soothing.openstream.online Open in urlscan Pro
5.161.228.189 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://soothing.openstream.online/
Effective URL:
https://soothing.openstream.online/install/
Submission Tags: @phish_report
Submission: On July 22 via api (July 22nd 2024, 11:36:14 pm UTC) from FI — Scanned from FI

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 9 HTTP transactions. The main IP is 5.161.228.189, located in United States and belongs to HETZNER-CLOUD2-AS, DE. The main domain is soothing.openstream.online.
TLS certificate: Issued by R10 on July 22nd 2024. Valid for: 3 months.

This is the only time soothing.openstream.online was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 8	5.161.228.189 5.161.228.189	213230 (HETZNER-C...) (HETZNER-CLOUD2-AS)
1	216.58.206.42 216.58.206.42	15169 (GOOGLE) (GOOGLE)
2	216.58.206.35 216.58.206.35	15169 (GOOGLE) (GOOGLE)
9	3

8 5.161.228.189 (United States) 2 redirects

ASN213230 (HETZNER-CLOUD2-AS, DE)
PTR: static.189.228.161.5.clients.your-server.de

soothing.openstream.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.42 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr35s10-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.206.35 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr35s10-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	openstream.online 2 redirects soothing.openstream.online	66 KB
2	gstatic.com fonts.gstatic.com	32 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 110	1 KB
9	3

	Domain	Requested by
8	soothing.openstream.online	2 redirects soothing.openstream.online
2	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	soothing.openstream.online
9	3

This site contains no links.

Subject Issuer	Validity	Valid
soothing.openstream.online R10	`2024-07-22` - `2024-10-20`	3 months	crt.sh
upload.video.google.com WR2	`2024-06-24` - `2024-09-16`	3 months	crt.sh
*.gstatic.com WR2	`2024-06-24` - `2024-09-16`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://soothing.openstream.online/install/
Frame ID: E0F761028AEC5CAEABB1357E9F25A18E
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

PlayTube | Installation

Page URL History Show full URLs

http://soothing.openstream.online/ HTTP 307
https://soothing.openstream.online/ HTTP 302
https://soothing.openstream.online/install HTTP 301
https://soothing.openstream.online/install/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

98 kB
Transfer

276 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://soothing.openstream.online/ HTTP 307
https://soothing.openstream.online/ HTTP 302
https://soothing.openstream.online/install HTTP 301
https://soothing.openstream.online/install/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
soothing.openstream.online/install/
Redirect Chain

http://soothing.openstream.online/
https://soothing.openstream.online/
https://soothing.openstream.online/install
https://soothing.openstream.online/install/

9 KB
3 KB

333ms
333ms

Document
text/html

5.161.228.189
HETZNER-CLOUD2-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://soothing.openstream.online/install/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.161.228.189 , United States, ASN213230 (HETZNER-CLOUD2-AS, DE),
Reverse DNS: static.189.228.161.5.clients.your-server.de
Software: Apache /
Resource Hash: 0f5cfdfa48f639c78ede2f1da20228a01d42e5ab0da24806b90bb684f714cf19

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

cache-control: max-age=16416000
content-encoding: gzip
content-length: 3073
content-type: text/html; charset=UTF-8
date: Mon, 22 Jul 2024 23:36:08 GMT
expires: Tue, 28 Jan 2025 23:36:08 GMT
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: max-age=16416000
content-length: 328
content-type: text/html; charset=iso-8859-1
date: Mon, 22 Jul 2024 23:36:08 GMT
expires: Tue, 28 Jan 2025 23:36:08 GMT
location: https://soothing.openstream.online/install/
server: Apache

GET
H2 200 bootstrap.min.css
soothing.openstream.online/install/ 110 KB
19 KB 340ms
338ms Stylesheet
text/css 5.161.228.189
HETZNER-CLOUD2-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://soothing.openstream.online/install/bootstrap.min.css
Requested by: Host: soothing.openstream.online
URL: https://soothing.openstream.online/install/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.161.228.189 , United States, ASN213230 (HETZNER-CLOUD2-AS, DE),
Reverse DNS: static.189.228.161.5.clients.your-server.de
Software: Apache /
Resource Hash: 2f3ecc6459ccd0c17fd4aec49c24b7e80c226875ab8037f1f80e8ce321f9a95a

Request headers

Referer: https://soothing.openstream.online/install/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 22 Jul 2024 23:36:08 GMT
content-encoding: gzip
last-modified: Fri, 25 May 2018 12:24:58 GMT
server: Apache
etag: "1b9f7-56d06db2dda80-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 19373
expires: Wed, 21 Aug 2024 23:36:08 GMT

GET
H2 200 style.css
soothing.openstream.online/install/ 10 KB
2 KB 352ms
352ms Stylesheet
text/css 5.161.228.189
HETZNER-CLOUD2-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://soothing.openstream.online/install/style.css
Requested by: Host: soothing.openstream.online
URL: https://soothing.openstream.online/install/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.161.228.189 , United States, ASN213230 (HETZNER-CLOUD2-AS, DE),
Reverse DNS: static.189.228.161.5.clients.your-server.de
Software: Apache /
Resource Hash: 52cc89305c25e41f4fbd0d947621c45ce417d2cf6391d45bcf401e6543328126

Request headers

Referer: https://soothing.openstream.online/install/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 22 Jul 2024 23:36:08 GMT
content-encoding: gzip
last-modified: Sun, 02 Jan 2022 11:43:42 GMT
server: Apache
etag: "268b-5d497ea715780-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2301
expires: Wed, 21 Aug 2024 23:36:08 GMT

