Submitted URL: https://firestream.us/hmkb3noi9xiy
Effective URL: https://torrent-protection.com/free-download/?hash=62a209c9ab898&domain=totalav.com&action=download&s1=68249_[w42_9Y]&s2=w6lYzB...
Submission: On October 04 via api from US — Scanned from US

Summary

This website contacted 3 IPs in 2 countries across 8 domains to perform 7 HTTP transactions. The main IP is 167.99.123.14, located in Clifton, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is torrent-protection.com.
TLS certificate: Issued by R3 on September 30th 2023. Valid for: 3 months.
This is the only time torrent-protection.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 37.48.65.145 60781 (LEASEWEB-...)
2 54.174.42.222 14618 (AMAZON-AES)
1 1 3.93.251.206 14618 (AMAZON-AES)
1 1 107.20.106.95 14618 (AMAZON-AES)
1 1 3.226.146.143 14618 (AMAZON-AES)
2 167.99.123.14 14061 (DIGITALOC...)
7 3
Domain Requested by
2 torrent-protection.com ganda-ljo.com
torrent-protection.com
2 ganda-ljo.com ganda-ljo.com
1 playgreatlyswiftinfo-product.info 1 redirects
1 brko.admobe.com 1 redirects
1 wsafeguardpush.com 1 redirects
1 firestream.us 1 redirects
0 fonts.googleapis.com Failed torrent-protection.com
0 code.jquery.com Failed torrent-protection.com
7 8

This site contains no links.

Subject Issuer Validity Valid
torrent-protection.com
R3
2023-09-30 -
2023-12-29
3 months crt.sh

This page contains 1 frames:

Primary Page: https://torrent-protection.com/free-download/?hash=62a209c9ab898&domain=totalav.com&action=download&s1=68249_[w42_9Y]&s2=w6lYzBocYWXYB-HPrVdavx6CyDmNCjho&s3={Anythingelse)
Frame ID: 24D43A31078DD1B97F8F673C9C217351
Requests: 8 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://firestream.us/hmkb3noi9xiy HTTP 302
    http://ganda-ljo.com/zclkvisitor/b9efe391-62d0-11ee-8daa-12d537b8b099/72092e88-2c53-401c-b988-51e... Page URL
  2. http://ganda-ljo.com/zclkredirect?visitid=b9efe391-62d0-11ee-8daa-12d537b8b099&type=js&browserWid... Page URL
  3. https://wsafeguardpush.com/mc-test/73794d93916856646daf6331fbc121cf/index.php?cid=zrb9efe39162d011ee8da... HTTP 302
    https://brko.admobe.com/gdsagdsagsd/gsadgsdag/?utm_source=24216&utm_campaign=14605286&clck=[CLICK_ID... HTTP 302
    https://playgreatlyswiftinfo-product.info/164H3WZAJwNzviUwG8nmKZCLqQR0jPmVF4i1vxga6WM?clck=[CLICK_ID]&sid=[SUB_ID] HTTP 302
    https://torrent-protection.com/free-download/?hash=62a209c9ab898&domain=totalav.com&action=download&s1=6824... Page URL

Page Statistics

7
Requests

29 %
HTTPS

0 %
IPv6

8
Domains

8
Subdomains

3
IPs

2
Countries

14 kB
Transfer

21 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://firestream.us/hmkb3noi9xiy HTTP 302
    http://ganda-ljo.com/zclkvisitor/b9efe391-62d0-11ee-8daa-12d537b8b099/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=77162120-4cb3-11ee-8288-0a4ababc2193 Page URL
  2. http://ganda-ljo.com/zclkredirect?visitid=b9efe391-62d0-11ee-8daa-12d537b8b099&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false&webdriverDetected=false Page URL
  3. https://wsafeguardpush.com/mc-test/73794d93916856646daf6331fbc121cf/index.php?cid=zrb9efe39162d011ee8daa12d537b8b099d1fb9f218c2e426fa998d6adc6624b0f07676831f756e89275&dom=hotel-sue-vzyml6rm5j&s=0.027100 HTTP 302
    https://brko.admobe.com/gdsagdsagsd/gsadgsdag/?utm_source=24216&utm_campaign=14605286&clck=[CLICK_ID]&sid=[SUB_ID] HTTP 302
    https://playgreatlyswiftinfo-product.info/164H3WZAJwNzviUwG8nmKZCLqQR0jPmVF4i1vxga6WM?clck=[CLICK_ID]&sid=[SUB_ID] HTTP 302
    https://torrent-protection.com/free-download/?hash=62a209c9ab898&domain=totalav.com&action=download&s1=68249_[w42_9Y]&s2=w6lYzBocYWXYB-HPrVdavx6CyDmNCjho&s3={Anythingelse) Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://firestream.us/hmkb3noi9xiy HTTP 302
  • http://ganda-ljo.com/zclkvisitor/b9efe391-62d0-11ee-8daa-12d537b8b099/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=77162120-4cb3-11ee-8288-0a4ababc2193

