hayman.carrd.co Open in urlscan Pro
104.18.40.34 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://hayman.carrd.co/
Effective URL:
https://hayman.carrd.co/
Submission: On July 24 via api (July 24th 2024, 12:18:46 am UTC) from US — Scanned from DE

Summary HTTP 12 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 8 domains to perform 12 HTTP transactions. The main IP is 104.18.40.34, located in and belongs to CLOUDFLARENET, US. The main domain is hayman.carrd.co.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on February 29th 2024. Valid for: 10 months.

This is the only time hayman.carrd.co was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3	104.18.40.34 104.18.40.34	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
2	96.43.128.66 96.43.128.66	19969 (JOESDATAC...) (JOESDATACENTER)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
2 4	2620:100:6022... 2620:100:6022:15::a27d:420f	19679 (DROPBOX) (DROPBOX)
1	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
1 1	184.105.177.70 184.105.177.70	6939 (HURRICANE) (HURRICANE)
1	184.105.177.71 184.105.177.71	6939 (HURRICANE) (HURRICANE)
12	7

3 104.18.40.34 (None, )

ASN13335 (CLOUDFLARENET, US)

hayman.carrd.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 96.43.128.66 (United States)

ASN19969 (JOESDATACENTER, US)

cur.cursors-4u.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:100:6022:15::a27d:420f (United States) 2 redirects

ASN19679 (DROPBOX, US)

dl.dropbox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dl.dropboxusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.105.177.70 (United States) 1 redirects

ASN6939 (HURRICANE, US)
PTR: s4.opendrive.com

od.lk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.105.177.71 (United States)

ASN6939 (HURRICANE, US)
PTR: s5.opendrive.com

web.opendrive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 110 ajax.googleapis.com — Cisco Umbrella Rank: 641	35 KB
3	carrd.co hayman.carrd.co	95 KB
2	dropboxusercontent.com dl.dropboxusercontent.com — Cisco Umbrella Rank: 27137	92 KB
2	dropbox.com 2 redirects dl.dropbox.com — Cisco Umbrella Rank: 64758	1 KB
2	cursors-4u.net cur.cursors-4u.net — Cisco Umbrella Rank: 930194	6 KB
1	opendrive.com web.opendrive.com — Cisco Umbrella Rank: 564302
1	od.lk 1 redirects od.lk — Cisco Umbrella Rank: 369879	367 B
1	gstatic.com fonts.gstatic.com	126 KB
12	8

	Domain	Requested by
3	hayman.carrd.co	hayman.carrd.co
2	dl.dropboxusercontent.com	hayman.carrd.co
2	dl.dropbox.com	2 redirects
2	cur.cursors-4u.net	hayman.carrd.co
2	fonts.googleapis.com	hayman.carrd.co
1	web.opendrive.com	hayman.carrd.co
1	od.lk	1 redirects
1	fonts.gstatic.com	fonts.googleapis.com
1	ajax.googleapis.com	hayman.carrd.co
12	9

This site contains links to these domains. Also see Links.

Domain
www.cursors-4u.com

Subject Issuer	Validity	Valid
carrd.co Cloudflare Inc ECC CA-3	`2024-02-29` - `2024-12-31`	10 months	crt.sh
upload.video.google.com WR2	`2024-07-01` - `2024-09-23`	3 months	crt.sh
ani.cursors-4u.net R10	`2024-07-08` - `2024-10-06`	3 months	crt.sh
*.gstatic.com WR2	`2024-07-01` - `2024-09-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://hayman.carrd.co/
Frame ID: 5305E2812E064DD11DBB03BC48FAE3A2
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

★

Page URL History Show full URLs

http://hayman.carrd.co/ HTTP 307
https://hayman.carrd.co/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

75 %
HTTPS

50 %
IPv6

8
Domains

9
Subdomains

7
IPs

3
Countries

353 kB
Transfer

687 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.cursors-4u.com/cursor/2011/11/10/small-grey-outline-pointer.html

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://hayman.carrd.co/ HTTP 307
https://hayman.carrd.co/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5

https://dl.dropbox.com/s/brdv4yv2iaigjmp/glenplayer07.js HTTP 302
https://dl.dropboxusercontent.com/s/brdv4yv2iaigjmp/glenplayer07.js

Request Chain 7

https://dl.dropbox.com/s/uougf9v63jmphoj/Jojoba.otf HTTP 302
https://dl.dropboxusercontent.com/s/uougf9v63jmphoj/Jojoba.otf

Request Chain 9

https://od.lk/s/MzFfNjU5MDIzNTVf/WHAT%20THE%20HIP%20HOP%20HELL%20IS%20THIS-.mp3 HTTP 302
https://web.opendrive.com/api/v1/download/file.json/MzFfNjU5MDIzNTVf?temp_key=Xp%13%DBD%C7%13m%07+%FD%B4%1C%E3%F6%D0q%0B%2Fm%08Km%13%1C%84%A6%A7&inline=1

