www.candymandroid.micronbots.com Open in urlscan Pro
173.254.30.110 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.candymandroid.micronbots.com/
Submission Tags: krdprod
Submission: On September 09 via api (September 9th 2021, 2:12:09 am UTC) from JP — Scanned from DE

Summary HTTP 11 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 5 domains to perform 11 HTTP transactions. The main IP is 173.254.30.110, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is www.candymandroid.micronbots.com.
TLS certificate: Issued by R3 on September 5th 2021. Valid for: 3 months.

This is the only time www.candymandroid.micronbots.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3	173.254.30.110 173.254.30.110	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
2 2	89.207.16.72 89.207.16.72	41041 (VCLK-EU-SE) (VCLK-EU-SE)
2	23.79.148.198 23.79.148.198	16625 (AKAMAI-AS) (AKAMAI-AS)
11	3

3 173.254.30.110 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: just2029.justhost.com

www.candymandroid.micronbots.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 89.207.16.72 (United States) 2 redirects

ASN41041 (VCLK-EU-SE, US)

www.tqlkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.lduhtrp.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.79.148.198 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-79-148-198.deploy.static.akamaitechnologies.com

www.yceml.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	micronbots.com www.candymandroid.micronbots.com	3 KB
2	yceml.net www.yceml.net	100 KB
1	lduhtrp.net 1 redirects www.lduhtrp.net	437 B
1	tqlkg.com 1 redirects www.tqlkg.com	437 B
0	candymandroid.com Failed candymandroid.com Failed
11	5

	Domain	Requested by
3	www.candymandroid.micronbots.com	www.candymandroid.micronbots.com
2	www.yceml.net	www.candymandroid.micronbots.com
1	www.lduhtrp.net	1 redirects
1	www.tqlkg.com	1 redirects
0	candymandroid.com Failed	www.candymandroid.micronbots.com
11	5

This site contains links to these domains. Also see Links.

Domain
www.droidstores.com
www.tkqlhce.com
www.dpbolvw.net
www.chocolatedroids.com
www.drinkingdroids.com

Subject Issuer	Validity	Valid
www.candymandroid.micronbots.com R3	`2021-09-05` - `2021-12-04`	3 months	crt.sh
www.yceml.net R3	`2021-07-27` - `2021-10-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.candymandroid.micronbots.com/
Frame ID: E8ABBCBEEFF5CE59658B3CB5B5168FC9
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Buy Candy Man Droid .Com

Page Statistics

11
Requests

45 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

3
IPs

2
Countries

103 kB
Transfer

108 kB
Size

0
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: http://www.droidstores.com/
Title: Droid Stores .com

Search URL Search Domain Scan URL

URL: http://www.tkqlhce.com/am77wktqks7C9BGBEE798GEBAD8

Search URL Search Domain Scan URL

URL: http://www.dpbolvw.net/1d111mu2-u1HMJLQLOOHJIORLPKJ

Search URL Search Domain Scan URL

URL: http://www.chocolatedroids.com/
Title: Chocolate Droids

Search URL Search Domain Scan URL

URL: http://www.drinkingdroids.com/
Title: Drinking Droids

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

https://www.tqlkg.com/31111jy1qwuFKHJOJMMFHGOMJILG HTTP 302
https://www.yceml.net/0658/10863250-1567802855616

Request Chain 3

https://www.lduhtrp.net/k8101xjnbhf052494770217A4832 HTTP 302
https://www.yceml.net/0089/10693721-1417805150542

