tourhandel.top Open in urlscan Pro
216.119.148.54  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response tourhandel.top/tam/2/	26 KB 6 KB	518ms 133ms	Document text/html	216.119.148.54 Hosting Services
General Check archive.org Show headers Download Go to Full URL http://tourhandel.top/tam/2/?n=KDg0NCkgMzg5LTE3MTE=3MTE= Protocol HTTP/1.1 Server 216.119.148.54 Atlanta, United States, ASN32780 (HOSTINGSERVICES-INC - Hosting Services, Inc., US), Reverse DNS shared01.atl-e.highimpacttech.net Software LiteSpeed / Resource Hash dab36a82dac7c074698068a55d70e5d0ee1641555a82fba6f4141603ec71955d Request headers Host tourhandel.top Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Etag "6635-5ce01bb8-12137e;gz" Last-Modified Sat, 18 May 2019 14:50:32 GMT Content-Type text/html Content-Length 5360 Accept-Ranges bytes Content-Encoding gzip Vary Accept-Encoding Date Fri, 05 Jul 2019 19:30:14 GMT Server LiteSpeed Connection Keep-Alive
GET		bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/	0 0
GET		bootstrap-theme.min.css maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/	0 0
GET H/1.1	200 OK	style.css tourhandel.top/tam/2/css/	4 KB 2 KB	138ms 133ms	Stylesheet text/css	216.119.148.54 Hosting Services
General Check archive.org Show headers Download Go to Full URL http://tourhandel.top/tam/2/css/style.css Requested by Host: tourhandel.top URL: http://tourhandel.top/tam/2/?n=KDg0NCkgMzg5LTE3MTE=3MTE= Protocol HTTP/1.1 Security , , Server 216.119.148.54 Atlanta, United States, ASN32780 (HOSTINGSERVICES-INC - Hosting Services, Inc., US), Reverse DNS shared01.atl-e.highimpacttech.net Software LiteSpeed / Resource Hash 58aeb9f772eaa9b56371ca46af24d5cab80bbefce865447628bc7d5126bb180f Request headers Referer http://tourhandel.top/tam/2/?n=KDg0NCkgMzg5LTE3MTE=3MTE= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 05 Jul 2019 19:30:14 GMT Content-Encoding gzip Last-Modified Fri, 03 May 2019 15:53:00 GMT Server LiteSpeed Etag "f3c-5ccc63dc-121376;gz" Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 1286 Expires Fri, 12 Jul 2019 19:30:14 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.3.1/	85 KB 30 KB	10ms 6ms	Script text/javascript	2a00:1450:4001:81e::200a Google LLC
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js Requested by Host: tourhandel.top URL: http://tourhandel.top/tam/2/?n=KDg0NCkgMzg5LTE3MTE=3MTE= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://tourhandel.top/tam/2/?n=KDg0NCkgMzg5LTE3MTE=3MTE= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 19 Jun 2019 20:36:41 GMT content-encoding gzip x-content-type-options nosniff age 1378413 status 200 alt-svc quic=":443"; ma=2592000; v="46,43,39" content-length 30399 x-xss-protection 0 last-modified Thu, 25 Jan 2018 15:33:24 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 18 Jun 2020 20:36:41 GMT
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/3.4.0/js/	37 KB 10 KB	1130ms 36ms	Script text/javascript	209.197.3.15 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/3.4.0/js/bootstrap.min.js Requested by Host: tourhandel.top URL: http://tourhandel.top/tam/2/?n=KDg0NCkgMzg5LTE3MTE=3MTE= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 209.197.3.15 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US), Reverse DNS vip0x00f.map2.ssl.hwcdn.net Software / Resource Hash 909ae563eb34f7e4285a3a643ab5d7c21c5e6a80f3f455b949ac45f08d0389b4 Request headers Referer http://tourhandel.top/tam/2/?n=KDg0NCkgMzg5LTE3MTE=3MTE= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 05 Jul 2019 19:30:15 GMT content-encoding gzip last-modified Fri, 14 Dec 2018 05:14:43 GMT access-control-allow-origin * etag "1544764483" vary Accept-Encoding x-cache HIT content-type text/javascript; charset=utf-8 status 200 cache-control public, max-age=31536000 x-hello-human Say hello back! @getBootstrapCDN on Twitter accept-ranges bytes timing-allow-origin * content-length 10035
GET H/1.1	200 OK	rsod.png tourhandel.top/tam/2/images/	11 KB 11 KB	272ms 134ms	Image image/png	216.119.148.54 Hosting Services
General Check archive.org Show headers Download Go to Show image Full URL http://tourhandel.top/tam/2/images/rsod.png Requested by Host: tourhandel.top URL: http://tourhandel.top/tam/2/?n=KDg0NCkgMzg5LTE3MTE=3MTE= Protocol HTTP/1.1 Security , , Server 216.119.148.54 Atlanta, United States, ASN32780 (HOSTINGSERVICES-INC - Hosting Services, Inc., US), Reverse DNS shared01.atl-e.highimpacttech.net Software LiteSpeed / Resource Hash 606a248227b8bfb26e81383ad9d7fa4d01a31ed02a31b282dc57790cf285d42a Request headers Referer http://tourhandel.top/tam/2/?n=KDg0NCkgMzg5LTE3MTE=3MTE= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 05 Jul 2019 19:30:14 GMT Last-Modified Fri, 03 May 2019 15:53:02 GMT Server LiteSpeed Etag "2a9c-5ccc63de-12137c;;;" Content-Type image/png Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 10908 Expires Fri, 12 Jul 2019 19:30:14 GMT
GET H/1.1	200 OK	335158-windows-8-window.png tourhandel.top/tam/2/images/	28 KB 28 KB	406ms 133ms	Image image/png	216.119.148.54 Hosting Services
General Check archive.org Show headers Download Go to Show image Full URL http://tourhandel.top/tam/2/images/335158-windows-8-window.png Requested by Host: tourhandel.top URL: http://tourhandel.top/tam/2/?n=KDg0NCkgMzg5LTE3MTE=3MTE= Protocol HTTP/1.1 Security , , Server 216.119.148.54 Atlanta, United States, ASN32780 (HOSTINGSERVICES-INC - Hosting Services, Inc., US), Reverse DNS shared01.atl-e.highimpacttech.net Software LiteSpeed / Resource Hash 312c6606235f1ba63b2141b812fef5398536390a76c85f5ab8bcc35a7aa8737e Request headers Referer http://tourhandel.top/tam/2/?n=KDg0NCkgMzg5LTE3MTE=3MTE= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 05 Jul 2019 19:30:14 GMT Last-Modified Fri, 03 May 2019 15:53:04 GMT Server LiteSpeed Etag "7019-5ccc63e0-121379;;;" Content-Type image/png Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 28697 Expires Fri, 12 Jul 2019 19:30:14 GMT
GET		jquery-3.3.1.min.js code.jquery.com/	0 0
GET H/1.1	200 OK	script.js Show response tourhandel.top/tam/2/js/	8 KB 3 KB	134ms 133ms	Script application/x-javascript	216.119.148.54 Hosting Services
General Check archive.org Show headers Download Go to Full URL http://tourhandel.top/tam/2/js/script.js Requested by Host: tourhandel.top URL: http://tourhandel.top/tam/2/?n=KDg0NCkgMzg5LTE3MTE=3MTE= Protocol HTTP/1.1 Security , , Server 216.119.148.54 Atlanta, United States, ASN32780 (HOSTINGSERVICES-INC - Hosting Services, Inc., US), Reverse DNS shared01.atl-e.highimpacttech.net Software LiteSpeed / Resource Hash 41ae6129a5b555a62d882ea0d19bb1e01106f3696fa1f566f3844db874d38e38 Request headers Referer http://tourhandel.top/tam/2/?n=KDg0NCkgMzg5LTE3MTE=3MTE= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 05 Jul 2019 19:30:14 GMT Content-Encoding gzip Last-Modified Fri, 03 May 2019 15:53:04 GMT Server LiteSpeed Etag "1ee7-5ccc63e0-121380;gz" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 2213 Expires Fri, 12 Jul 2019 19:30:14 GMT
GET H2	200	css fonts.googleapis.com/	33 KB 2 KB	20ms 19ms	Stylesheet text/css	2a00:1450:4001:81b::200a Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Comfortaa:300|Cormorant+Garamond|Cormorant+Infant|Cormorant+SC|Cormorant+Unicase|EB+Garamond|El+Messiri|Forum|Jura|Lobster|Neucha|Open+Sans+Condensed:300|PT+Sans|PT+Sans+Narrow|Philosopher|Playfair+Display+SC|Poiret+One|Ruslan+Display|Russo+One|Ubuntu&subset=cyrillic Requested by Host: tourhandel.top URL: http://tourhandel.top/tam/2/?n=KDg0NCkgMzg5LTE3MTE=3MTE= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software ESF / Resource Hash 195e971b0ab47e9484914db60c36589144dfaafce37408fdacf99aef82ebc5c9 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer http://tourhandel.top/tam/2/?n=KDg0NCkgMzg5LTE3MTE=3MTE= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding br last-modified Fri, 05 Jul 2019 19:30:14 GMT server ESF access-control-allow-origin * date Fri, 05 Jul 2019 19:30:14 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 status 200 alt-svc quic=":443"; ma=2592000; v="46,43,39" cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin x-xss-protection 0 expires Fri, 05 Jul 2019 19:30:14 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

