m7mzu-saaaa-aaaad-qboyq-cai.icp0.io
195.5.171.243  Public Scan Open in urlscan Pro

Internal
urlscan.io (IP) urlscan.io (Domain)
Effective Hostname
VirusTotal SecurityTrails crt.sh
Submitted URL
Google Safe Browsing Archive.org
Effective IP
VirusTotal SecurityTrails Domaintools Censys
Go To Rescan
Add Verdict Report
URL:
https://m7mzu-saaaa-aaaad-qboyq-cai.icp0.io/serviceworker/redirect.html 2yr old
Submission: On May 20 via api (May 20th 2025, 10:47:07 pm UTC) from US — Scanned from UK
Summary HTTP 3 Redirects  Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 195.5.171.243, located in Switzerland and belongs to DFINITY-NET, US. The main domain is m7mzu-saaaa-aaaad-qboyq-cai.icp0.io. 2yr old
TLS certificate: Issued by E6 on March 21st 2025. Valid for: 3mo.
This is the only time m7mzu-saaaa-aaaad-qboyq-cai.icp0.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 195.5.171.243 195.5.171.243 398485 (DFINITY-NET) (DFINITY-NET)
1 18.173.205.47 18.173.205.47 16509 (AMAZON-02) (AMAZON-02)
3 2
Apex Domain
Subdomains		 Transfer
2 icp0.io
m7mzu-saaaa-aaaad-qboyq-cai.icp0.io 2yr old
11 KB
1 toruswallet.io
scripts.toruswallet.io 6yr old
8 KB
3 2
Domain Requested by
2 m7mzu-saaaa-aaaad-qboyq-cai.icp0.io
1 scripts.toruswallet.io m7mzu-saaaa-aaaad-qboyq-cai.icp0.io
3 2

This site contains no links.

Subject Issuer Validity Valid
ic0.app
E6		 2025-03-21 -
2025-06-19		 3mo crt.sh
*.toruswallet.io
Amazon RSA 2048 M03		 2024-12-31 -
2026-01-28		 1yr crt.sh

This page contains 1 frames:

Primary Page: https://m7mzu-saaaa-aaaad-qboyq-cai.icp0.io/serviceworker/redirect.html
Frame ID: A0F47B3CA60C6EB48F2E8DDFE79CFA1B
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Redirect

