co47154.tw1.ru
Open in
urlscan Pro
2a03:6f00:1:1::5c35:6a72
Malicious Activity!
Public Scan
Submission: On October 11 via automatic, source phishtank — Scanned from DE
Summary
TLS certificate: Issued by GlobalSign GCC R3 DV TLS CA 2020 on January 11th 2024. Valid for: a year.
This is the only time co47154.tw1.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WeTransfer (Online) Sharepoint (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 2a03:6f00:1:1... 2a03:6f00:1:1::5c35:6a72 | 9123 (TIMEWEB-AS) (TIMEWEB-AS) | |
2 | 13.32.99.68 13.32.99.68 | 16509 (AMAZON-02) (AMAZON-02) | |
11 | 3 |
ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-68.fra60.r.cloudfront.net
auth-cdn.wetransfer.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
tw1.ru
co47154.tw1.ru |
843 KB |
2 |
wetransfer.com
auth-cdn.wetransfer.com — Cisco Umbrella Rank: 209765 |
8 KB |
11 | 2 |
Domain | Requested by | |
---|---|---|
6 | co47154.tw1.ru |
co47154.tw1.ru
|
2 | auth-cdn.wetransfer.com |
co47154.tw1.ru
auth-cdn.wetransfer.com |
11 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
wetransfer.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.tw1.ru GlobalSign GCC R3 DV TLS CA 2020 |
2024-01-11 - 2025-02-11 |
a year | crt.sh |
wetransfer.com Amazon RSA 2048 M03 |
2024-05-09 - 2025-06-06 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://co47154.tw1.ru/clients/
Frame ID: 8DC67A72DC5C1701A2D27069EEAD7915
Requests: 17 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
co47154.tw1.ru/clients/ |
265 KB 103 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fonts.css
auth-cdn.wetransfer.com/assets/styles/ |
824 B 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
transfer_login_styles.css
auth-cdn.wetransfer.com/assets/styles/ |
31 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cross-icon.svg
co47154.tw1.ru/clients/images/ |
977 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wetransfer-text-logo.svg
co47154.tw1.ru/clients/images/ |
6 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
transfer-general.png
co47154.tw1.ru/clients/images/ |
732 KB 733 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-free-mobile.svg
co47154.tw1.ru/clients/images/ |
6 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
38 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
943 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ActiefGrotesque-W-Regular.woff
auth-cdn.wetransfer.com/assets/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
565 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
GT-Super-WT-Regular.woff
auth-cdn.wetransfer.com/assets/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
ActiefGrotesque-W-Medium.woff
auth-cdn.wetransfer.com/assets/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
co47154.tw1.ru/clients/images/ |
196 B 278 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- auth-cdn.wetransfer.com
- URL
- https://auth-cdn.wetransfer.com/assets/fonts/ActiefGrotesque-W-Regular.woff
- Domain
- auth-cdn.wetransfer.com
- URL
- https://auth-cdn.wetransfer.com/assets/fonts/GT-Super-WT-Regular.woff
- Domain
- auth-cdn.wetransfer.com
- URL
- https://auth-cdn.wetransfer.com/assets/fonts/ActiefGrotesque-W-Medium.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WeTransfer (Online) Sharepoint (Online)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
7 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
auth-cdn.wetransfer.com
co47154.tw1.ru
auth-cdn.wetransfer.com
13.32.99.68
2a03:6f00:1:1::5c35:6a72
1f39a1017906d512934d04cef8dbd816ebe0206eab872da92d30fdb554c84a89
26350bef02c0812b33389f4d5336ba0aa3422ad165cd536507b8431a22992582
42c52bdbaa9c00ee5d298c01ccd6399083ff9283156da45904f679542243fe24
471bf9c3edfa3627f722b076363b0ca2df07a06b6672a334714f6d6d0f9df1d1
6dbba1863bcfe251266f22a6c3b047f788a4851623c58c7b6b750809f0885dad
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
96be93d1f7c250f6eaf427558e8c039fd63d2cf7920857c7ddea2c690d251184
9bc8288fe0230be7938ae55a93a56fc64911ff249541bacc1ca952db292d2f60
9fe25d8abe96455f6df6a86e43a7647cdd2c6fc3a9594fdb09911cece95d6b72
cde80e58fff4561911f7397ef39dca6cfd699cf91ae6a205ff0a38b248d9d2d4
d58a7b9518c5f32458eccc39b0cd4c187968697f83fea7bfc56ce0dc21cd5f62
db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545
e7bf2df0a16db084dfa378e073c399b14fa4c48e92764bdb5497051f9786ce77
fd7108379b77e618b1f8e812a72c90338233b88137fe80666d236db4295ed57c