ca95414.tw1.ru
Open in
urlscan Pro
92.53.96.121
Malicious Activity!
Public Scan
Effective URL: https://ca95414.tw1.ru/cgi-bin/coorectproct/sreieuusyeuus/miersseeesees/jjdjjhdjhdjhd/dtydghdhghdhd/auth/g9GHv2/login.p...
Submission Tags: @ecarlesi threat phishing Search All
Submission: On June 25 via api from IT — Scanned from GB
Summary
TLS certificate: Issued by GlobalSign GCC R3 DV TLS CA 2020 on January 11th 2024. Valid for: a year.
This is the only time ca95414.tw1.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Societe Generale (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 18.133.72.105 18.133.72.105 | 16509 (AMAZON-02) (AMAZON-02) | |
1 1 | 85.10.132.52 85.10.132.52 | 20857 (TRANSIP-A...) (TRANSIP-AS Amsterdam) | |
14 | 92.53.96.121 92.53.96.121 | 9123 (TIMEWEB-AS) (TIMEWEB-AS) | |
2 | 151.101.129.229 151.101.129.229 | 54113 (FASTLY) (FASTLY) | |
1 | 151.101.194.137 151.101.194.137 | 54113 (FASTLY) (FASTLY) | |
2 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 172.217.23.106 172.217.23.106 | 15169 (GOOGLE) (GOOGLE) | |
1 | 216.58.212.131 216.58.212.131 | 15169 (GOOGLE) (GOOGLE) | |
21 | 6 |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-133-72-105.eu-west-2.compute.amazonaws.com
driversecure.line.pm |
ASN20857 (TRANSIP-AS Amsterdam, the Netherlands, NL)
PTR: 85-10-132-52.colo.transip.net
b252.lynck.it |
ASN9123 (TIMEWEB-AS, RU)
PTR: vh432.timeweb.ru
ca95414.tw1.ru |
ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f10.1e100.net
fonts.googleapis.com |
ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f3.1e100.net
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
tw1.ru
ca95414.tw1.ru |
27 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 268 |
413 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 381 |
49 KB |
1 |
gstatic.com
fonts.gstatic.com |
48 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 83 |
2 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 816 |
31 KB |
1 |
lynck.it
1 redirects
b252.lynck.it |
1016 B |
1 |
line.pm
1 redirects
driversecure.line.pm |
357 B |
21 | 8 |
Domain | Requested by | |
---|---|---|
14 | ca95414.tw1.ru |
ca95414.tw1.ru
|
2 | cdnjs.cloudflare.com |
ca95414.tw1.ru
|
2 | cdn.jsdelivr.net |
ca95414.tw1.ru
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
ca95414.tw1.ru
|
1 | code.jquery.com |
ca95414.tw1.ru
|
1 | b252.lynck.it | 1 redirects |
1 | driversecure.line.pm | 1 redirects |
21 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.tw1.ru GlobalSign GCC R3 DV TLS CA 2020 |
2024-01-11 - 2025-02-11 |
a year | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3 |
2023-09-27 - 2024-10-28 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
cdnjs.cloudflare.com E1 |
2024-06-02 - 2024-08-31 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-06-03 - 2024-08-26 |
3 months | crt.sh |
*.gstatic.com WR2 |
2024-06-03 - 2024-08-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ca95414.tw1.ru/cgi-bin/coorectproct/sreieuusyeuus/miersseeesees/jjdjjhdjhdjhd/dtydghdhghdhd/auth/g9GHv2/login.php?id=42209674
Frame ID: 4977F1923E63B460F21D9161B0751A29
Requests: 21 HTTP requests in this frame
Screenshot
Page Title
Connexion à votre Espace Client - Crédit MutuelPage URL History Show full URLs
-
http://driversecure.line.pm/
HTTP 307