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

19 kB
Transfer

46 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
0 data transactions

Method
Protocol		 Status Resource
Path		 Size
x-fer		 Time
Latency		 Type
MIME-Type		 IP
Location
GET
H2 		200
 Primary Request redirect.html Show response
m7mzu-saaaa-aaaad-qboyq-cai.icp0.io/serviceworker/ 		9 KB
5 KB 		394ms
195ms 		Document
text/html		 195.5.171.243
DFINITY-NET
General
Check archive.org
Download Go to
Full URL
https://m7mzu-saaaa-aaaad-qboyq-cai.icp0.io/serviceworker/redirect.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
195.5.171.243 , Switzerland, ASN398485 (DFINITY-NET, US),
Reverse DNS
Software
/
Resource Hash
6f526b99b5afecebdbb8fe3c6ec48ded742c37aa254c56dd429f3d7cab7fc855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
access-control-expose-headers
accept-ranges,content-length,content-range,x-request-id,x-ic-canister-id
content-encoding
gzip
content-length
2707
content-type
text/html
date
Tue, 20 May 2025 22:47:07 GMT
ic-certificate
certificate=:2dn3o2R0cmVlgwGDAYMBggRYIEcHW/5i6fSAwsXfCI9kGK/nWGadmjtsFDxsxR8v9+ddgwJIY2FuaXN0ZXKDAYMBgwGDAYIEWCCRZAGcMHiR7MHJil6OvBVw4vKksM6zT9aQCGixmyEQjYMBgwGCBFggTvgAfENfI42wYOCO8qMAM/9SIXL/QPqoFO0L3b20EQCDAYIEWCCko60nCWRAMDPOb1XelvPU3KHkfFgTb/CO/ULGDAf9doMBgwGCBFggXrgiM04KDwdE8YcA01zoA1QeWmMwWccP6LxCHrGk8TODAYIEWCAsKEeIpHM8MndaE6fyzze5As+yNz3NA61Z2AZ20e4r5oMBgwGCBFggYoy/EbPOmwy/JVvkTbkNDtIPEO3blggfjiAPDP3BoruDAYMBgwJKAAAAAABwC7EBAYMBgwGDAk5jZXJ0aWZpZWRfZGF0YYIDWCBOuQv9J9ICLUjmzmo5Vq1KnHyzr9+blE2viilAkIX6yoIEWCDx5MMPfdCWSiDTTeZ5LUztPsDaVOK4io3Enu3FdX+J4YIEWCCFEhkS4KSNYouYG/G3EYDHTuVbuFC8CaAPC1aNic9fioIEWCBoF8eKVIgzZbKWwu7w0fxkf8k4FbaRwW4lcShkXERNGIIEWCDaRn0Xz+wWA8r8CtduJmuB9hlnlCpz7fo7YSBrDtzClIIEWCCsgeRVY1ZPDQBHTYOfEEp9eaHY8l0vB7CR1i+hbdcXBIIEWCAvG2tOyQpbQEtZR5EfOPEsf/oOF0uWeGM4kfCtjaMaYoIEWCCkUVY8gymXlUYQP0yLUntjrYtL/sBUwK6Aj/5+F/nAt4IEWCDjHqOQz5yT30GQYzxdnovkWJIFEqyGlSyGJoxwaNqMgIIEWCAp920m6WaXtElYa9BOiImmeNDM9v8UqYYlF/N4NuXUOoIEWCCXvOrJqFM43xXWHjVlwDhOIwGApwb6eEByDIqYJfVA5YIEWCCr/IGHYtJ8tY3xwnt+K67o7QbTlyQm2ZP+n4qXFkuAxIMBggRYIGw3wEeC2ErqdLRpGoC7Y9N4uDXj6CgN1Do2PznEIdFmgwJEdGltZYIDSeOozsK/uNegGGlzaWduYXR1cmVYMJNAyVavc761SaOhJ+iXbhTIdUhFVt838LPU1hMIktiQ4C23o+8oOjT48ftl9sT56GpkZWxlZ2F0aW