cc02058.tmweb.ru Open in urlscan Pro
2a03:6f00:1::5c35:60de Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://cc02058.tmweb.ru/
Submission: On November 17 via manual (November 17th 2021, 3:04:54 pm UTC) from FR — Scanned from FR

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 4 countries across 7 domains to perform 16 HTTP transactions. The main IP is 2a03:6f00:1::5c35:60de, located in Russian Federation and belongs to TIMEWEB-AS, RU. The main domain is cc02058.tmweb.ru.

This is the only time cc02058.tmweb.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Crédit Lyonnais (Banking)

Domain & IP information

	IP Address	AS Autonomous System
9	2a03:6f00:1::... 2a03:6f00:1::5c35:60de	9123 (TIMEWEB-AS) (TIMEWEB-AS)
1	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:5714	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	161.35.253.229 161.35.253.229	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
2	158.191.172.21 158.191.172.21	9159 (Credit Ag...) (Credit Agricole)
16	7

9 2a03:6f00:1::5c35:60de (Russian Federation)

ASN9123 (TIMEWEB-AS, RU)

cc02058.tmweb.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5714 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 161.35.253.229 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

keys0.openode.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 158.191.172.21 (France)

ASN9159 (Credit Agricole, FR)

monespace.lcl.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	tmweb.ru cc02058.tmweb.ru	539 KB
2	lcl.fr monespace.lcl.fr	361 KB
1	gstatic.com fonts.gstatic.com	20 KB
1	openode.io keys0.openode.io	1 KB
1	jsdelivr.net cdn.jsdelivr.net	893 B
1	cloudflare.com cdnjs.cloudflare.com	1 KB
1	googleapis.com fonts.googleapis.com	1 KB
16	7

	Domain	Requested by
9	cc02058.tmweb.ru	cc02058.tmweb.ru
2	monespace.lcl.fr
1	fonts.gstatic.com	fonts.googleapis.com
1	keys0.openode.io	cc02058.tmweb.ru
1	cdn.jsdelivr.net	cc02058.tmweb.ru
1	cdnjs.cloudflare.com	cc02058.tmweb.ru
1	fonts.googleapis.com	cc02058.tmweb.ru
16	7

This site contains no links.

Subject Issuer	Validity	Valid
upload.video.google.com GTS CA 1C3	`2021-10-18` - `2022-01-10`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-21` - `2022-09-20`	a year	crt.sh
*.openode.io AlphaSSL CA - SHA256 - G2	`2020-03-05` - `2022-04-11`	2 years	crt.sh
*.gstatic.com GTS CA 1C3	`2021-10-18` - `2022-01-10`	3 months	crt.sh
monespace.lcl.fr Sectigo RSA Extended Validation Secure Server CA	`2020-12-16` - `2021-12-16`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://cc02058.tmweb.ru/
Frame ID: 47603F711590B7475C7FFC5910012219
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

LCL - Banque et assurance

Page Statistics

16
Requests

44 %
HTTPS

71 %
IPv6

7
Domains

7
Subdomains

7
IPs

4
Countries

925 kB
Transfer

1610 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
cc02058.tmweb.ru/ 1 KB
951 B 200ms
135ms Document
text/html 2a03:6f00:1::5c35:60de
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://cc02058.tmweb.ru/
Protocol: HTTP/1.1
Server: 2a03:6f00:1::5c35:60de , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 93422ecd714e4b49109b635332bbe3d4a4eaa6ecbdfc61fde7a162269558abbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9

Response headers

Server: nginx/1.20.1
Date: Wed, 17 Nov 2021 15:04:47 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Mon, 15 Nov 2021 11:08:32 GMT
ETag: W/"46c-5d0d1d4542eb1"
Content-Encoding: gzip

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
1 KB 106ms
37ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:wght@400&display=swap

Requested by

Host: cc02058.tmweb.ru
URL: http://cc02058.tmweb.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

afbb224757994ccc20b0ab6ceb60eab144cd8825a392613861045e393632ec81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: http://cc02058.tmweb.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 15:04:47 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 17 Nov 2021 15:04:47 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 17 Nov 2021 15:04:47 GMT

GET
H2 200 index.min.js Show response
cdnjs.cloudflare.com/ajax/libs/adblock-detect/1.0.5/ 1 KB
1 KB 229ms
77ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/adblock-detect/1.0.5/index.min.js