https://driversecure.line.pm/ HTTP 307
http://driversecure.line.pm/ HTTP 301
https://b252.lynck.it/721c05 HTTP 302
https://ca95414.tw1.ru/cgi-bin/coorectproct/sreieuusyeuus/miersseeesees/jjdjjhdjhdjhd/dtydghdhghdhd... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Bootstrap (Web Frameworks) Expand
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://driversecure.line.pm/
HTTP 307
https://driversecure.line.pm/ HTTP 307
http://driversecure.line.pm/ HTTP 301
https://b252.lynck.it/721c05 HTTP 302
https://ca95414.tw1.ru/cgi-bin/coorectproct/sreieuusyeuus/miersseeesees/jjdjjhdjhdjhd/dtydghdhghdhd/auth/g9GHv2/login.php?id=42209674 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.php
ca95414.tw1.ru/cgi-bin/coorectproct/sreieuusyeuus/miersseeesees/jjdjjhdjhdjhd/dtydghdhghdhd/auth/g9GHv2/ Redirect Chain
|
11 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/ |
152 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
helpers.css
ca95414.tw1.ru/cgi-bin/coorectproct/sreieuusyeuus/miersseeesees/jjdjjhdjhdjhd/dtydghdhghdhd/auth/media/css/ |
41 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
ca95414.tw1.ru/cgi-bin/coorectproct/sreieuusyeuus/miersseeesees/jjdjjhdjhdjhd/dtydghdhghdhd/auth/media/css/ |
14 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
ca95414.tw1.ru/cgi-bin/coorectproct/sreieuusyeuus/miersseeesees/jjdjjhdjhdjhd/dtydghdhghdhd/auth/media/imgs/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
new-account.png
ca95414.tw1.ru/cgi-bin/coorectproct/sreieuusyeuus/miersseeesees/jjdjjhdjhdjhd/dtydghdhghdhd/auth/media/imgs/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo2.jpg
ca95414.tw1.ru/cgi-bin/coorectproct/sreieuusyeuus/miersseeesees/jjdjjhdjhdjhd/dtydghdhghdhd/auth/media/imgs/ |
1 KB 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
remember.jpg
ca95414.tw1.ru/cgi-bin/coorectproct/sreieuusyeuus/miersseeesees/jjdjjhdjhdjhd/dtydghdhghdhd/auth/media/imgs/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
valider.png
ca95414.tw1.ru/cgi-bin/coorectproct/sreieuusyeuus/miersseeesees/jjdjjhdjhdjhd/dtydghdhghdhd/auth/media/imgs/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow.png
ca95414.tw1.ru/cgi-bin/coorectproct/sreieuusyeuus/miersseeesees/jjdjjhdjhdjhd/dtydghdhghdhd/auth/media/imgs/ |
199 B 378 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
marker.png
ca95414.tw1.ru/cgi-bin/coorectproct/sreieuusyeuus/miersseeesees/jjdjjhdjhdjhd/dtydghdhghdhd/auth/media/imgs/ |
675 B 855 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
comments.png
ca95414.tw1.ru/cgi-bin/coorectproct/sreieuusyeuus/miersseeesees/jjdjjhdjhdjhd/dtydghdhghdhd/auth/media/imgs/ |
783 B 963 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
footer-logo.svg
ca95414.tw1.ru/cgi-bin/coorectproct/sreieuusyeuus/miersseeesees/jjdjjhdjhdjhd/dtydghdhghdhd/auth/media/imgs/ |
3 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.1.min.js
code.jquery.com/ |
88 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/ |
77 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
all.min.js
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.2.0/js/ |
1 MB 410 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.mask.min.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.16/ |
