urlscan.io logo urlscan.io
SecurityTrails logo

cg22034.tmweb.ru Open in urlscan Pro
188.225.63.143  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://vkontacte.github.io/survey
Effective URL: http://cg22034.tmweb.ru/
Submission: On August 08 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 188.225.63.143, located in Russian Federation and belongs to TIMEWEB-AS, RU. The main domain is cg22034.tmweb.ru.
This is the only time cg22034.tmweb.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Vkontakte (Social Network)

Domain & IP information

IP Address AS Autonomous System
1 2 185.199.110.153 54113 (FASTLY)
2 188.225.63.143 9123 (TIMEWEB-AS)
1 87.240.190.67 47541 (VKONTAKTE...)
4 3
Apex Domain
Subdomains		 Transfer
2 tmweb.ru
cg22034.tmweb.ru
3 KB
2 github.io
vkontacte.github.io
752 B
1 vk.com
st.vk.com
421 B
4 3
Domain Requested by
2 cg22034.tmweb.ru vkontacte.github.io
cg22034.tmweb.ru
2 vkontacte.github.io 1 redirects
1 st.vk.com cg22034.tmweb.ru
4 3

This site contains no links.

Subject Issuer Validity Valid
www.github.com
DigiCert SHA2 High Assurance Server CA		 2020-05-06 -
2022-04-14		 2 years crt.sh
*.vk.com
GlobalSign Organization Validation CA - SHA256 - G2		 2020-06-09 -
2022-06-10		 2 years crt.sh

This page contains 1 frames:

Primary Page: http://cg22034.tmweb.ru/
Frame ID: 02A31D628A86C447427F39A6A3E8309F
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://vkontacte.github.io/survey HTTP 301
    https://vkontacte.github.io/survey/ Page URL
  2. http://cg22034.tmweb.ru/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /^https?:\/\/[^/]+\.github\.io\//i
  • headers server /^GitHub\.com$/i
Overall confidence: 100%
Detected patterns
  • headers via /varnish(?: \(Varnish\/([\d.]+)\))?/i
Overall confidence: 100%
Detected patterns
  • url /^https?:\/\/[^/]+\.github\.io\//i
  • headers server /^GitHub\.com$/i
Overall confidence: 100%
Detected patterns
  • url /^https?:\/\/[^/]+\.github\.io\//i
  • headers server /^GitHub\.com$/i

Page Statistics

4
Requests

50 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

4 kB
Transfer

8 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://vkontacte.github.io/survey HTTP 301
    https://vkontacte.github.io/survey/ Page URL
  2. http://cg22034.tmweb.ru/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://vkontacte.github.io/survey HTTP 301
  • https://vkontacte.github.io/survey/

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
vkontacte.github.io/survey/
Redirect Chain
  • https://vkontacte.github.io/survey
  • https://vkontacte.github.io/survey/
370 B
586 B 		Document
General
Check archive.org
Download Go to
Full URL
https://vkontacte.github.io/survey/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.199.110.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
cdn-185-199-110-153.github.com
Software
GitHub.com /
Resource Hash
9c136c92cb3465f909b0553d26fdcd04d81d716c4516e1647eccd225a201bb22
Security Headers
Name Value
Strict-Transport-Security max-age=31556952

Request headers

:method
GET
:authority
vkontacte.github.io
:scheme
https
:path
/survey/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server
GitHub.com
content-type
text/html; charset=utf-8
permissions-policy
interest-cohort=()
strict-transport-security
max-age=31556952
last-modified
Sun, 08 Aug 2021 10:02:45 GMT
access-control-allow-origin
*
etag
W/"610fabc5-172"
expires
Sun, 08 Aug 2021 10:32:45 GMT
cache-control
max-age=600
content-encoding
gzip
x-proxy-cache
MISS
x-github-request-id
AAAC:8935:676F39:70DF08:610FB075
accept-ranges
bytes
date
Sun, 08 Aug 2021 10:22:45 GMT
via
1.1 varnish
age
0
x-served-by
cache-cdg20746-CDG
x-cache
MISS
x-cache-hits
0
x-timer
S1628418165.324992,VS0,VE97
vary
Accept-Encoding
x-fastly-request-id
79a1f876a3dd58c4e801ec1acdd18896f88e225c
content-length
273

Redirect headers

server
GitHub.com
content-type
text/html
permissions-policy
interest-cohort=()
location
https://vkontacte.github.io/survey/
x-github-request-id
94D8:387B:114B240:11F8062:610FB075
accept-ranges
bytes
date
Sun, 08 Aug 2021 10:22:45 GMT
via
1.1 varnish
age
0
x-served-by
cache-cdg20746-CDG
x-cache
MISS
x-cache-hits
0
x-timer
S1628418165.209771,VS0,VE96
vary
Accept-Encoding
x-fastly-request-id
73dc693622d10917baac7f796588a469d922b151
content-length
162
Primary Request /
cg22034.tmweb.ru/ 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://cg22034.tmweb.ru/
Requested by
Host: vkontacte.github.io
URL: https://vkontacte.github.io/survey/
Protocol
HTTP/1.1
Server
188.225.63.143 , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS
vh382.timeweb.ru
Software
nginx/1.20.1 /
Resource Hash
edd8430093f0e930a965922b2808381a9990d71def7d33493b1d4d45f95d880b

Request headers

Host
cg22034.tmweb.ru
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Server
nginx/1.20.1
Date
Sun, 08 Aug 2021 10:22:45 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
Content-Encoding
gzip
style6.css
cg22034.tmweb.ru/ 		2 KB
998 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://cg22034.tmweb.ru/style6.css
Requested by
Host: cg22034.tmweb.ru
URL: http://cg22034.tmweb.ru/
Protocol
HTTP/1.1
Server
188.225.63.143 , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS
vh382.timeweb.ru
Software
nginx/1.20.1 /
Resource Hash
70576835f25f2468d90060569e8e78d96c598bfc57fb50f75f0b9a46e68369c9

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
cg22034.tmweb.ru
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://cg22034.tmweb.ru/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://cg22034.tmweb.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sun, 08 Aug 2021 10:22:45 GMT
Content-Encoding
gzip
Last-Modified
Sat, 07 Aug 2021 20:53:37 GMT
Server
nginx/1.20.1
ETag
W/"610ef2d1-70f"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=2678400
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Wed, 08 Sep 2021 10:22:45 GMT
mobile_new.png
st.vk.com/images/icons/ 		165 B
421 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://st.vk.com/images/icons/mobile_new.png
Requested by
Host: cg22034.tmweb.ru
URL: http://cg22034.tmweb.ru/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
87.240.190.67 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS vk.com, RU),
Reverse DNS
srv67-190-240-87.vk.com
Software
kittenx /
Resource Hash
2e9838fad65124053f3e043aec52ee9a7d3c29617b8c47fb1d492fe58ed6ea20
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
http://cg22034.tmweb.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 08 Aug 2021 10:22:46 GMT
x-frontend
front220006
last-modified
Tue, 22 Sep 2020 20:29:56 GMT
server
kittenx
etag
"5f6a5ec4-a5"
strict-transport-security
max-age=15768000
content-type
image/png
access-control-expose-headers
X-Frontend
cache-control
max-age=345600
accept-ranges
bytes
content-length
165
expires
Thu, 12 Aug 2021 10:22:46 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Vkontakte (Social Network)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31556952