GET
H2 200 jquery-1.11.3.js Show response
soothing.openstream.online/install/ 95 KB
33 KB 464ms
464ms Script
text/javascript 5.161.228.189
HETZNER-CLOUD2-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://soothing.openstream.online/install/jquery-1.11.3.js
Requested by: Host: soothing.openstream.online
URL: https://soothing.openstream.online/install/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.161.228.189 , United States, ASN213230 (HETZNER-CLOUD2-AS, DE),
Reverse DNS: static.189.228.161.5.clients.your-server.de
Software: Apache /
Resource Hash: 5f1ab65fe2ad6b381a1ae036716475bf78c9b2e309528cf22170c1ddeefddcbf

Request headers

Referer: https://soothing.openstream.online/install/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 22 Jul 2024 23:36:08 GMT
content-encoding: gzip
last-modified: Fri, 15 Jan 2016 15:00:02 GMT
server: Apache
etag: "17c52-52960a85fc080-gzip"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=16416000
accept-ranges: bytes
content-length: 33845
expires: Tue, 28 Jan 2025 23:36:08 GMT

GET
H2 200 jquery.form.min.js Show response
soothing.openstream.online/install/ 15 KB
6 KB 353ms
352ms Script
text/javascript 5.161.228.189
HETZNER-CLOUD2-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://soothing.openstream.online/install/jquery.form.min.js
Requested by: Host: soothing.openstream.online
URL: https://soothing.openstream.online/install/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.161.228.189 , United States, ASN213230 (HETZNER-CLOUD2-AS, DE),
Reverse DNS: static.189.228.161.5.clients.your-server.de
Software: Apache /
Resource Hash: c90f0e501d2948fbc2b61bffd654fa4ab64741fd48923782419eeb14d3816fb8

Request headers

Referer: https://soothing.openstream.online/install/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 22 Jul 2024 23:36:08 GMT
content-encoding: gzip
last-modified: Mon, 03 Aug 2015 10:42:16 GMT
server: Apache
etag: "3b90-51c65d2b67200-gzip"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=16416000
accept-ranges: bytes
content-length: 5860
expires: Tue, 28 Jan 2025 23:36:08 GMT

GET
H2 200 css
fonts.googleapis.com/ 4 KB
1 KB 1049ms
195ms Stylesheet
text/css 216.58.206.42
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500

Requested by

Host: soothing.openstream.online
URL: https://soothing.openstream.online/install/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.42 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f10.1e100.net

Software

ESF /

Resource Hash

8753541a3a44842cd815d81c4f8c589e0a0d763112d622f3088cd6f064e825fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://soothing.openstream.online/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 22 Jul 2024 23:36:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 22 Jul 2024 23:01:11 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 22 Jul 2024 23:36:10 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 856ms
191ms Font
font/woff2 216.58.206.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f3.1e100.net

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://soothing.openstream.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 16 Jul 2024 09:08:41 GMT
x-content-type-options: nosniff
age: 570449
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 16 Jul 2025 09:08:41 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 839ms
174ms Font
font/woff2 216.58.206.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f3.1e100.net

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://soothing.openstream.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 16 Jul 2024 11:48:58 GMT
x-content-type-options: nosniff
age: 560832
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 16 Jul 2025 11:48:58 GMT

GET
H2 200 icon.png
soothing.openstream.online/themes/default/img/ 1 KB
2 KB 234ms
233ms Other
image/png 5.161.228.189
HETZNER-CLOUD2-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://soothing.openstream.online/themes/default/img/icon.png
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.161.228.189 , United States, ASN213230 (HETZNER-CLOUD2-AS, DE),
Reverse DNS: static.189.228.161.5.clients.your-server.de
Software: Apache /
Resource Hash: 4c6fbbe54064ccaebd9d7ac82703f181f5316ebb9bc25458681cb1cf6c7a0478

Request headers

Referer: https://soothing.openstream.online/install/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 22 Jul 2024 23:36:11 GMT
last-modified: Wed, 04 Oct 2017 08:29:00 GMT
server: Apache
etag: "5b5-55ab466458b00"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 1461
expires: Tue, 22 Jul 2025 23:36:11 GMT

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| Wo_SubmitButton

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			soothing.openstream.online/	1969-12-31 23:59:59	Name: PHPSESSID Value: 83gp55so2vn1o50qvk8i3bbgaa

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
soothing.openstream.online
216.58.206.35
216.58.206.42
5.161.228.189
0f5cfdfa48f639c78ede2f1da20228a01d42e5ab0da24806b90bb684f714cf19
2f3ecc6459ccd0c17fd4aec49c24b7e80c226875ab8037f1f80e8ce321f9a95a
4c6fbbe54064ccaebd9d7ac82703f181f5316ebb9bc25458681cb1cf6c7a0478
52cc89305c25e41f4fbd0d947621c45ce417d2cf6391d45bcf401e6543328126
5f1ab65fe2ad6b381a1ae036716475bf78c9b2e309528cf22170c1ddeefddcbf
8753541a3a44842cd815d81c4f8c589e0a0d763112d622f3088cd6f064e825fd
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
c90f0e501d2948fbc2b61bffd654fa4ab64741fd48923782419eeb14d3816fb8
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

soothing.openstream.online Open in urlscan Pro 5.161.228.189 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

98 kBTransfer

276 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

1 Cookies

Indicators

soothing.openstream.online Open in urlscan Pro
5.161.228.189 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

98 kB
Transfer

276 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions