Use whois cshare.us to find registration date, name servers, and registrar. Recent registration (less than 6 months) with hidden WHOIS is typical of temporary services – not necessarily malicious, but worth monitoring.
Numerous paste sites use short, memorable domains. cshare.us could offer a shareable clipboard. The met2 part might be a randomly generated ID for a specific paste. For example, upon creating a new paste, the server redirects to https://cshare.us/met2. If a user copies the link incorrectly, they might write http- cshare.us met2 in a text note. http- cshare.us met2
If HTTPS is supported, examine the certificate: Use whois cshare
openssl s_client -connect cshare.us:443 -servername cshare.us 2>/dev/null | openssl x509 -text | grep -A2 "Subject Alternative Name"
A valid certificate for *.cshare.us or the exact domain indicates some production use. Self-signed or expired certificates raise suspicion. Download (public):
input_str = "http- cshare.us met2" normalized = normalize_fragmented_url(input_str) print(normalized) # http://cshare.us/met2
This does not fix all cases (missing query parameters, ports), but it resolves the most obvious pattern.
Use whois cshare.us to find registration date, name servers, and registrar. Recent registration (less than 6 months) with hidden WHOIS is typical of temporary services – not necessarily malicious, but worth monitoring.
Numerous paste sites use short, memorable domains. cshare.us could offer a shareable clipboard. The met2 part might be a randomly generated ID for a specific paste. For example, upon creating a new paste, the server redirects to https://cshare.us/met2. If a user copies the link incorrectly, they might write http- cshare.us met2 in a text note.
If HTTPS is supported, examine the certificate:
openssl s_client -connect cshare.us:443 -servername cshare.us 2>/dev/null | openssl x509 -text | grep -A2 "Subject Alternative Name"
A valid certificate for *.cshare.us or the exact domain indicates some production use. Self-signed or expired certificates raise suspicion.
input_str = "http- cshare.us met2" normalized = normalize_fragmented_url(input_str) print(normalized) # http://cshare.us/met2
This does not fix all cases (missing query parameters, ports), but it resolves the most obvious pattern.