaging 10916 server Unknown etag "1911d68f3603dac9db4ac188a8c46a2c" content-type image/webp access-control-allow-origin * cache-control max-age=691200 content-length 18704 expires Thu, 30 Mar 2023 15:22:00 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.5.1/	87 KB 31 KB	54ms 15ms	Script text/javascript	2607:f8b0:4004:c09::5f GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js Requested by Host: canddy.xyz URL: https://canddy.xyz/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c09::5f Ashburn, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Tue, 21 Mar 2023 15:37:15 GMT content-encoding gzip x-content-type-options nosniff age 85484 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31021 x-xss-protection 0 last-modified Fri, 08 May 2020 07:05:03 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 20 Mar 2024 15:37:15 GMT
GET H2	200	html.3621368.f6f85.0.js Show response d2punpeg7vtjci.cloudfront.net/public/external/v2/	9 KB 10 KB	159ms 96ms	Script application/javascript	2600:9000:21da:7200:1c:8de0:8c80:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d2punpeg7vtjci.cloudfront.net/public/external/v2/html.3621368.f6f85.0.js Requested by Host: d2bb5k76l7oivo.cloudfront.net URL: https://d2bb5k76l7oivo.cloudfront.net/6daaaf1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21da:7200:1c:8de0:8c80:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11 Resource Hash bdfabefc85115655910d072b5c4c16676675732580d526c9d218e714ec5c7083 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Wed, 22 Mar 2023 15:22:00 GMT via 1.1 284419e56e7f935ce4c1c55765241348.cloudfront.net (CloudFront) server Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop EWR53-C1 x-powered-by PHP/7.4.11 x-cache Miss from cloudfront content-type application/javascript x-amz-cf-id T8mdWqpZxMqMJgpiRcHpt9ckL7BdI50R3Itk2kiO4tqLicwHkhal0w==
GET H2	200	css_front.css d2punpeg7vtjci.cloudfront.net/public/external/	6 KB 7 KB	163ms 87ms	Stylesheet text/css	2600:9000:21da:7200:1c:8de0:8c80:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d2punpeg7vtjci.cloudfront.net/public/external/css_front.css Requested by Host: d2bb5k76l7oivo.cloudfront.net URL: https://d2bb5k76l7oivo.cloudfront.net/6daaaf1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21da:7200:1c:8de0:8c80:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / Resource Hash a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Wed, 22 Mar 2023 15:22:00 GMT via 1.1 284419e56e7f935ce4c1c55765241348.cloudfront.net (CloudFront) last-modified Tue, 23 Jun 2020 20:06:47 GMT server Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop EWR53-C1 etag "19c4-5a8c5e62e9d0a" x-cache Miss from cloudfront content-type text/css accept-ranges bytes content-length 6596 x-amz-cf-id oB7mX_8m5oE_6j0S2Esdu-5AJ5-Es4lNLShuSOJ0bzXhvM_FMvnC7g==
GET H2	200	thumb-1920-887679.jpg images2.alphacoders.com/887/	433 KB 434 KB	53ms 17ms	Image image/jpeg	2606:4700:10::ac43:324 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://images2.alphacoders.com/887/thumb-1920-887679.jpg Requested by Host: canddy.xyz URL: https://canddy.xyz/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:324 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 44d28c4a77468da5b2f85ac7106bdb5ddee2ce5bc0b86a664807cadd8721848c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers accept-language en-US,en;q=0.9 Referer https://canddy.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Wed, 22 Mar 2023 15:22:00 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status HIT age 129661 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 443625 referrer-policy no-referrer-when-downgrade cf-bgj h2pri last-modified Sat, 09 Dec 2017 23:55:22 GMT server cloudflare etag "5a2c77ea-6c4e9" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/jpeg cache-control max-age=2592000 accept-ranges bytes cf-ray 7abf6d76af4f1859-EWR expires Thu, 20 Apr 2023 03:20:59 GMT
GET H2	200	js15_as.js Show response s10.histats.com/	11 KB 4 KB	300ms 10ms	Script text/javascript	46.105.201.240 OVH
General Check archive.org Show headers Download Go to Full URL https://s10.histats.com/js15_as.js Requested by Host: canddy.xyz URL: https://canddy.xyz/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 46.105.201.240 , France, ASN16276 (OVH, FR), Reverse DNS Software / Resource Hash 2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Wed, 22 Mar 2023 15:18:35 GMT content-encoding br last-modified Thu, 16 Apr 2020 10:44:16 GMT x-cacheable Matched cache x-cdn-pop-ip 137.74.122.0/26 etag "-375139978" content-type text/javascript x-cdn-pop bhs accept-ranges bytes content-length 4364 x-request-id 182224702
