usa.theodorus-flo.com

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 5 HTTP transactions. The main IP is 54.225.132.253, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is usa.theodorus-flo.com.

This is the only time usa.theodorus-flo.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	35.172.40.232 35.172.40.232	14618 (AMAZON-AES) (AMAZON-AES)
1	52.218.61.11 52.218.61.11	16509 (AMAZON-02) (AMAZON-02)
1	173.255.224.94 173.255.224.94	63949 (LINODE-AP...) (LINODE-AP Linode)
1	54.225.132.253 54.225.132.253	14618 (AMAZON-AES) (AMAZON-AES)
5	4

2 35.172.40.232 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-172-40-232.compute-1.amazonaws.com

amanda.ttnrd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.218.61.11 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: s3-eu-west-1.amazonaws.com

s3-eu-west-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 173.255.224.94 (Newark, United States)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li234-94.members.linode.com

clkn.adzopa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.225.132.253 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-225-132-253.compute-1.amazonaws.com

usa.theodorus-flo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	ttnrd.com amanda.ttnrd.com	2 KB
1	theodorus-flo.com usa.theodorus-flo.com	761 B
1	adzopa.com clkn.adzopa.com	797 B
1	amazonaws.com s3-eu-west-1.amazonaws.com	7 KB
5	4

	Domain	Requested by
2	amanda.ttnrd.com	amanda.ttnrd.com
1	usa.theodorus-flo.com	clkn.adzopa.com
1	clkn.adzopa.com	amanda.ttnrd.com
1	s3-eu-west-1.amazonaws.com	amanda.ttnrd.com
5	4

This site contains no links.

Subject Issuer	Validity	Valid
ttnrd.com Amazon	`2019-12-11` - `2021-01-11`	a year	crt.sh
*.s3-eu-west-1.amazonaws.com DigiCert Baltimore CA-2 G2	`2020-08-04` - `2021-08-09`	a year	crt.sh
clkn.adzopa.com Let's Encrypt Authority X3	`2020-06-29` - `2020-09-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://usa.theodorus-flo.com/zcvisitor/647fbd0e-f649-11ea-9975-0a9f786a0505?campaignid=131e8ecc-d71b-11ea-9f7c-12e5dcaa70ed
Frame ID: 47EBC19B0B506BA064F62BB7C1220BC1
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://amanda.ttnrd.com/tr?id=01f50ecbe1d1bd560c796bd4c982b83e869f9d2529.r&tk=eyJhbGciOiJIUzI1NiIsIn... Page URL
https://clkn.adzopa.com/nc/2001661600060567/click?i=aTSYZW0h9Ir9z Page URL
http://usa.theodorus-flo.com/zcvisitor/647fbd0e-f649-11ea-9975-0a9f786a0505?campaignid=131e8ecc-d71b-11ea... Page URL

Page Statistics

5
Requests

80 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

11 kB
Transfer

9 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://amanda.ttnrd.com/tr?id=01f50ecbe1d1bd560c796bd4c982b83e869f9d2529.r&tk=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwdWIiOiI1MjhlMTg5N2RjNDAxYWNjNjc4MWFlNTciLCJ0cyI6IjA5MTQwNTE2IiwiZCI6InByaW1ld2lyZWFnLm5ldCJ9.5Ss0c7Q5MCTJXpNnsuthR72W2UXBKj1syaT1LtpLbw4 Page URL
https://clkn.adzopa.com/nc/2001661600060567/click?i=aTSYZW0h9Ir9z Page URL
http://usa.theodorus-flo.com/zcvisitor/647fbd0e-f649-11ea-9975-0a9f786a0505?campaignid=131e8ecc-d71b-11ea-9f7c-12e5dcaa70ed Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 tr Show response
amanda.ttnrd.com/ 2 KB
2 KB 315ms
103ms Document
text/html 35.172.40.232
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://amanda.ttnrd.com/tr?id=01f50ecbe1d1bd560c796bd4c982b83e869f9d2529.r&tk=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwdWIiOiI1MjhlMTg5N2RjNDAxYWNjNjc4MWFlNTciLCJ0cyI6IjA5MTQwNTE2IiwiZCI6InByaW1ld2lyZWFnLm5ldCJ9.5Ss0c7Q5MCTJXpNnsuthR72W2UXBKj1syaT1LtpLbw4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.172.40.232 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-40-232.compute-1.amazonaws.com
Software: /
Resource Hash: 7517606a8963a9ff001425365173768c0f2c0667aeef7f9cb2f7aa7a681df43e

Request headers

:method: GET
:authority: amanda.ttnrd.com
:scheme: https
:path: /tr?id=01f50ecbe1d1bd560c796bd4c982b83e869f9d2529.r&tk=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwdWIiOiI1MjhlMTg5N2RjNDAxYWNjNjc4MWFlNTciLCJ0cyI6IjA5MTQwNTE2IiwiZCI6InByaW1ld2lyZWFnLm5ldCJ9.5Ss0c7Q5MCTJXpNnsuthR72W2UXBKj1syaT1LtpLbw4
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 14 Sep 2020 05:17:08 GMT
content-type: text/html; charset=utf-8
content-length: 2102
p3p: CP="CUR NOI NID STA STP"
x-robots-tag: noindex, nofollow
set-cookie: checkme=c9e94fbc0429dcbfff93a050b33a00c7b789; Path=/

