ScanMalware.com

Security Scan Report: orbitakirov.ru

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/91e1dd7b-900a-45e9-820c-10980e8f3877Domain and IP registration (RDAP)/api/v1/rdap/91e1dd7b-900a-45e9-820c-10980e8f3877How often this domain was scanned/api/v1/domain/stats/orbitakirov.ruScan history for this domain/api/v1/domain/history/orbitakirov.ru?limit=15
This website contacted 19 IPs in 3 countries across 13 domains to perform 73 HTTP transactions. The main domain is orbitakirov.ru and was registered 10 years ago.

Submitted URL: https://orbitakirov.ru

AI Security Verdict

High Risk

Confidence: 93%

9
Risk Score

Legitimate polymer company's site appears compromised: an injected ClickFix/EtherHiding loader pulls a fake 'Human Verification' overlay via a Polygon smart contract, per CRITICAL YARA and IDS malware hits. Do not follow its instructions.

Risk Factors (5)
Injected ClickFix/EtherHiding loader on a page whose visible content is unrelated to it
Blockchain smart-contract based payload retrieval (evasion of static blocklists)
CRITICAL IDS malware alerts for EtherHiding exfiltration
Obfuscated JavaScript concealing known-attacker RPC hosts
Third-party script/feed domain (id-verfied.boats) flagged as IClickFix infrastructure
Domain age information unavailable

Details

Page Title

Главная - Орбита

Scan Type

public

Domain Name Analysis

The domain 'orbitakirov.ru' uses the Russian country-code top-level domain (.ru) without a subdomain. Its registrable label 'orbitakirov' stretches across 11 characters containing five vowels alongside 6 consonants. It segments into three words: orbit, a, kirov. Average segment length settles at five characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://orbitakirov.ru

Page Load Overview

5.12s
Total Load Time
1.8 MB
Total Size

Language Analysis

Primary Language

🇷🇺Russian
Code: ru
Confidence:80%
Script:Cyrillic
Direction:ltr

Detection Details

HTML Lang Attribute:ru-RU
Text Length:1,624 chars
Detector Agreement:100%

Website Classification

Primary Category

corporate50% confidence
Type: spa
Method: structural

All Detected Categories

corporate
50%
news/blog
40%

Detected Features

Articles
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1946.254.21.116Moscow, Moscow, Russia
AS210079EuroByte LLC
3192.178.183.95Google · CDNUnited States
AS15169Google LLC
3188.114.96.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3142.251.20.94Google · CDNUnited States
AS15169Google LLC
3104.20.38.203Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3192.178.183.139Google · CDNUnited States
AS15169Google LLC
387.250.250.119Yandex · CLOUDRussia
AS13238YANDEX LLC
3172.67.70.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3142.251.14.97Google · CDNUnited States
AS15169Google LLC
377.88.21.119Yandex · CLOUDMoscow, Moscow, Russia
AS13238YANDEX LLC
7319--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1AC3395730D59A83B124391C490263F0B7BE2952BDF066958B7EC45EEFFC6EC58862325

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:X5kB3Y3nuatrVLUX80ExMR7ftTfVyXlRyxOSyOkukuLAPUTGXa1wUaZq7O19Cb:XGBX80D758XexKOkHbPUTGXaqUr

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:54077:3AihoEJAAIE9es1QAIgWNAAFMeQQpp8JEI7QCTVAVQ+HFeEDEQcRg6CnEYNKnGI45IQkIwKdobwQQEEFAOBAIaSapRQQBOgA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Scan History

Scan history not available

Unable to load historical scan data