Requested by

Host: cc02058.tmweb.ru
URL: http://cc02058.tmweb.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e5c9c430c430273551c46e69d58bec076c4171a41f56ef0411e670a76651a7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: http://cc02058.tmweb.ru/
Origin: http://cc02058.tmweb.ru
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 15:04:47 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1188129
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 452
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:04:05 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03cf5-425"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NHy6Zqqdb%2BYGbNECNeSD%2F8a9MN5PTpePhPNKsQsb46ZlKLgdUQswDNu5LNdngPsOyCKTdvd2WBoFgQ4XicVxKhff2BloYAUYk%2BUMzFsgqANOGrcea04mn2uMmzs7YunUlwumVFrFyDBYFQunWJ5Swkk%2B"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6af9da818dbb0f5a-MXP
expires: Mon, 07 Nov 2022 15:04:47 GMT

GET
H2 200 index.min.js Show response
cdn.jsdelivr.net/npm/@adonisjs/framework@5.0.13/ 430 B
893 B 234ms
82ms Script
application/javascript 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@adonisjs/framework@5.0.13/index.min.js

Requested by

Host: cc02058.tmweb.ru
URL: http://cc02058.tmweb.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6dcf40fd04d3387edc5d792b6c7d978af1ba834014f7028765f9342db989f6ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: http://cc02058.tmweb.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 15:04:47 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 134739
x-jsd-version: 5.0.13
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-served-by: cache-fra19145-FRA, cache-mxp6948-MXP
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"1ae-myc90tb7oItlxVsc5EMaDyV2uOM"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6af9da8189640e02-MXP

GET
H/1.1 200
OK init.js Show response
cc02058.tmweb.ru/config/ 427 B
752 B 79ms
78ms Script
application/x-javascript 2a03:6f00:1::5c35:60de
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://cc02058.tmweb.ru/config/init.js
Requested by: Host: cc02058.tmweb.ru
URL: http://cc02058.tmweb.ru/
Protocol: HTTP/1.1
Server: 2a03:6f00:1::5c35:60de , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: a2f8ea4bdbb8cfc450a635b729ab4993233e147a4ec63c1fda79c05263aa5592

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: http://cc02058.tmweb.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Wed, 17 Nov 2021 15:04:47 GMT
Last-Modified: Mon, 15 Nov 2021 11:09:37 GMT
Server: nginx/1.20.1
ETag: "61923ff1-1ab"
Content-Type: application/x-javascript
Cache-Control: max-age=2678400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 427
Expires: Sat, 18 Dec 2021 15:04:47 GMT

GET
H/1.1 200
OK vendor.79857f86.css
cc02058.tmweb.ru/css/ 469 KB
78 KB 166ms
147ms Stylesheet
text/css 2a03:6f00:1::5c35:60de
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://cc02058.tmweb.ru/css/vendor.79857f86.css
Requested by: Host: cc02058.tmweb.ru
URL: http://cc02058.tmweb.ru/
Protocol: HTTP/1.1
Server: 2a03:6f00:1::5c35:60de , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: d3863ce91b9d78d931c43a0dd93dfc867e6e94f1a94ef0aa65f8bf71ff738b07

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: http://cc02058.tmweb.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Wed, 17 Nov 2021 15:04:47 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 Nov 2021 11:09:49 GMT
Server: nginx/1.20.1
ETag: W/"61923ffd-755dc"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2678400
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sat, 18 Dec 2021 15:04:47 GMT

GET
H/1.1 200
OK app.c458c721.css
cc02058.tmweb.ru/css/ 1 KB
910 B 186ms
167ms Stylesheet
text/css 2a03:6f00:1::5c35:60de
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://cc02058.tmweb.ru/css/app.c458c721.css
Requested by: Host: cc02058.tmweb.ru
URL: http://cc02058.tmweb.ru/
Protocol: HTTP/1.1
Server: 2a03:6f00:1::5c35:60de , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: e5eadc851b61cb9a279249aa65fb8c743056240ec697b1ca93103ce7c28eb0f5

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: http://cc02058.tmweb.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Wed, 17 Nov 2021 15:04:47 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 Nov 2021 11:09:29 GMT
Server: nginx/1.20.1
ETag: W/"61923fe9-4e4"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2678400
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sat, 18 Dec 2021 15:04:47 GMT

GET
H/1.1 200
OK vendor.2f637462.js Show response
cc02058.tmweb.ru/js/ 394 KB
132 KB 159ms
132ms Script
application/x-javascript 2a03:6f00:1::5c35:60de
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://cc02058.tmweb.ru/js/vendor.2f637462.js
Requested by: Host: cc02058.tmweb.ru
URL: http://cc02058.tmweb.ru/
Protocol: HTTP/1.1
Server: 2a03:6f00:1::5c35:60de , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 4612d8bfbeb8a056e105a680a2a3e061e3052bd08e0580f23881feec2ced7513

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: http://cc02058.tmweb.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Wed, 17 Nov 2021 15:04:47 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 Nov 2021 11:08:53 GMT
Server: nginx/1.20.1
ETag: W/"61923fc5-627e4"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=2678400
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sat, 18 Dec 2021 15:04:47 GMT