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.candymandroid.micronbots.com/	9 KB 3 KB	788ms 368ms	Document text/html	173.254.30.110 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://www.candymandroid.micronbots.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 173.254.30.110 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS just2029.justhost.com Software Apache / Resource Hash `34185e2dfd7140e1a8be42d6cec3f411c7957c2e2305c101f46a03e4a53251d9` Request headers :method GET :authority www.candymandroid.micronbots.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Thu, 09 Sep 2021 02:12:02 GMT server Apache vary Accept-Encoding content-encoding gzip content-length 2909 content-type text/html; charset=UTF-8
GET H2	200	spacer.gif www.candymandroid.micronbots.com/images/	43 B 131 B	159ms 158ms	Image image/gif	173.254.30.110 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://www.candymandroid.micronbots.com/images/spacer.gif Requested by Host: www.candymandroid.micronbots.com URL: https://www.candymandroid.micronbots.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 173.254.30.110 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS just2029.justhost.com Software Apache / Resource Hash `b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b` Request headers :path /images/spacer.gif pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority www.candymandroid.micronbots.com referer https://www.candymandroid.micronbots.com/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.candymandroid.micronbots.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Thu, 09 Sep 2021 02:12:03 GMT last-modified Sun, 17 Oct 2010 10:12:25 GMT server Apache accept-ranges bytes content-length 43 content-type image/gif
GET H2	200	headerimage.gif www.candymandroid.micronbots.com/images/	43 B 72 B	160ms 160ms	Image image/gif	173.254.30.110 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://www.candymandroid.micronbots.com/images/headerimage.gif Requested by Host: www.candymandroid.micronbots.com URL: https://www.candymandroid.micronbots.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 173.254.30.110 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS just2029.justhost.com Software Apache / Resource Hash `b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b` Request headers :path /images/headerimage.gif pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority www.candymandroid.micronbots.com referer https://www.candymandroid.micronbots.com/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.candymandroid.micronbots.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Thu, 09 Sep 2021 02:12:03 GMT last-modified Sun, 17 Oct 2010 10:12:25 GMT server Apache accept-ranges bytes content-length 43 content-type image/gif
GET H/1.1	200 OK	10863250-1567802855616 www.yceml.net/0658/ Redirect Chain https://www.tqlkg.com/31111jy1qwuFKHJOJMMFHGOMJILG https://www.yceml.net/0658/10863250-1567802855616	45 KB 45 KB	189ms 30ms	Image image/jpeg	23.79.148.198 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.yceml.net/0658/10863250-1567802855616 Requested by Host: www.candymandroid.micronbots.com URL: https://www.candymandroid.micronbots.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.79.148.198 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-79-148-198.deploy.static.akamaitechnologies.com Software Server / Resource Hash `9f17fe7250bcdd7b9d94daaa588e68cadfbda7fa975e87f416a61eeb9673a21d` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.candymandroid.micronbots.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Thu, 09 Sep 2021 02:12:03 GMT Cache-Control max-age=604800 Server Server Connection keep-alive Content-Length 46391 Expires Thu, 16 Sep 2021 02:12:03 GMT Redirect headers Pragma no-cache Date Thu, 09 Sep 2021 02:12:02 GMT Server Server P3P policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT" Location https://www.yceml.net/0658/10863250-1567802855616 Cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection close Content-Type text/html; charset=UTF-8 Content-Length 87 Expires Thu, 09 Sep 2021 02:12:03 GMT
GET H/1.1	200 OK	10693721-1417805150542 www.yceml.net/0089/ Redirect Chain https://www.lduhtrp.net/k8101xjnbhf052494770217A4832 https://www.yceml.net/0089/10693721-1417805150542	54 KB 54 KB	191ms 32ms	Image image/gif	23.79.148.198 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.yceml.net/0089/10693721-1417805150542 Requested by Host: www.candymandroid.micronbots.com URL: https://www.candymandroid.micronbots.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.79.148.198 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-79-148-198.deploy.static.akamaitechnologies.com Software Server / Resource Hash `b2852623a94d7959e07994c6ca50662876c56122f3315d1144447e4af86cc261` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.candymandroid.micronbots.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Thu, 09 Sep 2021 02:12:03 GMT Cache-Control max-age=604800 Server Server Connection keep-alive Content-Length 55296 Expires Thu, 16 Sep 2021 02:12:03 GMT Redirect headers Pragma no-cache Date Thu, 09 Sep 2021 02:12:02 GMT Server Server P3P policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT" Location https://www.yceml.net/0089/10693721-1417805150542 Cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection close Content-Type text/html; charset=UTF-8 Content-Length 87 Expires Thu, 09 Sep 2021 02:12:03 GMT
GET		style.css candymandroid.com/	0 0

GET		Verdana.css candymandroid.com/	0 0

GET		Navigator.css candymandroid.com/	0 0

GET		pathway.css candymandroid.com/	0 0

GET		rvsheadpage.js candymandroid.com/rvsincludefile/	0 0

GET		rvscustomopenwindow.js candymandroid.com/rvsincludefile/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: candymandroid.com
URL: http://candymandroid.com/style.css