9uomlzdWJuZXRfaWRYHUUXi2akB6TVnApNZzO9os4/N8ERtCV+xBkI9PgCa2NlcnRpZmljYXRlWQJ92dn3omR0cmVlgwGCBFggFIM91g2NavHfUYUvqMyN93hhDvlcbEnr5xEaEt3NDyyDAYMBggRYIOcn/oPN3MUBPoMN39SeqYGBQldGmDjP2JxSaI0RUKVrgwJGc3VibmV0gwGDAYMBggRYIAmFMVu+kFt/kzbXBkeTkFsAVonzycKiGtmjH75s3VWZgwGCBFggRmpwKGz5rOmAHKU+Iq9u4FmglP1gSYYG1IS2hUBYMH2DAYIEWCA8osVUkJ05+buDEGDCNdejr+1OhweL2PnDYqAs1lv0fIMBgwJYHUUXi2akB6TVnApNZzO9os4/N8ERtCV+xBkI9PgCgwGDAk9jYW5pc3Rlcl9yYW5nZXOCA1gb2dn3gYJKAAAAAABwAAABAUoAAAAAAH///wEBgwJKcHVibGljX2tleYIDWIUwgYIwHQYNKwYBBAGC3HwFAwECAQYMKwYBBAGC3HwFAwIBA2EAlV9S9zwt7FmmN7KU5QuTTbXW3innO7z4Tn2GpKxBute1OfmBet6JFpYdnda/klcBDVhXFW6P5qr89v0Gh5XnC9M5mzQRMAyczI66DQaMEOTPtvTifRlbHq14XWGOs5O5ggRYIEy5ZnwgI5Lxw0GtR2OQgOGnBjKnYdKylVGyxCZN96txggRYILN97J1F9rmNqU/t5Te7E9C7hxorfLHvXPClXQP23lBSggRYIKJ+rufQQ2TBqbqn5a2nsHZQ8qTb8ajsDu6I6cQ+/9ERgwJEdGltZYIDSa2iptv2qdegGGlzaWduYXR1cmVYMIAvMwofdmndeN4Ap7sIwQDb+yR1O9DoxXJYAJh3GmpxzIDajHng0TXKA15GVVXuTg==:, tree=:2dn3gwJLaHR0cF9hc3NldHODAYMBggRYIDRqOMnhcgNy0sMDlG3+l4T9Utv3GyyMNI37usfCtrMfgwGCBFggDJYuR6gRqDH1hmrcR2TcAmYPcxL65h3xQZU8msuA8MaDAYMBggRYIId6xHC1to8LNJcKan6gp2MguM6Jl6YX4iuVu8VlSw2qgwGCBFgg+eunx51dNCHuRX8hVcOgRb1nSC4GyU1hexBOI/+tEZCDAlgcL3NlcnZpY2V3b3JrZXIvcmVkaXJlY3QuaHRtbIIDWCBvUmuZta/s69u4/jxuxI3tdCw3qiVMVt1Cnz18q3/IVYIEWCCHbUfVbbT7lxo6INvUlYisKEDpeAWP+mR43cdrQIxyxYIEWCDO6PgSIROVrSz26PdfKJwa0oQiVfW92eMbe94WjY5sGg==:
strict-transport-security
max-age=31536000; includeSubDomains
vary
origin, access-control-request-method, access-control-request-headers
x-cache-ttl
10
x-ic-canister-id
m7mzu-saaaa-aaaad-qboyq-cai
x-request-id
0196efe1-1590-73a3-a8a8-133794027961
GET
H2 		200
 broadcastChannel_3_5_3.js Show response
scripts.toruswallet.io/ 		33 KB
8 KB 		291ms
103ms 		Script
application/javascript		 18.173.205.47
AMAZON-02
General
Check archive.org
Download Go to
Full URL
https://scripts.toruswallet.io/broadcastChannel_3_5_3.js
Requested by
Host: m7mzu-saaaa-aaaad-qboyq-cai.icp0.io
URL: https://m7mzu-saaaa-aaaad-qboyq-cai.icp0.io/serviceworker/redirect.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.205.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-205-47.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d95ffd94e5562022174a30c6ac93784d6215bec0e2044434c0909a77ff307dcc

