This will likely require a Firefox patch, but it seems like Firefox pre-emptively establishes a connection with the server before the user is prompted about downloading a file. This isn't obvious. In addition to [[| #25672 comment 2](https://trac.torproject.org/projects/tor/ticket/25672#comment:2)] I see: ``` [04-11 00:10:08] Torbutton INFO: tor SOCKS: https://dist.torproject.org/torbrowser/7.5.3/torbrowser-install-7.5.3_en-US.exe via --unknown--:71e69d27f4adff41fb754a6dc960dfeb [04-11 00:10:08] Torbutton INFO: controlPort >> 650 STREAM 61 NEW 0 dist.torproject.org:443 SOURCE_ADDR=127.0.0.1:46918 PURPOSE=USER [04-11 00:10:08] Torbutton INFO: controlPort >> 650 STREAM 61 SENTCONNECT 36 dist.torproject.org:443 [04-11 00:10:08] Torbutton INFO: controlPort >> 650 STREAM 61 REMAP 36 38.229.72.17:443 SOURCE=EXIT [04-11 00:10:08] Torbutton INFO: controlPort >> 650 STREAM 61 SUCCEEDED 36 38.229.72.17:443 [04-11 00:10:09] Torbutton INFO: Component Load 0: New ExternalAppBlocker. [04-11 00:10:13] Torbutton INFO: controlPort >> 650 STREAM 60 CLOSED 36 138.201.14.197:443 REASON=DONE [04-11 00:10:21] Torbutton INFO: controlPort >> 650 STREAM 61 CLOSED 36 38.229.72.17:443 REASON=CONNRESET ``` The CONNRESET is when I click Cancel.