www.handytac.com Open in urlscan Pro
156.255.213.252  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://www.handytac.com/system/storage/vendor/leafo/scssphp/site/docs/siteunavailable/categories.php?farmer=mrd1k1ku11z0h&page=corner&hundred=soil Page URL
2. https://www.handytac.com/system/storage/vendor/leafo/scssphp/site/docs/siteunavailable/categories.php?earth=gxh9uncy9xx990h&fresh=parts&ago=nor Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
8 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	categories.php Show response www.handytac.com/system/storage/vendor/leafo/scssphp/site/docs/siteunavailable/	5 KB 2 KB	2074ms 1556ms	Document text/html	156.255.213.252 XIAOZHIYUN1-AS-AP...
General Check archive.org Show headers Download Go to Full URL https://www.handytac.com/system/storage/vendor/leafo/scssphp/site/docs/siteunavailable/categories.php?farmer=mrd1k1ku11z0h&page=corner&hundred=soil Protocol H2 Security TLS 1.3, , AES_256_GCM Server 156.255.213.252 Central, Hong Kong, ASN136800 (XIAOZHIYUN1-AS-AP ICIDC NETWORK, US), Reverse DNS Software nginx / Resource Hash 9c9e652f5dd532d02ca3958a2b4829a408c5a2fff7e4ba63aa1a0722e0655a00 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :method GET :authority www.handytac.com :scheme https :path /system/storage/vendor/leafo/scssphp/site/docs/siteunavailable/categories.php?farmer=mrd1k1ku11z0h&page=corner&hundred=soil pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers server nginx date Fri, 16 Apr 2021 07:57:06 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding strict-transport-security max-age=31536000 content-encoding gzip
GET H2	200	Primary Request categories.php Show response www.handytac.com/system/storage/vendor/leafo/scssphp/site/docs/siteunavailable/	965 KB 433 KB	3239ms 3239ms	Document text/html	156.255.213.252 XIAOZHIYUN1-AS-AP...
General Check archive.org Show headers Download Go to Full URL https://www.handytac.com/system/storage/vendor/leafo/scssphp/site/docs/siteunavailable/categories.php?earth=gxh9uncy9xx990h&fresh=parts&ago=nor Requested by Host: www.handytac.com URL: https://www.handytac.com/system/storage/vendor/leafo/scssphp/site/docs/siteunavailable/categories.php?farmer=mrd1k1ku11z0h&page=corner&hundred=soil Protocol H2 Security TLS 1.3, , AES_256_GCM Server 156.255.213.252 Central, Hong Kong, ASN136800 (XIAOZHIYUN1-AS-AP ICIDC NETWORK, US), Reverse DNS Software nginx / Resource Hash ca2ff39bff2b71a0688c88eb37b46ffa45ec22b6e25c200fbeefa16c51f740c4 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :method GET :authority www.handytac.com :scheme https :path /system/storage/vendor/leafo/scssphp/site/docs/siteunavailable/categories.php?earth=gxh9uncy9xx990h&fresh=parts&ago=nor pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site same-origin sec-fetch-mode navigate sec-fetch-dest document referer https://www.handytac.com/system/storage/vendor/leafo/scssphp/site/docs/siteunavailable/categories.php?farmer=mrd1k1ku11z0h&page=corner&hundred=soil accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Referer https://www.handytac.com/system/storage/vendor/leafo/scssphp/site/docs/siteunavailable/categories.php?farmer=mrd1k1ku11z0h&page=corner&hundred=soil Response headers server nginx date Fri, 16 Apr 2021 07:57:10 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding strict-transport-security max-age=31536000 content-encoding gzip
GET H2	200	css fonts.googleapis.com/	2 KB 644 B	14ms 14ms	Stylesheet text/css	2a00:1450:4001:800::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Montserrat|Acme Requested by Host: www.handytac.com URL: https://www.handytac.com/system/storage/vendor/leafo/scssphp/site/docs/siteunavailable/categories.php?earth=gxh9uncy9xx990h&fresh=parts&ago=nor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 361cb568cc7cfa45b12ccb43f83b8b3aab8a0e52a18d95c87398b86bc3427989 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Fri, 16 Apr 2021 06:23:56 GMT server ESF date Fri, 16 Apr 2021 07:57:11 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Fri, 16 Apr 2021 07:57:11 GMT
GET H2	200	css fonts.googleapis.com/	7 KB 571 B	15ms 14ms	Stylesheet text/css	2a00:1450:4001:800::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Assistant%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&ver=5.2.3 Requested by Host: www.handytac.com URL: https://www.handytac.com/system/storage/vendor/leafo/scssphp/site/docs/siteunavailable/categories.php?earth=gxh9uncy9xx990h&fresh=parts&ago=nor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2d99fe57669e5825d423e0cba99aaee3e9f1595ac357c03835af995ab9f58e63 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.handytac.com/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Fri, 16 Apr 2021 07:57:11 GMT server ESF date Fri, 16 Apr 2021 07:57:11 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Fri, 16 Apr 2021 07:57:11 GMT