maxcdn.bootstrapcdn.com

URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css

Domain

maxcdn.bootstrapcdn.com

URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap-theme.min.css

Domain

code.jquery.com

URL

https://code.jquery.com/jquery-3.3.1.min.js

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Tech Support Scam (Consumer) Microsoft (Consumer)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask boolean| isOpera boolean| isFirefox boolean| isSafari boolean| isChrome boolean| isIE function| getVariableFromURl function| getURLParameter function| decode_base64 string| base64_phone string| phone string| z

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
code.jquery.com
fonts.googleapis.com
maxcdn.bootstrapcdn.com
tourhandel.top
code.jquery.com
maxcdn.bootstrapcdn.com
209.197.3.15
216.119.148.54
2a00:1450:4001:81b::200a
2a00:1450:4001:81e::200a
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
195e971b0ab47e9484914db60c36589144dfaafce37408fdacf99aef82ebc5c9
312c6606235f1ba63b2141b812fef5398536390a76c85f5ab8bcc35a7aa8737e
41ae6129a5b555a62d882ea0d19bb1e01106f3696fa1f566f3844db874d38e38
58aeb9f772eaa9b56371ca46af24d5cab80bbefce865447628bc7d5126bb180f
606a248227b8bfb26e81383ad9d7fa4d01a31ed02a31b282dc57790cf285d42a
909ae563eb34f7e4285a3a643ab5d7c21c5e6a80f3f455b949ac45f08d0389b4
dab36a82dac7c074698068a55d70e5d0ee1641555a82fba6f4141603ec71955d