ScanMalware.com

Security Scan Report: cp552296.tw1.ru

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/74a1137d-073e-4422-b40e-b58d6eb8eb21Domain and IP registration (RDAP)/api/v1/rdap/74a1137d-073e-4422-b40e-b58d6eb8eb21How often this domain was scanned/api/v1/domain/stats/cp552296.tw1.ruScan history for this domain/api/v1/domain/history/cp552296.tw1.ru?limit=15
This website contacted 2 IPs in 2 countries across 2 domains to perform 26 HTTP transactions. The main domain is tw1.ru and was registered 20 years ago.

Submitted URL: https://cp552296.tw1.ru/core/client/scotia/

The Cisco Umbrella rank of the primary domain is #163,229 of the top 1 million websites

AI Security Verdict

Confirmed Scam

Confidence: 98%

10
Risk Score

Confirmed Scotiabank phishing page on a free-hosting subdomain: brand impersonation plus a username/password harvest form, and flagged twice by Google Safe Browsing for social engineering. Never enter credentials.

Risk Factors (5)
Google Safe Browsing: Social Engineering (2 instances)
Impersonation of Scotiabank on a non-Scotiabank domain (tw1.ru free hosting subdomain)
Credential-harvesting login form (username/card number + password) on the impersonating host
Deceptive 'Let's activate your account' link pointing only to '#'
Hostname unrelated to the claimed brand
Domain age information unavailable

Details

Page Title

Sign in | Scotiabank

Scan Type

public

Domain Name Analysis

Domain 'cp552296.tw1.ru' uses the Russian country-code top-level domain (.ru); it also runs on subdomain 'cp552296'. Its registrable label 'tw1' stretches across 3 characters containing zero vowels alongside two consonants, along with one digit. Splitting it apart reveals 2 words: tw, 1. Median word length is 1.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://cp552296.tw1.ru/core/client/scotia/

Page Load Overview

1.88s
Total Load Time
1013 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:257 chars
Detector Agreement:100%

Website Classification

Primary Category

finance banking34% confidence
Type: dynamic
Method: ml+structural+ocr_tiebreaker

All Detected Categories

finance banking
34%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1392.53.96.201St Petersburg, St.-Petersburg, Russia
AS9123Jsc timeweb
13142.251.20.95Google · CDNUnited States
AS15169Google LLC
262--

Detected Technologies5

X-UA-Compatible
100%
PasswordField
100%
JQueryv3.5.1
100%
Nginxv1.30.6
40%
Google Hosted Libraries
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1E372D8727A84123BC2134BD923B1F548267D8057E951CCA4B75D82C9EFC1FDBC67AA09

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:z42EGIvTyTasKc9mch/ViPXKztSOy9F1D:zCyJKAmchH8p3

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:16893:qhCAAwBgIpDEJ0EROsHSkCCgoMbhCh4EiMlBg+RSgAcIhMQTAjgBhwRh8kBBEiCsKr8kCGiaxVyxIAcAgXUAiU+BImKCDSBA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffa5ffa6a6ffe7ff
Perceptual Hash:f72b886477888877
Difference Hash:2868314c4c310cf0
Wavelet Hash:3c243c24e4fcc0ff
Color Hash:#783a3a

Other Hashes

Crop Resistant:2868314c4c310cf0

Scan History

Scan history not available

Unable to load historical scan data