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
72092e88-2c53-401c-b988-51ef43ce1034
ganda-ljo.com/zclkvisitor/b9efe391-62d0-11ee-8daa-12d537b8b099/
Redirect Chain
  • https://firestream.us/hmkb3noi9xiy
  • http://ganda-ljo.com/zclkvisitor/b9efe391-62d0-11ee-8daa-12d537b8b099/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=77162120-4cb3-11ee-8288-0a4ababc2193
1 KB
2 KB
Document
General
Full URL
http://ganda-ljo.com/zclkvisitor/b9efe391-62d0-11ee-8daa-12d537b8b099/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=77162120-4cb3-11ee-8288-0a4ababc2193
Protocol
HTTP/1.1
Server
54.174.42.222 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-174-42-222.compute-1.amazonaws.com
Software
mCIRNupA /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'
X-Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Access-Control-Allow-Headers
X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
Access-Control-Allow-Methods
GET,POST,OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, pre-check=0, post-check=0
Connection
keep-alive
Content-Type
text/html;charset=UTF-8
Date
Wed, 04 Oct 2023 16:11:51 GMT
Server
mCIRNupA
Transfer-Encoding
chunked
X-WebKit-CSP
default-src 'self'; script-src 'self' 'unsafe-inline'
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline'

Redirect headers

cache-control
max-age=0, private, must-revalidate
content-length
11
date
Wed, 04 Oct 2023 16:11:50 GMT
location
http://ganda-ljo.com/zclkvisitor/b9efe391-62d0-11ee-8daa-12d537b8b099/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=77162120-4cb3-11ee-8288-0a4ababc2193
server
Cowboy
zclkredirect
ganda-ljo.com/
586 B
1 KB
Document
General
Full URL
http://ganda-ljo.com/zclkredirect?visitid=b9efe391-62d0-11ee-8daa-12d537b8b099&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false&webdriverDetected=false
Requested by
Host: ganda-ljo.com
URL: http://ganda-ljo.com/zclkvisitor/b9efe391-62d0-11ee-8daa-12d537b8b099/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=77162120-4cb3-11ee-8288-0a4ababc2193
Protocol
HTTP/1.1
Server
54.174.42.222 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-174-42-222.compute-1.amazonaws.com
Software
WYEvMBtO /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'
X-Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'

Request headers

Referer
http://ganda-ljo.com/zclkvisitor/b9efe391-62d0-11ee-8daa-12d537b8b099/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=77162120-4cb3-11ee-8288-0a4ababc2193
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Access-Control-Allow-Headers
X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
Access-Control-Allow-Methods
GET,POST,OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, pre-check=0, post-check=0
Connection
keep-alive
Content-Type
text/html;charset=UTF-8
Date
Wed, 04 Oct 2023 16:11:51 GMT
Server
WYEvMBtO
Transfer-Encoding
chunked
X-WebKit-CSP
default-src 'self'; script-src 'self' 'unsafe-inline'
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline'
redirected
JS
x-content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline'
Primary Request /
torrent-protection.com/free-download/
Redirect Chain
  • https://wsafeguardpush.com/mc-test/73794d93916856646daf6331fbc121cf/index.php?cid=zrb9efe39162d011ee8daa12d537b8b099d1fb9f218c2e426fa998d6adc6624b0f07676831f756e89275&dom=hotel-sue-vzyml6rm5j&s=0.0...
  • https://brko.admobe.com/gdsagdsagsd/gsadgsdag/?utm_source=24216&utm_campaign=14605286&clck=[CLICK_ID]&sid=[SUB_ID]
  • https://playgreatlyswiftinfo-product.info/164H3WZAJwNzviUwG8nmKZCLqQR0jPmVF4i1vxga6WM?clck=[CLICK_ID]&sid=[SUB_ID]
  • https://torrent-protection.com/free-download/?hash=62a209c9ab898&domain=totalav.com&action=download&s1=68249_[w42_9Y]&s2=w6lYzBocYWXYB-HPrVdavx6CyDmNCjho&s3={Anythingelse)
14 KB
6 KB
Document
General
Full URL
https://torrent-protection.com/free-download/?hash=62a209c9ab898&domain=totalav.com&action=download&s1=68249_[w42_9Y]&s2=w6lYzBocYWXYB-HPrVdavx6CyDmNCjho&s3={Anythingelse)
Requested by
Host: ganda-ljo.com
URL: http://ganda-ljo.com/zclkredirect?visitid=b9efe391-62d0-11ee-8daa-12d537b8b099&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false&webdriverDetected=false
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
167.99.123.14 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
torrent-protection.com
Software
nginx/1.15.9 (Ubuntu) /
Resource Hash
0f7a6ccce7982cde7ad8918ddf1cee57770b4b0cb937c09e592b0186bf6462ea