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
hayman.carrd.co/
Redirect Chain

http://hayman.carrd.co/
https://hayman.carrd.co/

100 KB
17 KB

1776ms
341ms

Document
text/html

104.18.40.34
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hayman.carrd.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.40.34 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64b3fc37c193e0a8c63595afa857c4a89052bac9d92ed0da68c1940f46d29186

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

cache-control: max-age=0
cf-cache-status: DYNAMIC
cf-ray: 8a7fbbfd6e51bbaf-FRA
content-encoding: gzip
content-type: text/html
date: Wed, 24 Jul 2024 00:18:41 GMT
expires: Wed, 24 Jul 2024 00:18:41 GMT
last-modified: Tue, 25 Jun 2024 22:05:26 GMT
server: cloudflare
vary: Accept-Encoding

Redirect headers

Location: https://hayman.carrd.co/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 image01.jpg
hayman.carrd.co/assets/images/ 77 KB
78 KB 540ms
540ms Image
image/jpeg 104.18.40.34
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hayman.carrd.co/assets/images/image01.jpg?v=1be6b94c
Requested by: Host: hayman.carrd.co
URL: https://hayman.carrd.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.40.34 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ba613a6bac34d9a351af19f57d72debb18b1a60d1a5719a90648231986ec104b

Request headers

Referer: https://hayman.carrd.co/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 00:18:41 GMT
cf-cache-status: MISS
last-modified: Tue, 25 Jun 2024 21:59:51 GMT
server: cloudflare
etag: "1358c-61bbe046380b0"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=604800
accept-ranges: bytes
cf-ray: 8a7fbbffd830bbaf-FRA
content-length: 79244
expires: Wed, 31 Jul 2024 00:18:41 GMT

GET
H2 200 css
fonts.googleapis.com/ 1 KB
501 B 110ms
39ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=ABeeZee|Karla

Requested by

Host: hayman.carrd.co
URL: https://hayman.carrd.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

966816727f74ba203bedfac85bd987e0d2349fdc572fb723916ce60da82e6b15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hayman.carrd.co/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 24 Jul 2024 00:18:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 24 Jul 2024 00:18:41 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 24 Jul 2024 00:18:41 GMT

GET
H2 200 icon
fonts.googleapis.com/ 569 B
775 B 109ms
39ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/icon?family=Material+Icons

Requested by

Host: hayman.carrd.co
URL: https://hayman.carrd.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

36b2057eb5eef261a2cbb8c149dcf3a11edaa15ccd8e3d462eb34999f5ff8f2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hayman.carrd.co/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 24 Jul 2024 00:18:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 24 Jul 2024 00:18:41 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 24 Jul 2024 00:18:41 GMT

GET
H/1.1 200
OK cursor.png
cur.cursors-4u.net/ 1 KB
1 KB 569ms
133ms Image
image/png 96.43.128.66
JOESDATACENTER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cur.cursors-4u.net/cursor.png
Requested by: Host: hayman.carrd.co
URL: https://hayman.carrd.co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 96.43.128.66 , United States, ASN19969 (JOESDATACENTER, US),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: 9f4185f44c07da894dee2b3f016585769af454b43bd06376e13804d88cfc3a54

Request headers

Referer: https://hayman.carrd.co/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Wed, 24 Jul 2024 00:18:41 GMT
Content-Encoding: gzip
Last-Modified: Wed, 27 Feb 2013 17:33:08 GMT
Server: nginx/1.16.1
ETag: W/"512e4354-4d5"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: image/png
Connection: keep-alive

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.7/ 93 KB
34 KB 108ms
32ms Script
text/javascript 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.7/jquery.min.js

Requested by

Host: hayman.carrd.co
URL: https://hayman.carrd.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hayman.carrd.co/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 23 Jul 2024 11:50:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 44872
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33845
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 23 Jul 2025 11:50:49 GMT

GET
H2

200

glenplayer07.js Show response
dl.dropboxusercontent.com/s/brdv4yv2iaigjmp/
Redirect Chain

https://dl.dropbox.com/s/brdv4yv2iaigjmp/glenplayer07.js
https://dl.dropboxusercontent.com/s/brdv4yv2iaigjmp/glenplayer07.js

2 KB
1 KB

557ms
543ms

Script
application/javascript

2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL

https://dl.dropboxusercontent.com/s/brdv4yv2iaigjmp/glenplayer07.js

Requested by

Host: hayman.carrd.co
URL: https://hayman.carrd.co/

Protocol

Server

2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

999d162032c4296df93623fba73bcc6532dd30ecb24631acfea0f28b8211dfc0

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://hayman.carrd.co/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
date: Wed, 24 Jul 2024 00:18:41 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-dropbox-request-id: 94c343acb65d4dc4b3de72c081c6e8e7
x-dropbox-response-origin: far_remote
content-disposition: inline; filename="glenplayer07.js"; filename*=UTF-8''glenplayer07.js
pragma: public
server: envoy
x-server-response-time: 364
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=60
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noimageindex

