cu54368.tw1.ru Open in urlscan Pro
2a03:6f00:6:1::b972:f7e8 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://gooo.to/WQhlP7
Effective URL:
https://cu54368.tw1.ru/
Submission: On April 22 via automatic, source phishtank (April 22nd 2024, 8:43:54 am UTC) — Scanned from DE

Summary HTTP 3 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 3 HTTP transactions. The main IP is 2a03:6f00:6:1::b972:f7e8, located in Russian Federation and belongs to TIMEWEB-AS, RU. The main domain is cu54368.tw1.ru.
TLS certificate: Issued by GlobalSign GCC R3 DV TLS CA 2020 on January 11th 2024. Valid for: a year.

This is the only time cu54368.tw1.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	159.253.36.42 159.253.36.42	51559 (NETINTERN...) (NETINTERNET Netinternet Bilisim Teknolojileri AS)
1	2a03:6f00:6:1... 2a03:6f00:6:1::b972:f7e8	9123 (TIMEWEB-AS) (TIMEWEB-AS)
2	191.101.71.148 191.101.71.148	47583 (AS-HOSTINGER) (AS-HOSTINGER)
3	3

1 159.253.36.42 (Turkey) 1 redirects

ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR)

gooo.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:6f00:6:1::b972:f7e8 (Russian Federation)

ASN9123 (TIMEWEB-AS, RU)

cu54368.tw1.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 191.101.71.148 (São Paulo, Brazil)

ASN47583 (AS-HOSTINGER, CY)

cranky-cori.191-101-71-148.plesk.page	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	plesk.page cranky-cori.191-101-71-148.plesk.page	492 B
1	tw1.ru cu54368.tw1.ru	415 KB
1	gooo.to 1 redirects gooo.to	1 KB
3	3

	Domain	Requested by
2	cranky-cori.191-101-71-148.plesk.page
1	cu54368.tw1.ru
1	gooo.to	1 redirects
3	3

This site contains links to these domains. Also see Links.

Domain
portail.chorus-pro.gouv.fr
twitter.com
www.dailymotion.com
www.youtube.com
www.linkedin.com
communaute.chorus-pro.gouv.fr
www.service-public.fr
www.data.gouv.fr
www.legifrance.gouv.fr
www.gouvernement.fr

Subject Issuer	Validity	Valid
*.tw1.ru GlobalSign GCC R3 DV TLS CA 2020	`2024-01-11` - `2025-02-11`	a year	crt.sh
admin.drthiagocosta.com.br R3	`2024-03-17` - `2024-06-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://cu54368.tw1.ru/
Frame ID: 729E1D1B3916D58322BFEBFAE1E0C043
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Portail de services Chorus Pro

Page URL History Show full URLs

https://gooo.to/WQhlP7 HTTP 302
https://cu54368.tw1.ru/ Page URL

Page Statistics

3
Requests

33 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

773 kB
Transfer

1040 kB
Size

2
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://portail.chorus-pro.gouv.fr/aife_csm

Search URL Search Domain Scan URL

URL: https://twitter.com/aife_officiel?lang=fr
Title: Twitter Lien externe

Search URL Search Domain Scan URL

URL: https://www.dailymotion.com/playlist/x46njl
Title: Dailymotion Lien externe

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCZu7eGQjA6mHF15W7foJzkQ
Title: Youtube Lien externe

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/aife/?originalSubdomain=fr
Title: Linkedin Lien externe

Search URL Search Domain Scan URL

URL: https://portail.chorus-pro.gouv.fr/aife_csm?id=aife_sitemap
Title: Plan du site

Search URL Search Domain Scan URL

URL: https://portail.chorus-pro.gouv.fr/aife_csm?id=aife_contact
Title: Nous contacter

Search URL Search Domain Scan URL

URL: https://communaute.chorus-pro.gouv.fr/documentation/notes-de-version/
Title: Notes de version

Search URL Search Domain Scan URL

URL: https://portail.chorus-pro.gouv.fr/aife_csm?id=aife_cgu
Title: Conditions générales d'utilisation

Search URL Search Domain Scan URL

URL: https://portail.chorus-pro.gouv.fr/aife_csm?id=aife_quality
Title: Engagement et qualité

