Security Scan Report: cu789179.tw1.ru

Redirected to:
https://vh460.timeweb.ru/parking/?ref=cu789179.tw1.ru
Site favicon
Submitted: Completed: publiccompleted
This website contacted 13 IPs in 2 countries across 11 domains to perform 53 HTTP transactions. The main domain is tw1.ru and was registered 20 years ago.

Submitted URL: http://cu789179.tw1.ru/ca113cf1.php

Effective URL:
https://vh460.timeweb.ru/parking/?ref=cu789179.tw1.ru
Redirected

The Cisco Umbrella rank of the primary domain is #163,229 of the top 1 million websites

AI Security Verdict

High Risk

Confidence: 65%

7
Risk Score

Entry URL was reported as a DCRat trojan endpoint, but it now just redirects to a genuine Timeweb parking page with no forms. Treat the domain as previously malicious; do not visit the .php path.

Risk Factors (2)
The scanned URL path on the entry domain was publicly reported as a DCRat trojan indicator (single-source, unverified, so the attribution itself is not corroborated)
Host subdomain cu789179.tw1.ru sits on a free/dynamic-style tw1.ru namespace commonly used for throwaway payload hosting, and the .php endpoint no longer serves content
Domain age information unavailable

Details

Page Title

Домен припаркован в Timeweb

Scan Type

public

Domain Name Analysis

Domain 'cu789179.tw1.ru' uses the Russian country-code top-level domain (.ru); it also runs on subdomain 'cu789179'. The core label 'tw1' covers 3 characters containing 0 vowels alongside two consonants, along with one digit. Breaking it apart gives two words: tw, 1. The median word length lands at 1.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of http://cu789179.tw1.ru/ca113cf1.php

Page Load Overview

3.41s
Total Load Time
1.6 MB
Total Size

Language Analysis

Primary Language

🇷🇺Russian
Code: ru
Confidence:60%
Script:Cyrillic
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:1,717 chars
Detector Agreement:100%
Language mismatch: Declared as en but detected as ru

Website Classification

Primary Category

corporate business45% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

corporate business
45%
technology software
30%

Detected Features

Search

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
592.53.96.201St Petersburg, St.-Petersburg, Russia
AS9123Jsc timeweb
4142.251.13.95Google · CDNUnited States
AS15169Google LLC
4142.251.157.119Google · CDNUnited States
AS15169Google LLC
477.88.55.88Yandex · CLOUDRussia
AS13238YANDEX LLC
477.88.21.119Yandex · CLOUDMoscow, Moscow, Russia
AS13238YANDEX LLC
4142.250.154.94Google · CDNUnited States
AS15169Google LLC
4142.251.152.120Google · CDNUnited States
AS15169Google LLC
487.250.250.119Yandex · CLOUDRussia
AS13238YANDEX LLC
437.9.64.225Yandex · CLOUDRussia
AS13238YANDEX LLC
4142.251.152.119Google · CDNUnited States
AS15169Google LLC
5313--

Detected Technologies2

JQueryv2.1.3
100%
Nginxv1.30.6
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T13A63B7E701F0D0E14A4FC3B19D365A9B9D7624BFDE81928479DC0A507F92DF58883AAC

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:GfE3FlrVArdq9H40PxiHm/ouVHHMjEENRzibLIN0:Gf2VArdq9H40AupMV6LIG

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:72927:oAQZA2IlGglOLIQoJYQyRAxgoqkYQQA6jLLCtx/d4MYbd0AAYhIAYQAJbWrAAYE3TKhRCBQCIMOIMIbEylQSGUAYQkqAZ4gR

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:818181ffffffffff
Perceptual Hash:ba3b3ac0c5c5c5c5
Difference Hash:2b2b0b36e0c0b8e8
Wavelet Hash:000000007f7f7f7f
Color Hash:#e06c7f

Scan History

Scan history not available

Unable to load historical scan data