Redirect headers

content-security-policy: sandbox
date: Wed, 24 Jul 2024 00:18:41 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: envoy
vary: Accept-Encoding
content-type: text/html; charset=utf-8
location: https://dl.dropboxusercontent.com/s/brdv4yv2iaigjmp/glenplayer07.js
x-dropbox-request-id: 96de82dfacc74546800caf1cf9693248
cache-control: no-cache
x-dropbox-response-origin: far_remote
x-robots-tag: noindex, nofollow, noimageindex

GET
H/1.1 200
OK cur817.cur
cur.cursors-4u.net/cursors/cur-9/ 4 KB
4 KB 452ms
132ms Image
application/octet-stream 96.43.128.66
JOESDATACENTER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cur.cursors-4u.net/cursors/cur-9/cur817.cur
Requested by: Host: hayman.carrd.co
URL: https://hayman.carrd.co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 96.43.128.66 , United States, ASN19969 (JOESDATACENTER, US),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: f1d399112baf5bf8383872a42f0612b2c837102946697d0aed645fa1b2ee3719

Request headers

Referer: https://hayman.carrd.co/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Wed, 24 Jul 2024 00:18:41 GMT
Last-Modified: Wed, 27 Feb 2013 17:46:14 GMT
Server: nginx/1.16.1
ETag: "512e4666-10be"
Content-Type: application/octet-stream
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4286

GET
H2

200

Jojoba.otf
dl.dropboxusercontent.com/s/uougf9v63jmphoj/
Redirect Chain

https://dl.dropbox.com/s/uougf9v63jmphoj/Jojoba.otf
https://dl.dropboxusercontent.com/s/uougf9v63jmphoj/Jojoba.otf

90 KB
90 KB

618ms
616ms

Font
application/octet-stream

2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL

https://dl.dropboxusercontent.com/s/uougf9v63jmphoj/Jojoba.otf

Requested by

Host: hayman.carrd.co
URL: https://hayman.carrd.co/

Protocol

Server

2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

f5e996c2130ec7a06660413294be6005c300b0c66ae20f189fb3face8d9b05c7

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://hayman.carrd.co/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
date: Wed, 24 Jul 2024 00:18:42 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-dropbox-request-id: 8eb39b2adff24d1f8f9bcd76ad4e758f
x-dropbox-response-origin: far_remote
content-disposition: inline; filename="Jojoba.otf"; filename*=UTF-8''Jojoba.otf
content-length: 91904
pragma: public
server: envoy
etag: 1638939705021690n
x-server-response-time: 446
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Disposition, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed
cache-control: max-age=60
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noimageindex

Redirect headers

content-security-policy: sandbox
date: Wed, 24 Jul 2024 00:18:41 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: envoy
vary: Accept-Encoding
content-type: text/html; charset=utf-8
access-control-allow-origin: *
location: https://dl.dropboxusercontent.com/s/uougf9v63jmphoj/Jojoba.otf
access-control-expose-headers: Accept-Ranges, Content-Disposition, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed
cache-control: no-cache
x-dropbox-response-origin: far_remote
x-robots-tag: noindex, nofollow, noimageindex
x-dropbox-request-id: 9d0a5ad13e734703a592c80dfabe2a93

GET
H2 200 flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
fonts.gstatic.com/s/materialicons/v142/ 125 KB
126 KB 113ms
36ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/materialicons/v142/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/icon?family=Material+Icons

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hayman.carrd.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 23 Jul 2024 07:51:59 GMT
x-content-type-options: nosniff
age: 59202
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 128352
x-xss-protection: 0
last-modified: Mon, 08 Apr 2024 19:04:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 23 Jul 2025 07:51:59 GMT

GET
H2

200

MzFfNjU5MDIzNTVf
web.opendrive.com/api/v1/download/file.json/
Redirect Chain

https://od.lk/s/MzFfNjU5MDIzNTVf/WHAT%20THE%20HIP%20HOP%20HELL%20IS%20THIS-.mp3
https://web.opendrive.com/api/v1/download/file.json/MzFfNjU5MDIzNTVf?temp_key=Xp%13%DBD%C7%13m%07+%FD%B4%1C%E3%F6%D0q%0B%2Fm%08Km%13%1C%84%A6%A7&inline=1