Search URL Search Domain Scan URL

URL: https://portail.chorus-pro.gouv.fr/aife_csm?id=aife_accessibility
Title: Accessibilité

Search URL Search Domain Scan URL

URL: https://portail.chorus-pro.gouv.fr/aife_csm?id=aife_cookies
Title: Cookies

Search URL Search Domain Scan URL

URL: https://portail.chorus-pro.gouv.fr/aife_csm?id=aife_security
Title: Données personnelles et sécurité

Search URL Search Domain Scan URL

URL: https://portail.chorus-pro.gouv.fr/aife_csm?id=aife_legal
Title: Mentions légales

Search URL Search Domain Scan URL

URL: https://www.service-public.fr/
Title: service-public.fr Lien externe

Search URL Search Domain Scan URL

URL: https://www.data.gouv.fr/fr/
Title: data.gouv.fr Lien externe

Search URL Search Domain Scan URL

URL: https://www.legifrance.gouv.fr/
Title: legifrance.gouv.fr Lien externe

Search URL Search Domain Scan URL

URL: https://www.gouvernement.fr/
Title: gouvernement.fr Lien externe

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://gooo.to/WQhlP7 HTTP 302
https://cu54368.tw1.ru/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
7 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response cu54368.tw1.ru/ Redirect Chain https://gooo.to/WQhlP7 https://cu54368.tw1.ru/	641 KB 415 KB	388ms 165ms	Document text/html	2a03:6f00:6:1::b972:f7e8 TIMEWEB-AS
General Check archive.org Show headers Download Go to Full URL https://cu54368.tw1.ru/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:6f00:6:1::b972:f7e8 , Russian Federation, ASN9123 (TIMEWEB-AS, RU), Reverse DNS Software nginx/1.24.0 / Resource Hash `ba2a7f76043f1a638201e58914844d6581e1991594016d7e0590a0c3cd9e0ec7` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers content-encoding gzip content-type text/html; charset=UTF-8 date Mon, 22 Apr 2024 08:43:49 GMT server nginx/1.24.0 vary Accept-Encoding Redirect headers Cache-Control no-cache, private Connection keep-alive Content-Type text/html; charset=UTF-8 Date Mon, 22 Apr 2024 08:43:49 GMT Location https://cu54368.tw1.ru/ Server nginx/1.18.0 (Ubuntu) Transfer-Encoding chunked
GET DATA	200 OK	truncated /	22 KB 22 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `94229557c510ed5d0172c3b939bbb4c4d6cf86f20ad8b4d1f2b8bbf964267540` Request headers Referer Origin https://cu54368.tw1.ru Accept-Language de-DE,de;q=0.9;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type application/font-woff2
GET DATA	200 OK	truncated /	16 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `43bfec89dda7e28068b06681570a89c6fceff7a20aa54b1633b2884e82f988d8` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `15041e929608723475e05f6f71cbfd67675215be4455bdc51e6a3f5532dadd6c` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	722 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `2d58e6251a0d7d83378c084b9bdaadd978611f5f2c25d01fd48ac0342abdb961` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	5 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4bf27ef4a27d1d9967ad45c1037e56d74db04362b2fd10507daf90bddea6d5fc` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	17 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d17a3841b8e2261ca0a3f8d5c798f621ba5edc3a4f555c86b5a97dd2856244e2` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	336 KB 336 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ef807a6df81e1224e58adac3d6bc3b7e0fa5ce79bd876a2d15158685698bc984` Request headers Referer Origin https://cu54368.tw1.ru Accept-Language de-DE,de;q=0.9;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type application/font-woff2
GET H/1.1	200 OK	favicon.ico cranky-cori.191-101-71-148.plesk.page/	0 246 B	737ms 233ms	Other image/x-icon	191.101.71.148 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://cranky-cori.191-101-71-148.plesk.page/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 191.101.71.148 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software nginx/1.18.0 (Ubuntu) / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://cu54368.tw1.ru/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Mon, 22 Apr 2024 08:43:50 GMT Last-Modified Wed, 19 Jul 2023 22:47:25 GMT Server nginx/1.18.0 (Ubuntu) ETag "64b867fd-0" Content-Type image/x-icon Connection keep-alive Accept-Ranges bytes Content-Length 0
GET H/1.1	200 OK	favicon.ico cranky-cori.191-101-71-148.plesk.page/	0 246 B	232ms 232ms	Other image/x-icon	191.101.71.148 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://cranky-cori.191-101-71-148.plesk.page/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 191.101.71.148 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software nginx/1.18.0 (Ubuntu) / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://cu54368.tw1.ru/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Mon, 22 Apr 2024 08:43:51 GMT Last-Modified Wed, 19 Jul 2023 22:47:25 GMT Server nginx/1.18.0 (Ubuntu) ETag "64b867fd-0" Content-Type image/x-icon Connection keep-alive Accept-Ranges bytes Content-Length 0