Domain: candymandroid.com
URL: http://candymandroid.com/Verdana.css

Domain: candymandroid.com
URL: http://candymandroid.com/Navigator.css

Domain: candymandroid.com
URL: http://candymandroid.com/pathway.css

Domain: candymandroid.com
URL: http://candymandroid.com/rvsincludefile/rvsheadpage.js

Domain: candymandroid.com
URL: http://candymandroid.com/rvsincludefile/rvscustomopenwindow.js

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster function| chkWindowjs

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

10 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://www.candymandroid.micronbots.com/(Line 1) Message: Mixed Content: The page at 'https://www.candymandroid.micronbots.com/' was loaded over HTTPS, but requested an insecure element 'http://www.tqlkg.com/31111jy1qwuFKHJOJMMFHGOMJILG'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.candymandroid.micronbots.com/(Line 1) Message: Mixed Content: The page at 'https://www.candymandroid.micronbots.com/' was loaded over HTTPS, but requested an insecure element 'http://www.lduhtrp.net/k8101xjnbhf052494770217A4832'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	error	URL: https://www.candymandroid.micronbots.com/(Line 10) Message: Mixed Content: The page at 'https://www.candymandroid.micronbots.com/' was loaded over HTTPS, but requested an insecure stylesheet 'http://candymandroid.com/style.css'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://www.candymandroid.micronbots.com/(Line 11) Message: Mixed Content: The page at 'https://www.candymandroid.micronbots.com/' was loaded over HTTPS, but requested an insecure stylesheet 'http://candymandroid.com/Verdana.css'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://www.candymandroid.micronbots.com/(Line 12) Message: Mixed Content: The page at 'https://www.candymandroid.micronbots.com/' was loaded over HTTPS, but requested an insecure stylesheet 'http://candymandroid.com/Navigator.css'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://www.candymandroid.micronbots.com/(Line 13) Message: Mixed Content: The page at 'https://www.candymandroid.micronbots.com/' was loaded over HTTPS, but requested an insecure stylesheet 'http://candymandroid.com/pathway.css'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://www.candymandroid.micronbots.com/ Message: Mixed Content: The page at 'https://www.candymandroid.micronbots.com/' was loaded over HTTPS, but requested an insecure script 'http://candymandroid.com/rvsincludefile/rvsheadpage.js'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://www.candymandroid.micronbots.com/ Message: Mixed Content: The page at 'https://www.candymandroid.micronbots.com/' was loaded over HTTPS, but requested an insecure script 'http://candymandroid.com/rvsincludefile/rvscustomopenwindow.js'. This request has been blocked; the content must be served over HTTPS.
security	warning	URL: https://www.candymandroid.micronbots.com/ Message: Mixed Content: The page at 'https://www.candymandroid.micronbots.com/' was loaded over HTTPS, but requested an insecure element 'http://www.tqlkg.com/31111jy1qwuFKHJOJMMFHGOMJILG'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.candymandroid.micronbots.com/ Message: Mixed Content: The page at 'https://www.candymandroid.micronbots.com/' was loaded over HTTPS, but requested an insecure element 'http://www.lduhtrp.net/k8101xjnbhf052494770217A4832'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

candymandroid.com
www.candymandroid.micronbots.com
www.lduhtrp.net
www.tqlkg.com
www.yceml.net
candymandroid.com
173.254.30.110
23.79.148.198
89.207.16.72
34185e2dfd7140e1a8be42d6cec3f411c7957c2e2305c101f46a03e4a53251d9
9f17fe7250bcdd7b9d94daaa588e68cadfbda7fa975e87f416a61eeb9673a21d
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2852623a94d7959e07994c6ca50662876c56122f3315d1144447e4af86cc261

www.candymandroid.micronbots.com Open in urlscan Pro 173.254.30.110 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

11 Requests

45 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

3 IPs

2 Countries

103 kBTransfer

108 kBSize

0 Cookies

5 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

0 Cookies

10 Console Messages

Indicators

www.candymandroid.micronbots.com Open in urlscan Pro
173.254.30.110 Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

45 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

3
IPs

2
Countries

103 kB
Transfer

108 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions