Security Scan Report: cp447347.tw1.ru

Redirected to:
https://vh470.timeweb.ru/parking/?ref=cp447347.tw1.ru
Site favicon
Submitted: Completed: publiccompleted
This website contacted 14 IPs in 2 countries across 11 domains to perform 54 HTTP transactions. The main domain is tw1.ru and was registered 20 years ago.

Submitted URL: http://cp447347.tw1.ru/l1nc0in.php

Effective URL:
https://vh470.timeweb.ru/parking/?ref=cp447347.tw1.ru
Redirected

The Cisco Umbrella rank of the primary domain is #163,229 of the top 1 million websites

AI Security Verdict

High Risk

Confidence: 75%

7
Risk Score

The scanned URL is flagged as DCRat malware by two independent feeds, which forces a high-risk rating. It currently redirects to a harmless Timeweb parking page, but the host path has a malware history.

Risk Factors (3)
URL-level indicator matches a named malware family (DCRat) in two corroborating feeds
Compromised or abused subdomain within a free/instant shared-hosting namespace (tw1.ru)
Money/credential harvesting elements absent, but the flagged path indicates prior malicious hosting activity on this host
Domain age information unavailable

Details

Page Title

Домен припаркован в Timeweb

Scan Type

public

Domain Name Analysis

The domain 'cp447347.tw1.ru' uses the Russian country-code top-level domain (.ru) with subdomain 'cp447347'. The core label 'tw1' covers 3 characters holding 0 vowels versus two consonants; it also includes one digit. Splitting it apart reveals two words: tw, 1. Median word length comes out to 1.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of http://cp447347.tw1.ru/l1nc0in.php

Page Load Overview

4.68s
Total Load Time
1.6 MB
Total Size

Language Analysis

Primary Language

🇷🇺Russian
Code: ru
Confidence:60%
Script:Cyrillic
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:1,717 chars
Detector Agreement:100%
Language mismatch: Declared as en but detected as ru

Website Classification

Primary Category

corporate business43% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

corporate business
43%
technology software
29%

Detected Features

Search

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1592.53.96.169St Petersburg, St. Petersburg, Russia
AS9123Jsc timeweb
3142.251.13.95Google · CDNUnited States
AS15169Google LLC
3142.251.150.119Google · CDNUnited States
AS15169Google LLC
35.255.255.77Yandex · CLOUDMoscow, Moscow, Russia
AS13238YANDEX LLC
387.250.250.119Yandex · CLOUDRussia
AS13238YANDEX LLC
3142.251.14.94Google · CDNUnited States
AS15169Google LLC
3142.251.127.94Google · CDNUnited States
AS15169Google LLC
377.88.21.119Yandex · CLOUDMoscow, Moscow, Russia
AS13238YANDEX LLC
337.9.64.225Yandex · CLOUDRussia
AS13238YANDEX LLC
3142.250.154.95Google · CDNUnited States
AS15169Google LLC
5414--

Detected Technologies2

JQueryv2.1.3
100%
Nginxv1.30.6
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T19263C7E701F0D0E14A4FC3B19D365A9B9D7624BFDE81928479DC0A507F92DF58883AAC

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:EfELFlrVwmdq9H40PxiHm/ouVHHMjEENRzibLIN0:EfqVwmdq9H40AupMV6LIG

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:72927:IatVe2YYD4ASzJAIkkkIBQBILsAoATKLjKmN5IcQYgIBIwErwnQBKgTouME6ES9EYAARCBIakMISs+aMMBwACQGhCSSTkgpA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:818181ffffffffff
Perceptual Hash:ba3b3ac0c5c5c5c5
Difference Hash:2b2b0b36e0c0b8e8
Wavelet Hash:000000007f7f7f7f
Color Hash:N/A

Scan History

Scan history not available

Unable to load historical scan data