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js.js
ca95414.tw1.ru/cgi-bin/coorectproct/sreieuusyeuus/miersseeesees/jjdjjhdjhdjhd/dtydghdhghdhd/auth/media/js/ |
3 KB 943 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
17 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ |
47 KB 48 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ff.ico
ca95414.tw1.ru/cgi-bin/coorectproct/sreieuusyeuus/miersseeesees/jjdjjhdjhdjhd/dtydghdhghdhd/auth/media/imgs/ |
318 B 459 B |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Societe Generale (Banking)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage function| $ function| jQuery number| uidEvent object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome object| $jscomp boolean| loaded3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
b252.lynck.it/ | Name: XSRF-TOKEN Value: eyJpdiI6Ilg0YjEvcVlWTnF0MlFtUkk1MVFKc1E9PSIsInZhbHVlIjoiT2hjNHYyampXV2ZOVWViV0IxTXJFWVV4S3prQmNFZnYxMVFzblRVcVdmTU8wSHZDVzBqajBaUlNIMEdENGg1UTdWVWViMjg3SXBhU2NBNU9SUEc3TVNOUi9JayswK2hzbDhqbGhIUDFndHFFMm5jcE5IelRad3JyT1YzYkxSVHciLCJtYWMiOiJkZWViZTM0OWZhNTIyMTJlZjc3MTNkNmJhZjNkOGZkODhlNzA2NGYyMjNiMTFiMDBkNmIwYzNhODM0OGM0NWJmIiwidGFnIjoiIn0%3D |
|
b252.lynck.it/ | Name: lynck_session Value: eyJpdiI6InBnbVhvcVRTdnI0WUdONWZPYUdIN1E9PSIsInZhbHVlIjoicFNsMElZdStmNmNxZFpVRVo5eEVSK29UNmIwbzFmTUFuNjBWY3kxL1pYMmdyWENDUEM5Yzk3cTJmSjhVQXBCMVRJVDhYVS8wejFsajMyS0UvQWpGcERDQUpTL0E2T1BUR040TDlxbzF2Tjl4bjFtY0FDK1hWMmlsb1JhaFFOTUkiLCJtYWMiOiI1Mzg5NWU0ZjhiODZjMjU1MjM4OWNkZjM0MjQ5NTBlYTMyMjViNWRhZTBkNWY2MDE0Njc3YWE3MWIxZTQ3ODgyIiwidGFnIjoiIn0%3D |
|
ca95414.tw1.ru/ | Name: PHPSESSID Value: 9962b3bc6ac55200103f75314007a34c |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
b252.lynck.it
ca95414.tw1.ru
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
driversecure.line.pm
fonts.googleapis.com
fonts.gstatic.com
104.17.24.14
151.101.129.229
151.101.194.137
172.217.23.106
18.133.72.105
216.58.212.131
85.10.132.52
92.53.96.121
034d52b5025461d4dc4786e7a4047e6ddddb023cd8ded716dc3ae55ed9fc1781
12151d5190ac2f09ed928c16b833c8f4ab3daab155cf9c7c00fcd2466b6012bd
19b11e9d230e5fc6e11924e8c07f604d7884a4107794810bc70eec129b915795
23882f29cd743d1e0058ac22d2a791196952dab003f83df83d186e94b175119d
2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995
332ed68f420cc91a5c79ffbb1af4598551fb365ed60e9d4fdd31f101b7688a6e
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
3dc3d4f09a6caa938a754adf03cb9f7661ebffa085a55de8f04d2b52e1e5e46b
50be9e5f854dad9dda940e1ed423467441aad412867f41bc62439e85082f1198
523f01e171ebf63770e025487bdcfe986841d4ec2da50c1486d2632066eacd5f
6a769e18b06859751eaa2259044a6ff76e3ddcd6572a516d8ce3a2d7b8c7538e
7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b
7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe
851699a18b631a7bd68efc99598701293a6065b463fced7b68d8d6d9227bd8e7
90419bcd869510282afb6d26e137e59a9538c2cf9b0b9b80bfcd147a984abf86
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
aa39a33b5032c599052363d19ada053b116b2b8185e58cce440178f62b3bd82a
b3cd89aaaf60d9f7e4521c4fbf1551124bd411a3319b18908a00dac97b9b15f3
daf58b06a09d467436ee5fd10eefbeadac3cf6ecaef1eca1884ef8330f561642
ed956ce0d8100ac843bf85fb49362ccad13c98bbecdb24768968dc8deff6d6e0
fc4d89e3a21dd77bda0407ff095f596ca1335072f34e6c0f0f1550aec7f43d11