ca70003.tw1.ru
Open in
urlscan Pro
5.23.50.56
Malicious Activity!
Public Scan
Submission: On May 25 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by GlobalSign RSA OV SSL CA 2018 on June 29th 2022. Valid for: a year.
This is the only time ca70003.tw1.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Credit Agricole (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
17 | 5.23.50.56 5.23.50.56 | 9123 (TIMEWEB-AS) (TIMEWEB-AS) | |
1 | 2404:6800:400... 2404:6800:4004:824::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2404:6800:400... 2404:6800:4004:822::2003 | 15169 (GOOGLE) (GOOGLE) | |
20 | 3 |
ASN9123 (TIMEWEB-AS, RU)
PTR: bitrix360.timeweb.ru
ca70003.tw1.ru |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
tw1.ru
ca70003.tw1.ru |
717 KB |
2 |
gstatic.com
fonts.gstatic.com |
97 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 35 |
1 KB |
20 | 3 |
Domain | Requested by | |
---|---|---|
17 | ca70003.tw1.ru |
ca70003.tw1.ru
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
ca70003.tw1.ru
|
20 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.timeweb.ru GlobalSign RSA OV SSL CA 2018 |
2022-06-29 - 2023-07-31 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-04-24 - 2023-07-17 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-04-24 - 2023-07-17 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ca70003.tw1.ru/home/
Frame ID: 35A41E1BBEFECB27C56A5AA93B242773
Requests: 20 HTTP requests in this frame
Screenshot
Page Title
Accès CR - Crédit AgricoleDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
AngularJS (JavaScript Frameworks) Expand
Detected patterns
- \bangular.{0,32}\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
ca70003.tw1.ru/home/ |
23 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
angular.min.js
ca70003.tw1.ru/home/style/js/ |
163 KB 57 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ca70003.tw1.ru/home/style/js/ |
86 KB 30 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.CardValidator.js
ca70003.tw1.ru/home/style/js/ |
6 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.validate.min.js
ca70003.tw1.ru/home/style/js/ |
22 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.mask.js
ca70003.tw1.ru/home/style/js/ |
18 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.js
ca70003.tw1.ru/home/style/js/ |
2 KB 1019 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
ca70003.tw1.ru/home/style/css/ |
138 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
helpers.css
ca70003.tw1.ru/home/style/css/ |
40 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fonts.css
ca70003.tw1.ru/home/style/css/ |
1 KB 462 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
ca70003.tw1.ru/home/style/css/ |
10 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
CADIF_logo_horizontal_rvb_v4.png
ca70003.tw1.ru/home/style/ |
18 KB 19 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
ca70003.tw1.ru/home/style/js/ |
20 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
ca70003.tw1.ru/home/style/js/ |
58 KB 15 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fontawesome.js
ca70003.tw1.ru/home/style/js/ |
1 MB 378 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
ca70003.tw1.ru/home/style/js/ |
4 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
24 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fermeture-agence-travaux-DAB_septembre2020.jpg
ca70003.tw1.ru/home//style/ |
161 KB 162 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/ |
47 KB 48 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v35/ |
49 KB 49 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Credit Agricole (Banking)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| angular function| $ function| jQuery function| preventBack function| Popper object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome boolean| isShift string| seperator string| dash function| cc_date function| date_of_birth1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
ca70003.tw1.ru/ | Name: PHPSESSID Value: 4780645451a32ea6891db02c44c57e6a |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ca70003.tw1.ru
fonts.googleapis.com
fonts.gstatic.com
2404:6800:4004:822::2003
2404:6800:4004:824::200a
5.23.50.56
049f25718205d69ce742df71f034263a55a485a95dbf78dacea2dfbd6812ac93
16e8f08eb363930ccc9f0e91f33ded7905fed943045a040078196294db8a9b17
29afa9ae5f254ebab486b606c22e263e2a7963ae6f97a89a320e3fb1e017c991
2a6536dfb04e99526ca10907b63b77bd89acf583d1e0a5351a64983b65a860ab
2e31f31633d04598c60731878851d821eaa4403af63b930d58bb10bc9c0428a2
306ab8dd287ef041231a510b7e4c027a11e28b20c3408a9185d895c091dc72a4
3642c7e774562f7483d7b0de93dd1759fc6928e85eebd7e62ddae72e9d46c9cb
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf
68c7d8b42c960fd8544cca7013af1451f1d5da5224dd318da5d2c91548eb3076
7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
86c051eb57fe97e4dc99fd4cba7334c3faef8e6d3655da6f2b04176f523d96f5
8965eaf1598037b1a608ede6ff9633e6944b70039d631f80f635e25c79030da8
8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9
a2a539ffc2d9864af69560f5b77f29da9bd5aa8e9141e8ca2e9a0930bb8ca965
cd8873d8c03fd90eacd976f57b300327972964a89c7ac37d27e369d0324b9999
cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a
d2b9f29ea1f42a60a8beb1c04f76868287f2a48d6ec50fb39d6b888584a03c49
e07a9ccc231bfc6a4f4ef7d64b1c2df670d9ac347d0d3e4cb4ad04c2133e07f5
f8e9befa13e3ff93d974729ae3c727461555d582bb63bb388a4bd497619ef20b