GET H2	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	63ms 11ms	Script text/javascript	2607:f8b0:4004:c09::65 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-261313093-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c09::65 Ashburn, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Wed, 22 Mar 2023 14:57:27 GMT last-modified Tue, 10 Jan 2023 21:29:14 GMT server Golfe2 age 1473 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20085 expires Wed, 22 Mar 2023 16:57:27 GMT
GET H2	200	css.css d2punpeg7vtjci.cloudfront.net/public/clockers/CustomButton/	1010 B 1 KB	84ms 83ms	Stylesheet text/css	2600:9000:21da:7200:1c:8de0:8c80:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d2punpeg7vtjci.cloudfront.net/public/clockers/CustomButton/css.css Requested by Host: d2bb5k76l7oivo.cloudfront.net URL: https://d2bb5k76l7oivo.cloudfront.net/6daaaf1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21da:7200:1c:8de0:8c80:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 / Resource Hash a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Wed, 22 Mar 2023 15:22:00 GMT via 1.1 284419e56e7f935ce4c1c55765241348.cloudfront.net (CloudFront) last-modified Fri, 10 Apr 2020 22:29:00 GMT server Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop EWR53-C1 etag "3f2-5a2f7428ae907" x-cache Miss from cloudfront content-type text/css accept-ranges bytes content-length 1010 x-amz-cf-id Mi8igxhVIfLFhGlwEa9MPyamGboP8HVWXiWB9b-v8D7O2Auk39LSrw==
POST H2	200	collect Show response www.google-analytics.com/j/	1 B 203 B	19ms 18ms	XHR text/plain	2607:f8b0:4004:c09::65 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j99&a=1370286746&t=pageview&_s=1&dl=https%3A%2F%2Fcanddy.xyz%2F&ul=en-us&de=UTF-8&dt=CandyShop&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=1990149170&gjid=2122516402&cid=682340783.1679498520&tid=UA-261313093-1&_gid=875239532.1679498520&_r=1&gtm=457e33k0&z=1142054182 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c09::65 Ashburn, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 22 Mar 2023 15:22:00 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://canddy.xyz cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	0.php Show response s4.histats.com/stats/	50 B 184 B	48ms 10ms	Script text/html	54.39.156.32 OVH
General Check archive.org Show headers Download Go to Full URL https://s4.histats.com/stats/0.php?4727364&@f16&@g1&@h1&@i1&@j1679498520406&@k0&@l1&@mCandyShop&@n0&@o1000&@q0&@r0&@s0&@ten-US&@u1600&@b1:178052686&@b3:1679498520&@b4:js15_as.js&@b5:0&@a-_0.2.1&@vhttps%3A%2F%2Fcanddy.xyz%2F&@w Requested by Host: s10.histats.com URL: https://s10.histats.com/js15_as.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.39.156.32 Québec, Canada, ASN16276 (OVH, FR), Reverse DNS ns562579.ip-54-39-156.net Software / Resource Hash c11a00401cc1bae7048016bad9ca86d7d621db6a03d0767e5d4f0a2d0c3e7c7a Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Wed, 22 Mar 2023 15:22:00 GMT Connection close Content-Length 50 Content-Type text/html;charset=UTF-8
GET H2	200	guid Show response d2punpeg7vtjci.cloudfront.net/public/	0 277 B	161ms 160ms	Script text/html	2600:9000:21da:7200:1c:8de0:8c80:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d2punpeg7vtjci.cloudfront.net/public/guid?cpguid=phbyop5yh&e=ll&t=1679498521007 Requested by Host: d2bb5k76l7oivo.cloudfront.net URL: https://d2bb5k76l7oivo.cloudfront.net/6daaaf1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21da:7200:1c:8de0:8c80:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11 Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Wed, 22 Mar 2023 15:22:01 GMT via 1.1 284419e56e7f935ce4c1c55765241348.cloudfront.net (CloudFront) server Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop EWR53-C1 x-powered-by PHP/7.4.11 x-cache Miss from cloudfront content-type text/html; charset=UTF-8 content-length 0 x-amz-cf-id 0kyHhKFRLwVCthIic_zx4buKrpsCJPJIhh980KwOvt2-5ejDwClhDw==
