Security Scan Report: les-stroi.ru

Site favicon
Submitted: Completed: publiccompleted

AI Security Verdict

Moderate Risk

Confidence: 78%

5
Risk Score

Aged Russian DIY blog, but injected/obfuscated JS (5 eval calls) POSTs to the unrelated suspicious domain newrotatormarch23.bid alongside cross-domain redirects — a compromise/malvertising injection. No credential forms present.

Risk Factors (4)
eval() dynamic code execution (5 calls) indicative of obfuscated injected script
Cross-origin POST to newrotatormarch23.bid, a .bid domain with no legitimate relationship to a construction blog (known malvertising/push-notification abuse pattern)
4 cross-domain redirects
Unranked domain (not in Cisco Umbrella top 1M)
Safety Factors (6)
Domain age 1524 days (>4 years, well-established registration)
No threat-intel Indicators of Compromise matched the page
No YARA JavaScript malware patterns and no known-kit roster hit
No credential or payment forms (0 password, 0 payment, 0 total forms)
Self-branded Russian home-repair blog with coherent topical content
Established domain (1524 days old) with no strong malicious indicators — risk clamped from 7 to 5
Domain age information unavailable

Details

Page Title

Строительство и ремонт

Scan Type

public

Domain Name Analysis

You're looking at domain 'les-stroi.ru' on the Russian country-code top-level domain (.ru) and has no subdomain. The registrable portion 'les-stroi' spans 9 characters split between three vowels and 5 consonants, notching 1 hyphen. Tokenizing the label suggests 3 words: les, s, troi. Median word length is three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://les-stroi.ru

Page Load Overview

18.87s
Total Load Time
6.0 MB
Total Size

Language Analysis

Primary Language

🇷🇺Russian
Code: ru
Confidence:80%
Script:Cyrillic
Direction:ltr

Detection Details

HTML Lang Attribute:ru-RU
Text Length:2,733 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical100% confidence
Type: spa
Method: ml+structural

All Detected Categories

documentation technical
100%
real estate property
89%
blog personal website
88%
technology software
64%
healthcare medical
57%

Detected Features

Articles
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1977.246.148.77Russia
AS29182JSC IOT
4142.251.14.95Google · CDNUnited States
AS15169Google LLC
4142.251.13.157Google · CDNUnited States
AS15169Google LLC
45.255.255.77Yandex · CLOUDMoscow, Moscow, Russia
AS13238YANDEX LLC
495.216.65.102Helsinki, Uusimaa, Finland
AS24940Hetzner Online GmbH
4142.251.127.95Google · CDNUnited States
AS15169Google LLC
4142.251.13.156Google · CDNUnited States
AS15169Google LLC
477.88.44.55Yandex · CLOUDMoscow, Moscow, Russia
AS13238YANDEX LLC
4104.17.208.5Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4142.251.14.94Google · CDNUnited States
AS15169Google LLC
9119--

Detected Technologies8

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1AC03B531E29225AA3A5B677C6142F3192774FF02C5045B7634BCA0A4DFA44FE05FA26F

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:I1bE/UBHerqZdSZUaAzGkWd/3E3cdS6EK9MHYiOTP9OXtDl0RmOKy/RyhOv57JC+:wuUBBZdypc6OcNFTP0Xieyv57Jz

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:41080:A4ghQmgFBIKmN5FQhwAkaCSiNWcEAyjQQMgEZCGKJNfgzAXBZIIIIqMhPogICAJACiYADg0ECAcQQYTQChgETW8ioQaJCcBp

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Scan History

Scan history not available

Unable to load historical scan data