GET
H/1.1 200
OK ajax-loader.gif
s3-eu-west-1.amazonaws.com/pxgif/ 7 KB
7 KB 182ms
53ms Image
image/gif 52.218.61.11
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-eu-west-1.amazonaws.com/pxgif/ajax-loader.gif
Requested by: Host: amanda.ttnrd.com
URL: https://amanda.ttnrd.com/tr?id=01f50ecbe1d1bd560c796bd4c982b83e869f9d2529.r&tk=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwdWIiOiI1MjhlMTg5N2RjNDAxYWNjNjc4MWFlNTciLCJ0cyI6IjA5MTQwNTE2IiwiZCI6InByaW1ld2lyZWFnLm5ldCJ9.5Ss0c7Q5MCTJXpNnsuthR72W2UXBKj1syaT1LtpLbw4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.218.61.11 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1.amazonaws.com
Software: AmazonS3 /
Resource Hash

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 14 Sep 2020 05:17:10 GMT
Last-Modified: Fri, 12 Aug 2016 15:23:54 GMT
Server: AmazonS3
x-amz-request-id: 90E669D73A42E048
ETag: "dc5b98ed1c3c7959cdcb76113e7442cd"
Content-Type: image/gif
Accept-Ranges: bytes
Content-Length: 6820
x-amz-id-2: Zc/vojYaDHwIuliC54U9pTxFlLhSJygn+p2n/12OVPlZuqRePv+72qwHzxoD/vSfncYqrOXRKqg=

GET
H2 200 trx
amanda.ttnrd.com/ 65 B
215 B 112ms
111ms XHR
text/html 35.172.40.232
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://amanda.ttnrd.com/trx?id=01f50ecbe1d1bd560c796bd4c982b83e869f9d2529.r&confirm=c9e94fbc0429dcbfff93a050b33a00c7&size=1920000&noframe=1&tnc_ref=n%2Fa&reftaken=feed&refEqual=false
Requested by: Host: amanda.ttnrd.com
URL: https://amanda.ttnrd.com/tr?id=01f50ecbe1d1bd560c796bd4c982b83e869f9d2529.r&tk=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwdWIiOiI1MjhlMTg5N2RjNDAxYWNjNjc4MWFlNTciLCJ0cyI6IjA5MTQwNTE2IiwiZCI6InByaW1ld2lyZWFnLm5ldCJ9.5Ss0c7Q5MCTJXpNnsuthR72W2UXBKj1syaT1LtpLbw4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.172.40.232 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-40-232.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 14 Sep 2020 05:17:08 GMT
referrer-policy: no-referrer
content-type: text/html; charset=utf-8
x-robots-tag: noindex, nofollow
content-length: 65
p3p: CP="CUR NOI NID STA STP"

GET
H2 200 click
clkn.adzopa.com/nc/2001661600060567/ 438 B
797 B 295ms
99ms Document
text/html 173.255.224.94
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL: https://clkn.adzopa.com/nc/2001661600060567/click?i=aTSYZW0h9Ir9z
Requested by: Host: amanda.ttnrd.com
URL: https://amanda.ttnrd.com/tr?id=01f50ecbe1d1bd560c796bd4c982b83e869f9d2529.r&tk=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwdWIiOiI1MjhlMTg5N2RjNDAxYWNjNjc4MWFlNTciLCJ0cyI6IjA5MTQwNTE2IiwiZCI6InByaW1ld2lyZWFnLm5ldCJ9.5Ss0c7Q5MCTJXpNnsuthR72W2UXBKj1syaT1LtpLbw4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.255.224.94 Newark, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS: li234-94.members.linode.com
Software: nginx/1.16.1 / Express
Resource Hash

Request headers

:method: GET
:authority: clkn.adzopa.com
:scheme: https
:path: /nc/2001661600060567/click?i=aTSYZW0h9Ir9z
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: nginx/1.16.1
date: Mon, 14 Sep 2020 05:17:09 GMT
content-type: text/html; charset=utf-8
content-length: 438
x-powered-by: Express
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type, Authorization
access-control-allow-methods: POST, GET, PUT, DELETE, OPTIONS
cache-control: private, no-cache, no-store, must-revalidate
expires: -1
pragma: no-cache
etag: W/"1b6-r7TKsoYz6vjJ4oCDdFf3DpT47mY"

GET
H/1.1 500
Internal Server Error Primary Request 647fbd0e-f649-11ea-9975-0a9f786a0505 Show response
usa.theodorus-flo.com/zcvisitor/ 62 B
761 B 200ms
174ms Document
text/html 54.225.132.253
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

http://usa.theodorus-flo.com/zcvisitor/647fbd0e-f649-11ea-9975-0a9f786a0505?campaignid=131e8ecc-d71b-11ea-9f7c-12e5dcaa70ed

Requested by

Host: clkn.adzopa.com
URL: https://clkn.adzopa.com/nc/2001661600060567/click?i=aTSYZW0h9Ir9z

Protocol

HTTP/1.1

Server

54.225.132.253 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-225-132-253.compute-1.amazonaws.com

Software

ZeroPark-Traffic /

Resource Hash

a402e74a16d6d5e13146c2d8cb07a95d2fccd90e362efd6bc05cd988a4e92747

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline'
X-Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline'

Request headers

Host: usa.theodorus-flo.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 14 Sep 2020 05:17:09 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
Server: ZeroPark-Traffic

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amanda.ttnrd.com
clkn.adzopa.com
s3-eu-west-1.amazonaws.com
usa.theodorus-flo.com
173.255.224.94
35.172.40.232
52.218.61.11
54.225.132.253
7517606a8963a9ff001425365173768c0f2c0667aeef7f9cb2f7aa7a681df43e
a402e74a16d6d5e13146c2d8cb07a95d2fccd90e362efd6bc05cd988a4e92747

usa.theodorus-flo.com Open in urlscan Pro 54.225.132.253 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

5 Requests

80 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

11 kBTransfer

9 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

0 Cookies

Indicators

usa.theodorus-flo.com Open in urlscan Pro
54.225.132.253 Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

80 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

11 kB
Transfer

9 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions