URL: http://104.244.76.245/
Submission: On December 12 via manual from GB

Summary

This website contacted 3 IPs in 3 countries across 2 domains to perform 4 HTTP transactions. The main IP is 104.244.76.245, located in Roost, Luxembourg and belongs to PONYNET, US. The main domain is 104.244.76.245.
This is the only time 104.244.76.245 was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 104.244.76.245 53667 (PONYNET)
1 65.9.73.38 16509 (AMAZON-02)
1 99.81.126.252 16509 (AMAZON-02)
4 3
Apex Domain
Subdomains
Transfer
1 nordvpn.net
go.nordvpn.net
466 B
1 go2speed.org
media.go2speed.org
43 KB
4 2
Domain Requested by
1 go.nordvpn.net 104.244.76.245
1 media.go2speed.org 104.244.76.245
4 2

This site contains links to these domains. Also see Links.

Domain
www.torproject.org
go.nordvpn.net
Subject Issuer Validity Valid
media.go2speed.org
Amazon
2020-11-03 -
2021-12-04
a year crt.sh
go.nordvpn.net
Amazon
2020-02-14 -
2021-03-14
a year crt.sh

This page contains 1 frames:

Primary Page: http://104.244.76.245/
Frame ID: AC4B62E6ABCF227F1ACA498F85D3370E
Requests: 4 HTTP requests in this frame

Screenshot


Page Statistics

4
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

3
Countries

46 kB
Transfer

45 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
104.244.76.245/
2 KB
2 KB
Document
General
Full URL
http://104.244.76.245/
Protocol
HTTP/1.0
Server
104.244.76.245 Roost, Luxembourg, ASN53667 (PONYNET, US),
Reverse DNS
zarathustra.tor.k0nsl.org
Software
/
Resource Hash
5cf660a9486f2d5249335486905111e7bd236173a08d56819e59f7ddcd8f69e0

Request headers

Host
104.244.76.245
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 12 Dec 2020 10:18:25 GMT
Content-Type
text/html
X-Your-Address-Is
82.102.19.136
Content-Encoding
identity
Content-Length
2347
Expires
Sat, 12 Dec 2020 10:38:25 GMT
null
104.244.76.245/
0
0
Stylesheet
General
Full URL
http://104.244.76.245/null
Requested by
Host: 104.244.76.245
URL: http://104.244.76.245/
Protocol
HTTP/1.0
Server
104.244.76.245 Roost, Luxembourg, ASN53667 (PONYNET, US),
Reverse DNS
zarathustra.tor.k0nsl.org
Software
/
Resource Hash

Request headers

Referer
http://104.244.76.245/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 12 Dec 2020 10:18:25 GMT
300x250v10.gif
media.go2speed.org/brand/files/nordvpn/15/
43 KB
43 KB
Image
General
Full URL
https://media.go2speed.org/brand/files/nordvpn/15/300x250v10.gif
Requested by
Host: 104.244.76.245
URL: http://104.244.76.245/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.73.38 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
433373ab69bd0659231d8d41d3dafb919de9b3c4101c2c3694611a2328825d11

Request headers

Referer
http://104.244.76.245/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 12 Dec 2020 09:48:38 GMT
via
1.1 e029c86e892e2d8a35492f6625a1d26e.cloudfront.net (CloudFront)
etag
"09d8af252c57c0c123a4aae638005b02"
last-modified
Sat, 10 Aug 2019 10:05:08 GMT
server
AmazonS3
age
1788
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-type
image/gif
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
content-length
43557
x-amz-cf-id
Uu5_c0dtuxsz2IykO_IEWoLPNfL77yFyGiOnLUDCz8JebsX3EuhLIw==
aff_i
go.nordvpn.net/
43 B
466 B
Image
General
Full URL
https://go.nordvpn.net/aff_i?offer_id=15&file_id=23&aff_id=30698&source=tor_exit
Requested by
Host: 104.244.76.245
URL: http://104.244.76.245/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.81.126.252 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-99-81-126-252.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
ac05f643d51698438fc2504bc237b5a39ce1248b037dbf446aaca4ce65c3182c

Request headers

Referer
http://104.244.76.245/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 12 Dec 2020 10:18:25 GMT
Server
nginx
tracking_id
10235b9e018f8e359304edd3c992e4
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Access-Control-Allow-Headers
Tune-SDK-Version
Content-Length
43
X-Request-Id
ecca884df0db92ca7c74ef1d24504b33
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

go.nordvpn.net
media.go2speed.org
104.244.76.245
65.9.73.38
99.81.126.252
433373ab69bd0659231d8d41d3dafb919de9b3c4101c2c3694611a2328825d11
5cf660a9486f2d5249335486905111e7bd236173a08d56819e59f7ddcd8f69e0
ac05f643d51698438fc2504bc237b5a39ce1248b037dbf446aaca4ce65c3182c