GET H2	200	check.php Show response d2punpeg7vtjci.cloudfront.net/public/external/	78 B 372 B	161ms 160ms	Script application/javascript	2600:9000:21da:7200:1c:8de0:8c80:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d2punpeg7vtjci.cloudfront.net/public/external/check.php?it=3621368&time=1679498522213 Requested by Host: d2bb5k76l7oivo.cloudfront.net URL: https://d2bb5k76l7oivo.cloudfront.net/6daaaf1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21da:7200:1c:8de0:8c80:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11 Resource Hash 9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Wed, 22 Mar 2023 15:22:02 GMT via 1.1 284419e56e7f935ce4c1c55765241348.cloudfront.net (CloudFront) server Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop EWR53-C1 x-powered-by PHP/7.4.11 x-cache Miss from cloudfront content-type application/javascript content-length 78 x-amz-cf-id eX4pQtgCk-RAR2A5otUskQeV2qZuYZ5o6KF4zljD5L1tDYFzEzfy8g==

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

34 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| CPABUILDSETTINGS object| CPABUILDContentLocker number| __cfRLUnblockHandlers function| CPBContentLocker function| CPABuildLock function| CPABuildGetFeedURL function| CPABuildGetIframeURL function| CPABuildGetIframeHTML function| CPABuildUnlock function| CPABuildOfferComplete function| CPABuildOffersComplete function| CPABuildCheckForLead function| og_load function| CPABuildComplete function| call_locker function| gtag object| dataLayer function| $ function| jQuery object| google_tag_manager object| _Hasync object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData function| chfh function| chfh2 string| _HST_cntval object| Histats object| _HistatsCounterGraphics_0_setValues

12 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			canddy.xyz/	1970-01-20 10:46:02	Name: _cpguid Value: phbyop5yh
			.alphacoders.com/	1970-01-20 10:31:40	Name: __cf_bm Value: Z68B9y_WHXTE2t_HBMW3sAx4hDcsavl5bxq_H7Jn0VQ-1679498520-0-AaHKwzXs8JmAsa5/tXu20kzSBF2TxVi1W5X6McuuBRrEo2RKz5i4F58Z/x/G30TCGUscidAUfZ5OLr+4PFl+yOA=
			.canddy.xyz/	1970-01-20 20:07:38	Name: _ga Value: GA1.2.682340783.1679498520
			.canddy.xyz/	1970-01-20 10:33:04	Name: _gid Value: GA1.2.875239532.1679498520
			.canddy.xyz/	1970-01-20 10:31:38	Name: _gat_gtag_UA_261313093_1 Value: 1
			canddy.xyz/	1970-01-20 19:17:14	Name: HstCfa4727364 Value: 1679498520406
			canddy.xyz/	1970-01-20 19:17:14	Name: HstCla4727364 Value: 1679498520406
			canddy.xyz/	1970-01-20 19:17:14	Name: HstCmu4727364 Value: 1679498520406
			canddy.xyz/	1970-01-20 19:17:14	Name: HstPn4727364 Value: 1
			canddy.xyz/	1970-01-20 19:17:14	Name: HstPt4727364 Value: 1
			canddy.xyz/	1970-01-20 19:17:14	Name: HstCnv4727364 Value: 1
			canddy.xyz/	1970-01-20 19:17:14	Name: HstCns4727364 Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
canddy.xyz
d2bb5k76l7oivo.cloudfront.net
d2punpeg7vtjci.cloudfront.net
i.mmo.cm
images2.alphacoders.com
s10.histats.com
s4.histats.com
www.google-analytics.com
www.googletagmanager.com
www10.0zz0.com
www11.0zz0.com
www13.0zz0.com
www2.0zz0.com
www6.0zz0.com
2600:141b:5000::b81c:be18
2600:9000:2140:5600:d:e9c:2500:21
2600:9000:21da:7200:1c:8de0:8c80:21
2606:4700:10::ac43:324
2606:4700:3036::6815:1d27
2607:f8b0:4004:c09::5f
2607:f8b0:4004:c09::65
2607:f8b0:4004:c19::61
34.73.83.172
46.105.201.240
54.39.156.32
0cf1c03f718ef0041e211ef3f6d84cc111f1ae7c6ec320db9e33b959390da310
2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede
32cfdcbce7fd266985e141fe30f285dd4e42a6786421b1006b984b05cfcabd0f
44d28c4a77468da5b2f85ac7106bdb5ddee2ce5bc0b86a664807cadd8721848c
4cc53d2ab40b2972a68692b572019203d7a9c4d4c47f77c46363b7d2ee21372e
55718ffc3e54a81e9b809232403d6d059b8dd1d1737413951183bad97fa2c69a
5643133b8896f26b849740de15924bf8b4f590875b1fa9051cbd4f190a4ab54f
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
76f61b135b52459ddc3e4d74c587da3fef890b45403124d61557fc5b27a338fc
7b0a1c6cb286fff48e0fd1bd89947123161193372e8a98a47b34d9fefc4800d5
851343b16173359448875068ef05469e617a9cab282e8cd7ab3cf106426001d3
9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b
a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de
a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec
ad6fdaf1a5b959abe92596eb31da0bfe6dbcbb3e7d536253a9e31127e397e8e8
bdfabefc85115655910d072b5c4c16676675732580d526c9d218e714ec5c7083
c11a00401cc1bae7048016bad9ca86d7d621db6a03d0767e5d4f0a2d0c3e7c7a
c62905a7b7815457987ee604d6c9c3b7f0ca31b0d9f056c5a369c5b2d11aae2d
d212a5a732e0632cb7a63412830a021c8c0a4aaa835a604ef008c1b0e4b00300
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d