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/	86 KB 28 KB	21ms 21ms	Script application/javascript	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js Requested by Host: www.handytac.com URL: https://www.handytac.com/system/storage/vendor/leafo/scssphp/site/docs/siteunavailable/categories.php?earth=gxh9uncy9xx990h&fresh=parts&ago=nor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://www.handytac.com/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Fri, 16 Apr 2021 07:57:11 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 3065388 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 27748 cf-request-id 097b4824ef0000c2956509a000000001 timing-allow-origin * last-modified Mon, 04 May 2020 16:11:48 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03ec4-15851" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=bIFnTJaUAEymc7vlex9T1Bx5tfPOBnmbBGtqTIR3JxSxPD9pVVECAW9JXM1GJTcWFqLa4DZrNI48EIPS0i3JS4w9JsjjQ00AEQkl4VHLJ7y%2BCnOaP4S84O8lrohtzWw9%2Bg%3D%3D"}],"max_age":604800,"group":"cf-nel"} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 640bdc8179fbc295-FRA expires Wed, 06 Apr 2022 07:57:11 GMT
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 7de8c6ccb91c80e155bb481dcf4a71e36db65f158d6005766b7e23288e3c955d Request headers Referer User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 55e5d60c0d60be0360d0f85728aba03381af4ca67591f7804e0cbf796deb1b88 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/jpg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ed3a250c216760c821303b27e166f6ea01f5df07fae393a24e0ad31701cdef98 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers Content-Type image/jpg
GET DATA	200 OK	truncated /	1 KB 0		Image image/jpg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a62c1b96ada273407cd21697b5bc927b844e937acc4ca7b0c7c3eeb41f3a4feb Request headers Referer User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers Content-Type image/jpg
GET H2	200	2sDcZGJYnIjSi6H75xkzaGW5.woff2 fonts.gstatic.com/s/assistant/v7/	20 KB 20 KB	7ms 6ms	Font font/woff2	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/assistant/v7/2sDcZGJYnIjSi6H75xkzaGW5.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Assistant%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&ver=5.2.3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9fdce601969d5ddcaf6a997e6843d92e5096e83b165ece04d907655b74945b21 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://www.handytac.com Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Sun, 11 Apr 2021 10:03:38 GMT x-content-type-options nosniff last-modified Thu, 28 Jan 2021 22:56:13 GMT server sffe age 424413 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20620 x-xss-protection 0 expires Mon, 11 Apr 2022 10:03:38 GMT
GET DATA	200 OK	truncated /	96 KB 0		Image image/jpg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 94abd4bd8798b642756c81aefc3838a76366ea5e51fe4a1ac7d56ab96b4731b6 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers Content-Type image/jpg
GET H2	200	2sDcZGJYnIjSi6H75xkzZmW5O7w.woff2 fonts.gstatic.com/s/assistant/v7/	8 KB 8 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/assistant/v7/2sDcZGJYnIjSi6H75xkzZmW5O7w.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Assistant%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&ver=5.2.3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 776835106c631437fae4b1360a1115f9d329988020e1b62f040f589f446317ac Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://www.handytac.com Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Thu, 15 Apr 2021 02:03:13 GMT x-content-type-options nosniff last-modified Thu, 28 Jan 2021 22:22:19 GMT server sffe age 107638 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 8452 x-xss-protection 0 expires Fri, 15 Apr 2022 02:03:13 GMT
GET DATA	200 OK	truncated /	65 KB 0		Image image/jpg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3c5ab8d7a40b23cb31d0c8392d02cd4d079a08600699189dfd4266e0bb433807 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers Content-Type image/jpg
GET DATA	200 OK	truncated /	25 KB 0		Image image/jpg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4755266998f9d0b6256a9e92d0cae198f4e0dbd2a7907243fd29677aa5babc0c Request headers Referer User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers Content-Type image/jpg
GET DATA	200 OK	truncated /	129 KB 0		Image image/jpg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash aa4503cc1fa587e4cb1f048219e658c85793f5e1a06c2b79f6d906ed81e89ee4 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers Content-Type image/jpg

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Investment Scam (Online)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| dayNames object| monthNames object| now

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
www.handytac.com
156.255.213.252
2606:4700::6810:125e
2a00:1450:4001:800::200a
2a00:1450:4001:813::2003
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
2d99fe57669e5825d423e0cba99aaee3e9f1595ac357c03835af995ab9f58e63
361cb568cc7cfa45b12ccb43f83b8b3aab8a0e52a18d95c87398b86bc3427989
3c5ab8d7a40b23cb31d0c8392d02cd4d079a08600699189dfd4266e0bb433807
4755266998f9d0b6256a9e92d0cae198f4e0dbd2a7907243fd29677aa5babc0c
55e5d60c0d60be0360d0f85728aba03381af4ca67591f7804e0cbf796deb1b88
776835106c631437fae4b1360a1115f9d329988020e1b62f040f589f446317ac
7de8c6ccb91c80e155bb481dcf4a71e36db65f158d6005766b7e23288e3c955d
94abd4bd8798b642756c81aefc3838a76366ea5e51fe4a1ac7d56ab96b4731b6
9c9e652f5dd532d02ca3958a2b4829a408c5a2fff7e4ba63aa1a0722e0655a00
9fdce601969d5ddcaf6a997e6843d92e5096e83b165ece04d907655b74945b21
a62c1b96ada273407cd21697b5bc927b844e937acc4ca7b0c7c3eeb41f3a4feb
aa4503cc1fa587e4cb1f048219e658c85793f5e1a06c2b79f6d906ed81e89ee4
ca2ff39bff2b71a0688c88eb37b46ffa45ec22b6e25c200fbeefa16c51f740c4
ed3a250c216760c821303b27e166f6ea01f5df07fae393a24e0ad31701cdef98