Request headers

Referer
http://ganda-ljo.com/zclkredirect?visitid=b9efe391-62d0-11ee-8daa-12d537b8b099&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false&webdriverDetected=false
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

content-encoding
gzip
content-type
text/html
date
Wed, 04 Oct 2023 16:11:52 GMT
etag
W/"62e11572-39c5"
last-modified
Wed, 27 Jul 2022 10:37:38 GMT
server
nginx/1.15.9 (Ubuntu)

Redirect headers

Accept-CH
Sec-CH-UA,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
Access-Control-Allow-Origin
*
Connection
keep-alive
Content-Length
142
Content-Type
text/html
Date
Wed, 04 Oct 2023 16:11:51 GMT
Location
https://torrent-protection.com/free-download/?hash=62a209c9ab898&domain=totalav.com&action=download&s1=68249_[w42_9Y]&s2=w6lYzBocYWXYB-HPrVdavx6CyDmNCjho&s3={Anythingelse)
Server
nginx
jquery-1.12.0.min.js
code.jquery.com/
0
0

css
fonts.googleapis.com/
0
0

css
fonts.googleapis.com/
0
0

win.png
torrent-protection.com/images/EN/
5 KB
5 KB
Image
General
Full URL
https://torrent-protection.com/images/EN/win.png
Requested by
Host: torrent-protection.com
URL: https://torrent-protection.com/free-download/?hash=62a209c9ab898&domain=totalav.com&action=download&s1=68249_[w42_9Y]&s2=w6lYzBocYWXYB-HPrVdavx6CyDmNCjho&s3={Anythingelse)
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
167.99.123.14 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
torrent-protection.com
Software
nginx/1.15.9 (Ubuntu) /
Resource Hash
a9c0af0e8952521f9aac722d21f618a9e0d782645739a1901d22014e97ddf654

Request headers

accept-language
en-US,en;q=0.9
Referer
https://torrent-protection.com/free-download/?hash=62a209c9ab898&domain=totalav.com&action=download&s1=68249_[w42_9Y]&s2=w6lYzBocYWXYB-HPrVdavx6CyDmNCjho&s3={Anythingelse)
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date
Wed, 04 Oct 2023 16:12:22 GMT
last-modified
Thu, 11 Aug 2022 09:51:04 GMT
server
nginx/1.15.9 (Ubuntu)
accept-ranges
bytes
etag
"62f4d108-1492"
content-length
5266
content-type
image/png
truncated
/
173 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8e32d99e816a42958b9473f470a2600963602981007576d85220044e6137965b

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Content-Type
image/png

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
code.jquery.com
URL
https://code.jquery.com/jquery-1.12.0.min.js
Domain
fonts.googleapis.com
URL
https://fonts.googleapis.com/css?family=Open+Sans:400,700,800&display=swap
Domain
fonts.googleapis.com
URL
https://fonts.googleapis.com/css?family=Varela+Round&display=swap

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

3 Cookies

Domain/Path Name / Value
.firestream.us/ Name: sid
Value: b9e0656e-62d0-11ee-9afe-003ad76899fa
wsafeguardpush.com/ Name: PHPSESSID
Value: htv1d7m4isshmbfa0r2h77ns9g
playgreatlyswiftinfo-product.info/ Name: session
Value: w6lYzBocYWXYB-HPrVdavx6CyDmNCjho

3 Console Messages

Source Level URL
Text
network error URL: https://fonts.googleapis.com/css?family=Open+Sans:400,700,800&display=swap
Message:
Failed to load resource: net::ERR_TIMED_OUT
network error URL: https://fonts.googleapis.com/css?family=Varela+Round&display=swap
Message:
Failed to load resource: net::ERR_TIMED_OUT
network error URL: https://code.jquery.com/jquery-1.12.0.min.js
Message:
Failed to load resource: net::ERR_TIMED_OUT

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'
X-Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'