GET
H/1.1 200
OK app.891049b6.js Show response
cc02058.tmweb.ru/js/ 6 KB
3 KB 180ms
101ms Script
application/x-javascript 2a03:6f00:1::5c35:60de
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://cc02058.tmweb.ru/js/app.891049b6.js
Requested by: Host: cc02058.tmweb.ru
URL: http://cc02058.tmweb.ru/
Protocol: HTTP/1.1
Server: 2a03:6f00:1::5c35:60de , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 8618f8e47bd3e1ed94e0dcd719108c959bf21c160ac75f331def59dcf2f24b43

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: http://cc02058.tmweb.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Wed, 17 Nov 2021 15:04:47 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 Nov 2021 11:08:37 GMT
Server: nginx/1.20.1
ETag: W/"61923fb5-189e"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=2678400
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sat, 18 Dec 2021 15:04:47 GMT

GET
H2 200 ip Show response
keys0.openode.io/ 742 B
1 KB 467ms
163ms Fetch
application/json 161.35.253.229
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://keys0.openode.io/ip

Requested by

Host: cc02058.tmweb.ru
URL: http://cc02058.tmweb.ru/js/app.891049b6.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

161.35.253.229 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

/ Express

Resource Hash

9690aff9bb2871d7be99babd178529dab6fa216116732e41442478e2b6239ae6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: http://cc02058.tmweb.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 15:04:48 GMT
etag: W/"2e6-ICz/ayliYfNHJQ0fGQwIeoh7pWA"
x-powered-by: Express
strict-transport-security: max-age=15724800; includeSubDomains
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 742

GET
H/1.1 200
OK 2.330e31a4.js Show response
cc02058.tmweb.ru/js/ 699 B
1 KB 82ms
79ms Script
application/x-javascript 2a03:6f00:1::5c35:60de
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://cc02058.tmweb.ru/js/2.330e31a4.js
Requested by: Host: cc02058.tmweb.ru
URL: http://cc02058.tmweb.ru/js/app.891049b6.js
Protocol: HTTP/1.1
Server: 2a03:6f00:1::5c35:60de , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: bc8e263c1fbcf63b7fa1cff7ec1655b2ad29fda01c62c5cb12f275b8974e7249

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: http://cc02058.tmweb.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Wed, 17 Nov 2021 15:04:48 GMT
Last-Modified: Mon, 15 Nov 2021 11:08:45 GMT
Server: nginx/1.20.1
ETag: "61923fbd-2bb"
Content-Type: application/x-javascript
Cache-Control: max-age=2678400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 699
Expires: Sat, 18 Dec 2021 15:04:48 GMT

GET
H/1.1 200
OK 4.6f16beb8.js Show response
cc02058.tmweb.ru/js/ 18 KB
5 KB 85ms
84ms Script
application/x-javascript 2a03:6f00:1::5c35:60de
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://cc02058.tmweb.ru/js/4.6f16beb8.js
Requested by: Host: cc02058.tmweb.ru
URL: http://cc02058.tmweb.ru/js/app.891049b6.js
Protocol: HTTP/1.1
Server: 2a03:6f00:1::5c35:60de , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: accbee700a3bd80fd802cb531a4bf2444f14f142e381175b6dfbff7a70458fbc

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: http://cc02058.tmweb.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Wed, 17 Nov 2021 15:04:48 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 Nov 2021 11:08:37 GMT
Server: nginx/1.20.1
ETag: W/"61923fb5-46dc"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=2678400
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sat, 18 Dec 2021 15:04:48 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v18/ 19 KB
20 KB 101ms
31ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@400&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: http://cc02058.tmweb.ru
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 07:59:11 GMT
x-content-type-options: nosniff
age: 111937
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19844
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:20:10 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 16 Nov 2022 07:59:11 GMT

GET
H/1.1 200
OK materialdesignicons-webfont.e9db4005.woff2
cc02058.tmweb.ru/fonts/ 318 KB
318 KB 77ms
77ms Font
application/font-woff2 2a03:6f00:1::5c35:60de
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://cc02058.tmweb.ru/fonts/materialdesignicons-webfont.e9db4005.woff2
Requested by: Host: cc02058.tmweb.ru
URL: http://cc02058.tmweb.ru/css/vendor.79857f86.css
Protocol: HTTP/1.1
Server: 2a03:6f00:1::5c35:60de , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: da7fba3ca3e0b9cd42a9cd10c7c6ed16d2fdb938174116601cd3d51033c6f490

