Security Scan Report: nhcylxx-ohrannikdocsohrannikdocsohrannikdocs-ohrannikdocs.click

Site favicon
Submitted: Oct 6, 2026, 8:01:38 AMCompleted: Oct 6, 2026, 8:02:13 AMpubliccompleted

AI Security Verdict

Low Risk

Confidence: 78%

3
Risk Score

One-day-old unranked site openly selling forged Russian security-guard credentials, licenses and medical/criminal-record certificates for 22,000 RUB, with 6 cross-domain redirects — an illegal-document fraud funnel, not a legitimate business.

Risk Factors (5)
Sale of forged government/official documents (guard licenses, diplomas, medical and criminal-record certificates)
Extremely new domain (1 day) with no reputation
Six cross-domain redirects, indicative of a disposable/rotating funnel
Spam-engineered hostname and boilerplate 'buy documents' landing-page template
Obfuscated/OCR-garbled text and AI-crawler-style obfuscation on the visible page
Safety Factors (4)
No credential-harvesting form: 0 password fields, 0 payment fields (verified form facts)
No Indicators of Compromise, no YARA/JavaScript malware, no network IDS alerts
Third-party scripts are established services (JivoSite chat, Yandex Metrica)
No concrete malicious signal (no IoC / YARA / Safe-Browsing / IDS / credential form / brand impersonation) — elevated risk rested on domain age or reputation alone; clamped from 8 to 3
Domain age information unavailable

Details

Page Title

Купить удостоверение охранника образца 2026 года в России

Scan Type

public

Domain Name Analysis

The domain 'nhcylxx-ohrannikdocsohrannikdocsohrannikdocs-ohrannikdocs.click' uses the .click top-level domain and has no subdomain. Its registrable label 'nhcylxx-ohrannikdocsohrannikdocsohrannikdocs-ohrannikdocs' stretches across 57 characters with 16 vowels and 39 consonants, plus 2 hyphens. Breaking it apart gives 19 words: nhc, y, lxx, oh, ran, nik, docs, oh, ran, nik, docs, oh, ran, nik, docs, oh, ran, nik, docs. The median word length lands at three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://nhcylxx-ohrannikdocsohrannikdocsohrannikdocs-ohrannikdocs.click/

Page Load Overview

1.51s
Total Load Time
2.0 MB
Total Size

Language Analysis

Primary Language

🇷🇺Russian
Code: ru
Confidence:80%
Script:Cyrillic
Direction:ltr

Detection Details

HTML Lang Attribute:ru
Text Length:11,410 chars
Detector Agreement:100%

Website Classification

Primary Category

government public service68% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

government public service
68%
corporate business
45%
adult content
43%
documentation technical
26%
blog personal website
26%

Detected Features

OG: website

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
9145.63.129.127Frankfurt am Main, Hesse, Germany
AS211381Podaon SIA
95.101.71.73Yerevan, Yerevan, Armenia
AS201589edgeam LLC
987.250.250.119Yandex · CLOUDRussia
AS13238YANDEX LLC
9185.71.67.146Russia
AS43298Storm Networks LLC
987.250.251.119Yandex · CLOUDRussia
AS13238YANDEX LLC
977.88.21.119Yandex · CLOUDMoscow, Moscow, Russia
AS13238YANDEX LLC
994.131.94.24Kazakhstan
AS208795Cloud Services Kazakhstan LLP
637--

Detected Technologies3

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T15463752041E9245A0102E296D9707A0E7D97D17FBF1B5B2531AC3ABD3FD3C96C92B22D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:adIIU7p/wE7QTirFCivfuaOy3vjChrRcsH:V9IE0TirFCi3uaOy3vjCRRL

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:70573:QgcKlgD1qmyAaCISCg/QQAGUgQBIpIcgDHnFAHSIYWgJCwC2IIwBpQBBY7CABMUAAJQ8C41HoYQsFSwB5lSYoKFkZBQegAkC

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:000000000000ffff
Perceptual Hash:8a16e5364bf64996
Difference Hash:4d55f15555511492
Wavelet Hash:27bf3c000001ffff
Color Hash:#931f35

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data