candyeye-71.ml - urlscan.io

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 4 HTTP transactions. The main IP is 192.232.246.34, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is candyeye-71.ml.

This is the only time candyeye-71.ml was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	192.232.246.34 192.232.246.34	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	68.115.151.37 68.115.151.37	20115 (CHARTER-2...) (CHARTER-20115)
1	2a00:1450:400... 2a00:1450:4001:81d::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:821::200e	15169 (GOOGLE) (GOOGLE)
4	4

1 192.232.246.34 (Houston, United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: sha.shamambikterios.com

candyeye-71.ml	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.115.151.37 (Fountain Inn, United States)

ASN20115 (CHARTER-20115, US)
PTR: www.homelandsecureit.com

www.homelandsecureit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

encrypted-tbn0.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	youtube.com www.youtube.com
1	gstatic.com encrypted-tbn0.gstatic.com	4 KB
1	homelandsecureit.com www.homelandsecureit.com	6 KB
1	candyeye-71.ml candyeye-71.ml	8 KB
4	4

	Domain	Requested by
1	www.youtube.com	candyeye-71.ml
1	encrypted-tbn0.gstatic.com	candyeye-71.ml
1	www.homelandsecureit.com	candyeye-71.ml
1	candyeye-71.ml
4	4

This site contains links to these domains. Also see Links.

Domain
en.wikipedia.org
www.bitcoin.com

Subject Issuer	Validity	Valid
*.google.com GTS CA 1O1	`2020-04-01` - `2020-06-24`	3 months	crt.sh

This page contains 2 frames:

Primary Page: http://candyeye-71.ml/
Frame ID: 381EA85E728E874B76E3F69BA2DEAFFA
Requests: 3 HTTP requests in this frame

Frame: https://www.youtube.com/embed/C_i441fUnfg?autoplay=1
Frame ID: DB7498A8EBCC37770D64835320CFAD4E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

YouTube (Video Players) Expand

Overall confidence: 100%
Detected patterns

html /<(?:param|embed|iframe)[^>]+youtube(?:-nocookie)?\.com\/(?:v|embed)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

4
Requests

50 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

18 kB
Transfer

17 kB
Size

3
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://en.wikipedia.org/wiki/Bitcoin
Title: About BitCoin

Search URL Search Domain Scan URL

URL: https://www.bitcoin.com/buy-bitcoin
Title: How to buy BitCoin ?

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
candyeye-71.ml/ 7 KB
8 KB 416ms
351ms Document
text/html 192.232.246.34
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://candyeye-71.ml/
Protocol: HTTP/1.1
Server: 192.232.246.34 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: sha.shamambikterios.com
Software: Apache /
Resource Hash: 3b5bed100c6516f16555e52e5526838bb6f814c4d328c26d2ff4a661f42d32a5

Request headers

Host: candyeye-71.ml
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 22 Apr 2020 15:43:14 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK security-padlock.gif
www.homelandsecureit.com/wp-content/uploads/2011/01/ 5 KB
6 KB 389ms
339ms Image
image/gif 68.115.151.37
CHARTER-20115

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.homelandsecureit.com/wp-content/uploads/2011/01/security-padlock.gif
Requested by: Host: candyeye-71.ml
URL: http://candyeye-71.ml/
Protocol: HTTP/1.1
Server: 68.115.151.37 Fountain Inn, United States, ASN20115 (CHARTER-20115, US),
Reverse DNS: www.homelandsecureit.com
Software: Apache /
Resource Hash: 52af13a5393aa1c5db6f93b260b175778ef2b58b719ad6575de89dd1a10d0c32

Request headers

Referer: http://candyeye-71.ml/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 22 Apr 2020 15:43:14 GMT
Last-Modified: Fri, 16 Nov 2012 19:19:50 GMT
Server: Apache
ETag: "14fe-4cea1a6cc8009"
Vary: User-Agent
Content-Type: image/gif
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 5374
Expires: Fri, 22 May 2020 15:43:14 GMT

GET
H2 200 images
encrypted-tbn0.gstatic.com/ 4 KB
4 KB 43ms
41ms Image
image/jpeg 2a00:1450:4001:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTKAnP6a0_qv1qIt-rHjDltkInvW1BSdoObHKRfpgPFF00DcCZp

Requested by

Host: candyeye-71.ml
URL: http://candyeye-71.ml/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1036341430f8ed6d14c50873b2e937c9e7ff29707b8a952e0fe1bc1c921cb79c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://candyeye-71.ml/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 22 Apr 2020 15:43:14 GMT
x-content-type-options: nosniff
last-modified: Sun, 02 Jul 2017 20:19:09 GMT
server: sffe
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 4420
x-xss-protection: 0
expires: Thu, 22 Apr 2021 15:43:14 GMT

GET
H2 200 C_i441fUnfg
www.youtube.com/embed/ Frame DB74 0
0 117ms
117ms Document
text/html 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/C_i441fUnfg?autoplay=1

Requested by

Host: candyeye-71.ml
URL: http://candyeye-71.ml/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/C_i441fUnfg?autoplay=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://candyeye-71.ml/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://candyeye-71.ml/

Response headers

status: 200
content-type: text/html; charset=utf-8
x-content-type-options: nosniff
cache-control: no-cache
strict-transport-security: max-age=31536000
expires: Tue, 27 Apr 1971 19:44:06 GMT
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
content-encoding: br
date: Wed, 22 Apr 2020 15:43:14 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: VISITOR_INFO1_LIVE=2_GzY3-X524; path=/; domain=.youtube.com; secure; expires=Mon, 19-Oct-2020 15:43:14 GMT; httponly; samesite=None YSC=NbkifJSmI7E; path=/; domain=.youtube.com; secure; httponly; samesite=None GPS=1; path=/; domain=.youtube.com; expires=Wed, 22-Apr-2020 16:13:14 GMT VISITOR_INFO1_LIVE=2_GzY3-X524; path=/; domain=.youtube.com; secure; expires=Mon, 19-Oct-2020 15:43:14 GMT; httponly; samesite=None
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.youtube.com/	1970-01-19 08:59:31	Name: GPS Value: 1
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: NbkifJSmI7E
.youtube.com/	1970-01-19 13:18:42	Name: VISITOR_INFO1_LIVE Value: 2_GzY3-X524

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

candyeye-71.ml
encrypted-tbn0.gstatic.com
www.homelandsecureit.com
www.youtube.com
192.232.246.34
2a00:1450:4001:81d::200e
2a00:1450:4001:821::200e
68.115.151.37
1036341430f8ed6d14c50873b2e937c9e7ff29707b8a952e0fe1bc1c921cb79c
3b5bed100c6516f16555e52e5526838bb6f814c4d328c26d2ff4a661f42d32a5
52af13a5393aa1c5db6f93b260b175778ef2b58b719ad6575de89dd1a10d0c32

candyeye-71.ml Open in urlscan Pro 192.232.246.34 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

4 Requests

50 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

18 kBTransfer

17 kBSize

3 Cookies

2 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

3 Cookies

Indicators

candyeye-71.ml Open in urlscan Pro
192.232.246.34 Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

50 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

18 kB
Transfer

17 kB
Size

3
Cookies

4 HTTP transactions
0 data transactions