Request headers

Referer: http://cc02058.tmweb.ru/css/vendor.79857f86.css
Origin: http://cc02058.tmweb.ru
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Wed, 17 Nov 2021 15:04:48 GMT
Last-Modified: Mon, 15 Nov 2021 11:09:21 GMT
Server: nginx/1.20.1
ETag: "61923fe1-4f67c"
Content-Type: application/font-woff2
Cache-Control: max-age=2678400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 325244
Expires: Sat, 18 Dec 2021 15:04:48 GMT

GET
H/1.1 200
OK logo.b67cae54f399508c58a3.svg
monespace.lcl.fr/ 27 KB
10 KB 413ms
27ms Image
image/svg+xml 158.191.172.21
Credit Agricole

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://monespace.lcl.fr/logo.b67cae54f399508c58a3.svg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

158.191.172.21 , France, ASN9159 (Credit Agricole, FR),

Reverse DNS

Software

Resource Hash

b0606f6d85632a232a60b68fcb3abd5b05ffaf6e27cb0a202970507144582b60

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: http://cc02058.tmweb.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Wed, 17 Nov 2021 15:04:48 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 16 Nov 2021 19:42:33 GMT
ETag: W/"6c7d-17d2a45bc28"
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=15724800; includeSubDomains
Content-Type: image/svg+xml
Cache-Control: public, max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 9436
X-XSS-Protection: 0
Keep-Alive: timeout=5, max=100

GET
H/1.1 200
OK login-page-background.ebdfc9d931825723e5ed.jpg
monespace.lcl.fr/ 351 KB
351 KB 413ms
28ms Image
image/jpeg 158.191.172.21
Credit Agricole

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://monespace.lcl.fr/login-page-background.ebdfc9d931825723e5ed.jpg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

158.191.172.21 , France, ASN9159 (Credit Agricole, FR),

Reverse DNS

Software

Resource Hash

5a447b0ee932cde3ebd1124a9707e77d7e7cf90d0cd965a1364f8fa21434f243

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: http://cc02058.tmweb.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Wed, 17 Nov 2021 15:04:48 GMT
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Tue, 16 Nov 2021 19:42:33 GMT
ETag: W/"57bc0-17d2a45bc28"
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public, max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 359360
X-XSS-Protection: 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Crédit Lyonnais (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cc02058.tmweb.ru
cdn.jsdelivr.net
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
keys0.openode.io
monespace.lcl.fr
158.191.172.21
161.35.253.229
2606:4700::6810:125e
2606:4700::6810:5714
2a00:1450:4001:810::200a
2a00:1450:4001:82b::2003
2a03:6f00:1::5c35:60de
0e5c9c430c430273551c46e69d58bec076c4171a41f56ef0411e670a76651a7c
2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3
4612d8bfbeb8a056e105a680a2a3e061e3052bd08e0580f23881feec2ced7513
5a447b0ee932cde3ebd1124a9707e77d7e7cf90d0cd965a1364f8fa21434f243
6dcf40fd04d3387edc5d792b6c7d978af1ba834014f7028765f9342db989f6ee
8618f8e47bd3e1ed94e0dcd719108c959bf21c160ac75f331def59dcf2f24b43
93422ecd714e4b49109b635332bbe3d4a4eaa6ecbdfc61fde7a162269558abbd
9690aff9bb2871d7be99babd178529dab6fa216116732e41442478e2b6239ae6
a2f8ea4bdbb8cfc450a635b729ab4993233e147a4ec63c1fda79c05263aa5592
accbee700a3bd80fd802cb531a4bf2444f14f142e381175b6dfbff7a70458fbc
afbb224757994ccc20b0ab6ceb60eab144cd8825a392613861045e393632ec81
b0606f6d85632a232a60b68fcb3abd5b05ffaf6e27cb0a202970507144582b60
bc8e263c1fbcf63b7fa1cff7ec1655b2ad29fda01c62c5cb12f275b8974e7249
d3863ce91b9d78d931c43a0dd93dfc867e6e94f1a94ef0aa65f8bf71ff738b07
da7fba3ca3e0b9cd42a9cd10c7c6ed16d2fdb938174116601cd3d51033c6f490
e5eadc851b61cb9a279249aa65fb8c743056240ec697b1ca93103ce7c28eb0f5

cc02058.tmweb.ru Open in urlscan Pro 2a03:6f00:1::5c35:60de Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

16 Requests

44 %HTTPS

71 %IPv6

7 Domains

7 Subdomains

7 IPs

4 Countries

925 kBTransfer

1610 kBSize

0 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

Indicators

cc02058.tmweb.ru Open in urlscan Pro
2a03:6f00:1::5c35:60de Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

44 %
HTTPS

71 %
IPv6

7
Domains

7
Subdomains

7
IPs

4
Countries

925 kB
Transfer

1610 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!