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin
https://m7mzu-saaaa-aaaad-qboyq-cai.icp0.io
Referer
https://m7mzu-saaaa-aaaad-qboyq-cai.icp0.io/

Response headers

access-control-max-age
86400
content-encoding
gzip
etag
W/"d86c498c3d2770fb6f6a4d4dbbac41e3"
age
116196
access-control-allow-methods
GET, HEAD
x-cache
Hit from cloudfront
x-amz-cf-id
_-er7b1ZYGMvptWKLhUdH1fkCtq1gtgc7KNqUtvj42taJ7iVWDfFqg==
date
Mon, 19 May 2025 14:30:33 GMT
content-type
application/javascript
last-modified
Mon, 15 Mar 2021 05:00:48 GMT
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
cache-control
public, max-age=604800, immutable
via
1.1 1876576d09e30dc7b468e90ff448f1f8.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-cf-pop
FRA56-P12
server
AmazonS3
GET
H2 		200
 favicon.ico
m7mzu-saaaa-aaaad-qboyq-cai.icp0.io/ 		4 KB
6 KB 		406ms
406ms 		Other
image/x-icon		 195.5.171.243
DFINITY-NET
General
Check archive.org
Download Go to
Full URL
https://m7mzu-saaaa-aaaad-qboyq-cai.icp0.io/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
195.5.171.243 , Switzerland, ASN398485 (DFINITY-NET, US),
Reverse DNS
Software
/
Resource Hash
3d10f7da6c603178340081668c4ac5b3ae9743ca9a262ab0fcd312fbb9f48bdd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer
https://m7mzu-saaaa-aaaad-qboyq-cai.icp0.io/serviceworker/redirect.html

