ci12597.tw1.ru
Open in
urlscan Pro
92.53.118.39
Malicious Activity!
Public Scan
Submission: On February 21 via api from JP — Scanned from JP
Summary
This is the only time ci12597.tw1.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Orange (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 92.53.118.39 92.53.118.39 | 9123 (TIMEWEB-AS) (TIMEWEB-AS) | |
1 | 69.16.175.10 69.16.175.10 | 20446 (STACKPATH...) (STACKPATH-CDN) | |
1 | 193.252.148.247 193.252.148.247 | 8891 (FTBGPDM) (FTBGPDM) | |
1 | 193.252.122.137 193.252.122.137 | 24600 (WANADOOPO...) (WANADOOPORTAILS-AS Wanadoo PortailsDirection technique) | |
1 | 104.16.86.20 104.16.86.20 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
17 | 7 |
ASN9123 (TIMEWEB-AS, RU)
PTR: vh312.timeweb.ru
ci12597.tw1.ru |
ASN8891 (FTBGPDM, FR)
PTR: vip-cachehttp-https-prod-poole-soi.s0.fti.net
c.woopic.com |
ASN24600 (WANADOOPORTAILS-AS Wanadoo PortailsDirection technique, FR)
PTR: vip-cachehttp-https-prod-poole-soi.b0.fti.net
gp.cdn.woopic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
tw1.ru
ci12597.tw1.ru |
131 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 196 |
358 KB |
2 |
woopic.com
c.woopic.com — Cisco Umbrella Rank: 185883 gp.cdn.woopic.com — Cisco Umbrella Rank: 192045 |
71 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 346 |
23 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 699 |
83 KB |
17 | 5 |
Domain | Requested by | |
---|---|---|
9 | ci12597.tw1.ru |
ci12597.tw1.ru
|
2 | cdnjs.cloudflare.com |
ci12597.tw1.ru
|
1 | cdn.jsdelivr.net |
ci12597.tw1.ru
|
1 | gp.cdn.woopic.com |
ci12597.tw1.ru
|
1 | c.woopic.com |
ci12597.tw1.ru
|
1 | code.jquery.com |
ci12597.tw1.ru
|
17 | 6 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
cdn.woopic.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-10-14 - 2023-06-27 |
8 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-02 - 2023-06-01 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://ci12597.tw1.ru/THHYYYYY/
Frame ID: BBC0B0A3794886FE76207D1C701A3B2B
Requests: 17 HTTP requests in this frame
Screenshot
Page Title
Identifiez-vousDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
38 Outgoing links
These are links going to different origins than the main page.
Title: Maintenant
Search URL Search Domain Scan URL
Title: Ce soir
Search URL Search Domain Scan URL
Title: Programme TV
Search URL Search Domain Scan URL
Title: Le Mag TV
Search URL Search Domain Scan URL
Title: Mes enregistrements
Search URL Search Domain Scan URL
Title: Cinéma
Search URL Search Domain Scan URL
Title: Séries
Search URL Search Domain Scan URL
Title: Jeunesse
Search URL Search Domain Scan URL
Title: Tout le replay
Search URL Search Domain Scan URL
Title: Tout le catalogue
Search URL Search Domain Scan URL
Title: Mes vidéos
Search URL Search Domain Scan URL
Title: Ma liste
Search URL Search Domain Scan URL
Title: Mon compte prépayé
Search URL Search Domain Scan URL
Title: Jeux vidéo
Search URL Search Domain Scan URL
Title: France
Search URL Search Domain Scan URL
Title: Météo
Search URL Search Domain Scan URL
Title: Politique
Search URL Search Domain Scan URL
Title: Société
Search URL Search Domain Scan URL
Title: Economie
Search URL Search Domain Scan URL
Title: Auto
Search URL Search Domain Scan URL
Title: Toute l'actualité
Search URL Search Domain Scan URL
Title: En direct
Search URL Search Domain Scan URL
Title: Football
Search URL Search Domain Scan URL
Title: Rugby
Search URL Search Domain Scan URL
Title: Tennis
Search URL Search Domain Scan URL
Title: Tous les sports
Search URL Search Domain Scan URL
Title: Bien-être
Search URL Search Domain Scan URL
Title: Art de vivre
Search URL Search Domain Scan URL
Title: Environnement
Search URL Search Domain Scan URL
Title: Culture Pop
Search URL Search Domain Scan URL
Title: Mode Beauté
Search URL Search Domain Scan URL
Title: Toutes les tendances
Search URL Search Domain Scan URL
Title: Sorties de la semaine
Search URL Search Domain Scan URL
Title: Au programme
Search URL Search Domain Scan URL
Title: Actus cinéma
Search URL Search Domain Scan URL
Title: Actus séries
Search URL Search Domain Scan URL
Title: Vidéos
Search URL Search Domain Scan URL
Title: Tout cinéma et séries
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
ci12597.tw1.ru/THHYYYYY/ |
75 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.11.3.js
code.jquery.com/ |
278 KB 83 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.css
ci12597.tw1.ru/THHYYYYY/css/ |
909 KB 120 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-orange.png
c.woopic.com/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
567x302_Orange%20bank%20juin%202022.jpg
gp.cdn.woopic.com/magic/ |
67 KB 67 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/ |
82 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.js
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.1/js/ |
1 MB 355 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.payment.min.js
cdnjs.cloudflare.com/ajax/libs/jquery.payment/3.0.0/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
script.js
ci12597.tw1.ru/assets/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HelvNeue75_W1G.woff2
ci12597.tw1.ru/THHYYYYY/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
o-icomoon.woff
c.woopic.com/Magic/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HelvNeue55_W1G.woff2
ci12597.tw1.ru/THHYYYYY/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HelvNeue75_W1G.woff
ci12597.tw1.ru/THHYYYYY/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HelvNeue55_W1G.woff
ci12597.tw1.ru/THHYYYYY/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HelvNeue75_W1G.ttf
ci12597.tw1.ru/THHYYYYY/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HelvNeue55_W1G.ttf
ci12597.tw1.ru/THHYYYYY/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
o-icomoon.ttf
c.woopic.com/Magic/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- c.woopic.com
- URL
- http://c.woopic.com/Magic/o-icomoon.woff?1xeygc
- Domain
- c.woopic.com
- URL
- http://c.woopic.com/Magic/o-icomoon.ttf?1xeygc
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Orange (Telecommunication)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| oncontentvisibilityautostatechange function| $ function| jQuery boolean| c_email boolean| _pass function| toggalClass function| nextStep function| validateEmail object| bootstrap object| jQuery1113016781925057205727 object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
11 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
c.woopic.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
ci12597.tw1.ru
code.jquery.com
gp.cdn.woopic.com
c.woopic.com
104.16.86.20
104.17.25.14
193.252.122.137
193.252.148.247
69.16.175.10
92.53.118.39
069893e1081da967b61d9898a483e7c756a1e9497776ca6099a3a0e4ef441e38
0fe2ef604972ea9b7f74eb327ae73bd0070f980cdafef32045e73f37b7435896
2065aecca0fb9b0567358d352ed5f1ab72fce139bf449b4d09805f5d9c3725ed
20a3ef6979bbe5e4de1afaecc703e1d34cbc5e3ceab36d378539506327692d72
6c4ba1c662b440b3aefe5e5147ea2df72f80e510e4979c65485a7b0fff894e37
8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01
b36e8ca10880ffc8a3903cd991589fbbe8aa75cbff6315f475be1ed0e9bda472
ce66470aac581912e04322fadc41485a3aa878a5a73ef8d8d0f928f8523f6737