gctu-cgs.org - URL scan, 22 Aug 2026
MalwareAnalyzer by Cyble scanned gctu-cgs.org and returned a unknown verdict (score 6). The page resolved to 95.142.40.175 on EUROBYTE-MNT in RU. The domain was registered 693 days ago through Regional Network Information Center, JSC dba RU-CENTER. 5 domains and 2 IPs were contacted, over 13 HTTP requests. 1 malware sample communicates with this URL (Phishing). The request followed 2 redirects before landing. This is a point-in-time observation from 22 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 6) · Confidence 9%
- Scanned URL:
http://vkp.ru/upload/global/file/dekixolu.pdf - Domain: gctu-cgs.org · IP: 95.142.40.175 · AS210079 · RU
- Server: nginx
- Page title: Всеобщая конфедерация профсоюзов
- HTTP status: 200 · text/html; charset=UTF-8
- Registrar: Regional Network Information Center, JSC dba RU-CENTER · domain age 693 days · created 2024-09-27
- HTTP requests captured: 13
- Scan tier: fast · observed 2026-08-22 00:52:10 UTC
Redirect chain
http://vkp.ru/upload/global/file/dekixolu.pdfhttps://vkp.ru/upload/global/file/dekixolu.pdfhttps://gctu-cgs.org/
Malware communicating with this URL (1)
These samples were observed contacting or being served from gctu-cgs.org. Each links to its full analysis.
- Phishing - referenced ·
162819995cee94b81920b2270f632baa· first seen 2026-08-22
Antivirus & YARA (0 of 48 engines)
No engine flagged this page's content.
Why this verdict
- Cross-host redirect chain
Detected technologies
- Nginx
- jQuery
Contacted infrastructure
- 95.142.40.175 - AS210079 EUROBYTE-MNT (RU)
- 185.154.54.10 - AS210079 EUROBYTE - EuroByte LLC, RU (RU)
Observed indicators
- gctu-cgs.org
- mc.yandex.ru
- vk.com
- t.me
- code.jquery.com
- 95.142.40.175
- 185.154.54.10
- https://gctu-cgs.org/
- https://gctu-cgs.org/images/favicon.ico
- https://gctu-cgs.org/assets/fonts/ubuntu-regular.woff2
- https://gctu-cgs.org/assets/fonts/ubuntu-medium.woff2
- https://gctu-cgs.org/assets/fonts/ubuntu-bold.woff2
- https://gctu-cgs.org/assets/css/style.min.css
- https://gctu-cgs.org/assets/slick/slick.css
- https://gctu-cgs.org/assets/slick/slick-theme.css
- https://gctu-cgs.org/assets/css/custom.css?v=1787359933
- https://gctu-cgs.org/bitrix/js/intranet/intranet-common.min.css?173080651261199
- https://gctu-cgs.org/bitrix/js/ui/design-tokens/dist/ui.design-tokens.min.css?173080654923463
- https://gctu-cgs.org/bitrix/js/ui/fonts/opensans/ui.font.opensans.min.css?17308065572320
- https://gctu-cgs.org/bitrix/css/labsu.cookie/style.css?1782114292998
Other scans of gctu-cgs.org (3)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 22 Aug 2026 - unknown
- 13 Aug 2026 - unknown
- 13 Aug 2026 - unknown
Questions about gctu-cgs.org
- Is gctu-cgs.org safe?
- The scan of gctu-cgs.org on 22 Aug 2026 reached no verdict either way (score 6). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with gctu-cgs.org?
- 1 analysed samples communicate with this URL, including Phishing.
- How was gctu-cgs.org checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of gctu-cgs.org
Scanned on MalwareAnalyzer by Cyble · Open interactive scan