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-request-id
0196efe1-17a4-7a03-be53-3d696f3c3996
x-ic-canister-id
m7mzu-saaaa-aaaad-qboyq-cai
access-control-expose-headers
accept-ranges,content-length,content-range,x-request-id,x-ic-canister-id
ic-certificate
certificate=:2dn3o2R0cmVlgwGDAYMBggRYIEcHW/5i6fSAwsXfCI9kGK/nWGadmjtsFDxsxR8v9+ddgwJIY2FuaXN0ZXKDAYMBgwGDAYIEWCCRZAGcMHiR7MHJil6OvBVw4vKksM6zT9aQCGixmyEQjYMBgwGCBFggTvgAfENfI42wYOCO8qMAM/9SIXL/QPqoFO0L3b20EQCDAYIEWCCko60nCWRAMDPOb1XelvPU3KHkfFgTb/CO/ULGDAf9doMBgwGCBFggXrgiM04KDwdE8YcA01zoA1QeWmMwWccP6LxCHrGk8TODAYIEWCAsKEeIpHM8MndaE6fyzze5As+yNz3NA61Z2AZ20e4r5oMBgwGCBFggYoy/EbPOmwy/JVvkTbkNDtIPEO3blggfjiAPDP3BoruDAYMBgwJKAAAAAABwC7EBAYMBgwGDAk5jZXJ0aWZpZWRfZGF0YYIDWCBOuQv9J9ICLUjmzmo5Vq1KnHyzr9+blE2viilAkIX6yoIEWCDx5MMPfdCWSiDTTeZ5LUztPsDaVOK4io3Enu3FdX+J4YIEWCCFEhkS4KSNYouYG/G3EYDHTuVbuFC8CaAPC1aNic9fioIEWCBoF8eKVIgzZbKWwu7w0fxkf8k4FbaRwW4lcShkXERNGIIEWCDaRn0Xz+wWA8r8CtduJmuB9hlnlCpz7fo7YSBrDtzClIIEWCCsgeRVY1ZPDQBHTYOfEEp9eaHY8l0vB7CR1i+hbdcXBIIEWCAvG2tOyQpbQEtZR5EfOPEsf/oOF0uWeGM4kfCtjaMaYoIEWCCkUVY8gymXlUYQP0yLUntjrYtL/sBUwK6Aj/5+F/nAt4IEWCDjHqOQz5yT30GQYzxdnovkWJIFEqyGlSyGJoxwaNqMgIIEWCAp920m6WaXtElYa9BOiImmeNDM9v8UqYYlF/N4NuXUOoIEWCCXvOrJqFM43xXWHjVlwDhOIwGApwb6eEByDIqYJfVA5YIEWCAp8fNvDdQeg/ZD9mqeZR/Y6xWQ5fauEGR/IyV73PN5oIMBggRYIJvt7jrXVcVJhFVHv8ri8KuVb+IKD8itngrWZIOh1F3NgwJEdGltZYIDSdqj3vTCuNegGGlzaWduYXR1cmVYMJcbprYiRD7DdNBkoVrVnLTgvakOz7GSvac9/rDQrimnDl7EDjYZhQdE72fHmlwhRGpkZWxlZ2F0aW9uomlzdWJuZXRfaWRYHUUXi2akB6TVnApNZzO9os4/N8ERtCV+xBkI9PgCa2NlcnRpZmljYXRlWQJ92dn3omR0cmVlgwGCBFggVV5A2ezhaUrqjXXCCfuxtQCoDnjvrsS7Tkgt3UNpxwyDAYMBggRYINI+unB0LDvHLNZT8IpdmllhWcNXoJ5IS9+f5fxl4xzggwJGc3VibmV0gwGDAYMBggRYIAmFMVu+kFt/kzbXBkeTkFsAVonzycKiGtmjH75s3VWZgwGCBFggRmpwKGz5rOmAHKU+Iq9u4FmglP1gSYYG1IS2hUBYMH2DAYIEWCA8osVUkJ05+buDEGDCNdejr+1OhweL2PnDYqAs1lv0fIMBgwJYHUUXi2akB6TVnApNZzO9os4/N8ERtCV+xBkI9PgCgwGDAk9jYW5pc3Rlcl9yYW5nZXOCA1gb2dn3gYJKAAAAAABwAAABAUoAAAAAAH///wEBgwJKcHVibGljX2tleYIDWIUwgYIwHQYNKwYBBAGC3HwFAwECAQYMKwYBBAGC3HwFAwIBA2EAlV9S9zwt7FmmN7KU5QuTTbXW3innO7z4Tn2GpKxBute1OfmBet6JFpYdnda/klcBDVhXFW6P5qr89v0Gh5XnC9M5mzQRMAyczI66DQaMEOTPtvTifRlbHq14XWGOs5O5ggRYIEy5ZnwgI5Lxw0GtR2OQgOGnBjKnYdKylVGyxCZN96txggRYILN97J1F9rmNqU/t5Te7E9C7hxorfLHvXPClXQP23lBSggRYIEg3iIBvHQ9t3rPmGtZMtjKeP/1HW072j3wpHWt9w5fIgwJEdGltZYIDSbzl8Y3hrdegGGlzaWduYXR1cmVYMLGVSBoxKhj739keDcvYbbQLwVR/e6pxAXpw3QSTtKSqcX0yHmPJV/jf3V7B5XFSSA==:, tree=:2dn3gwJLaHR0cF9hc3NldHODAYMBgwGDAYIEWCDnBNq9p2rbe9lLDII3oEW9QvSirDYjFHeYOnEXxcB2R4MBggRYIA+ha2qkxSgnAjvQc2lzoALn5HPSZHIgOVG5vzLdZpKygwJML2Zhdmljb24uaWNvggNYID0Q99psYDF4NACBZoxKxbOul0PKmiYqsPzTEvu59IvdggRYILQij7fUuS0rcPdGsqkHXc/cOLEiJNgav5xkDTBM5kl8ggRYIGlP0+xiJumDe7sof0a0D2G5sIG1aQFff0J5lZxFunjlggRYIM7o+BIhE5WtLPbo918onBrShCJV9b3Z4xt73haNjmwa:
access-control-allow-origin
*
x-cache-ttl
10
content-length
3870
date
Tue, 20 May 2025 22:47:08 GMT
content-type
image/x-icon
vary
origin, access-control-request-method, access-control-request-headers

Verdicts & Comments Add Verdict or Comment

11 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| broadcastChannelLib function| storageAvailable function| showCloseText boolean| isLocalStorageAvailable boolean| isSessionStorageAvailable object| bc object| broadcastChannelOptions object| instanceParams object| url object| hashParams object| queryParams

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

m7mzu-saaaa-aaaad-qboyq-cai.icp0.io
scripts.toruswallet.io
18.173.205.47
195.5.171.243
3d10f7da6c603178340081668c4ac5b3ae9743ca9a262ab0fcd312fbb9f48bdd
6f526b99b5afecebdbb8fe3c6ec48ded742c37aa254c56dd429f3d7cab7fc855
d95ffd94e5562022174a30c6ac93784d6215bec0e2044434c0909a77ff307dcc