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| savepage_ShadowLoader

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			gooo.to/	1970-01-20 20:03:02	Name: XSRF-TOKEN Value: eyJpdiI6ImpnSkJsVmkxRnNBVWRGUTZEUGthaWc9PSIsInZhbHVlIjoiaHFCbmJCVG0rQm9jUEh3dkxrMkpLWjUxNWZ1VlFVbzMvYitWWHlBT0U4S3B4eGtNbTQ2M0t3VnRYc0gyS29oMHdiZmNITmVEbGtyTEUyakt2ZG1seFcyWnV4eEpvV0Z2eGN2ODZFTFNhVk9SNkJoVXNWTlJYWWkvZllCSEpWeEEiLCJtYWMiOiI4NDIxYTRmZTNkYjBlNzJiYTIwNTM2NmY0OWJiYWM1Y2UxNzg2NzJiMjUyYWI2ZGUyZTExNDA2ZWQ0OGFiZWE3In0%3D
			gooo.to/	1970-01-20 20:03:02	Name: goooto_session Value: eyJpdiI6InFMbHVZRFJ4SE85UUsvd2drdkluSHc9PSIsInZhbHVlIjoibGt3dEdOVkVrTUFLNTZWUFhicHhyTXl1Y2J4VVNGME9OUHZIZ0UzSkZQRWZBYUFZNVd5cWh2THBNSCsreVlzbENVLzlqam1rbjBwMGp1akdoQVVvSWIveGVaTU02Y0l4bEJNU3BCZ0JpY0x5SGFib25TVGxUT1hueXlhd1c1azMiLCJtYWMiOiJlODc5MzUyNDg3NDVlMDk4ZGYzOGE3MWQ5ZDljZDI0NWM4ZmFmMWMzYTlmMmIxMzFjMDQ4NWYzODNiODYzYWViIn0%3D

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cranky-cori.191-101-71-148.plesk.page
cu54368.tw1.ru
gooo.to
159.253.36.42
191.101.71.148
2a03:6f00:6:1::b972:f7e8
15041e929608723475e05f6f71cbfd67675215be4455bdc51e6a3f5532dadd6c
2d58e6251a0d7d83378c084b9bdaadd978611f5f2c25d01fd48ac0342abdb961
43bfec89dda7e28068b06681570a89c6fceff7a20aa54b1633b2884e82f988d8
4bf27ef4a27d1d9967ad45c1037e56d74db04362b2fd10507daf90bddea6d5fc
94229557c510ed5d0172c3b939bbb4c4d6cf86f20ad8b4d1f2b8bbf964267540
ba2a7f76043f1a638201e58914844d6581e1991594016d7e0590a0c3cd9e0ec7
d17a3841b8e2261ca0a3f8d5c798f621ba5edc3a4f555c86b5a97dd2856244e2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef807a6df81e1224e58adac3d6bc3b7e0fa5ce79bd876a2d15158685698bc984

cu54368.tw1.ru Open in urlscan Pro 2a03:6f00:6:1::b972:f7e8 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

3 Requests

33 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

773 kBTransfer

1040 kBSize

2 Cookies

18 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

2 Cookies

Indicators

cu54368.tw1.ru Open in urlscan Pro
2a03:6f00:6:1::b972:f7e8 Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

33 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

773 kB
Transfer

1040 kB
Size

2
Cookies

3 HTTP transactions
7 data transactions