192 KB
0

1630ms
1287ms

Media
audio/mpeg

184.105.177.71
HURRICANE

General

Check archive.org

Show headers Download Go to

Full URL

https://web.opendrive.com/api/v1/download/file.json/MzFfNjU5MDIzNTVf?temp_key=Xp%13%DBD%C7%13m%07+%FD%B4%1C%E3%F6%D0q%0B%2Fm%08Km%13%1C%84%A6%A7&inline=1

Requested by

Host: hayman.carrd.co
URL: https://hayman.carrd.co/

Protocol

Server

184.105.177.71 , United States, ASN6939 (HURRICANE, US),

Reverse DNS

s5.opendrive.com

Software

/ PHP/7.4.33

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Referer: https://hayman.carrd.co/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: public
date: Wed, 24 Jul 2024 00:18:43 GMT
strict-transport-security: max-age=63072000; includeSubDomains
x-powered-by: PHP/7.4.33
serverid: s5
content-type: audio/mpeg
access-control-allow-origin: *
content-range: bytes 0-2593243/2593244
cache-control: must-revalidate, post-check=0, pre-check=0, private
content-transfer-encoding: binary
content-disposition: inline; filename*=UTF-8''WHAT%20THE%20HIP%20HOP%20HELL%20IS%20THIS-.mp3
accept-ranges: bytes
content-length: 2593244
expires: Fri, 23 Aug 2024 00:18:43 GMT

Redirect headers

date: Wed, 24 Jul 2024 00:18:41 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-powered-by: PHP/7.4.33
x-frame-options: DENY
content-type: text/html; charset=UTF-8
location: https://web.opendrive.com/api/v1/download/file.json/MzFfNjU5MDIzNTVf?temp_key=Xp%13%DBD%C7%13m%07+%FD%B4%1C%E3%F6%D0q%0B%2Fm%08Km%13%1C%84%A6%A7&inline=1
x-fastcgi-cache: MISS
cache-control: no-cache, max-age=0, s-max-age=0, must-revalidate, no-store

GET
H2 404 favicon.ico
hayman.carrd.co/ 637 B
558 B 311ms
310ms Other
text/html 104.18.40.34
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hayman.carrd.co/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.40.34 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 219e5ae2778f7c3e1a9a0609f5f465a4fa58a9cf0655657d9274b3c5bd043671

Request headers

Referer: https://hayman.carrd.co/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 00:18:44 GMT
content-encoding: gzip
cf-cache-status: MISS
server: cloudflare
vary: Accept-Encoding
content-type: text/html; charset=iso-8859-1
cache-control: public, max-age=14400
cf-ray: 8a7fbc12d8a5bbaf-FRA
expires: Wed, 24 Jul 2024 04:18:44 GMT

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.dropboxusercontent.com/	1969-12-31 23:59:59	Name: uc_session Value: 41ycacAZa7L3ejKi0XKaJZ9tlVjVQ3YHeTK4YFnTKiPHgDo5mb94FEy9fMC9xN0j

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://hayman.carrd.co/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cur.cursors-4u.net
dl.dropbox.com
dl.dropboxusercontent.com
fonts.googleapis.com
fonts.gstatic.com
hayman.carrd.co
od.lk
web.opendrive.com
104.18.40.34
184.105.177.70
184.105.177.71
2620:100:6022:15::a27d:420f
2a00:1450:4001:80b::200a
2a00:1450:4001:810::2003
2a00:1450:4001:82a::200a
96.43.128.66
219e5ae2778f7c3e1a9a0609f5f465a4fa58a9cf0655657d9274b3c5bd043671
36b2057eb5eef261a2cbb8c149dcf3a11edaa15ccd8e3d462eb34999f5ff8f2a
47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4
64b3fc37c193e0a8c63595afa857c4a89052bac9d92ed0da68c1940f46d29186
8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1
966816727f74ba203bedfac85bd987e0d2349fdc572fb723916ce60da82e6b15
999d162032c4296df93623fba73bcc6532dd30ecb24631acfea0f28b8211dfc0
9f4185f44c07da894dee2b3f016585769af454b43bd06376e13804d88cfc3a54
ba613a6bac34d9a351af19f57d72debb18b1a60d1a5719a90648231986ec104b
f1d399112baf5bf8383872a42f0612b2c837102946697d0aed645fa1b2ee3719
f5e996c2130ec7a06660413294be6005c300b0c66ae20f189fb3face8d9b05c7

hayman.carrd.co Open in urlscan Pro 104.18.40.34 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

75 %HTTPS

50 %IPv6

8 Domains

9 Subdomains

7 IPs

3 Countries

353 kBTransfer

687 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

hayman.carrd.co Open in urlscan Pro
104.18.40.34 Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

75 %
HTTPS

50 %
IPv6

8
Domains

9
Subdomains

7
IPs

3
Countries

353 kB
Transfer

687 kB
Size

1
Cookies

12 HTTP transactions
0 data transactions