Security Scan Report: heygen.net.ru

Site favicon
Submitted: Completed: publiccompleted
This website contacted 4 IPs in 1 country across 3 domains to perform 31 HTTP transactions. The main domain is net.ru and was registered 29 years ago.

Submitted URL: https://heygen.net.ru/

AI Security Verdict

Moderate Risk

Confidence: 74%

5
Risk Score

A Russian-language clone presenting itself as the HeyGen AI video service on the non-official heygen.net.ru domain, complete with a hidden 13-domain SEO link farm and a 6-hop redirect chain. No credential forms were found, but it is brand impersonation and should be avoided.

Risk Factors (5)
Impersonation of the HeyGen brand on a non-official third-level domain
Hidden link block pointing to 13 unrelated clone/doorway domains
Excessive cross-domain redirect chain (6 hops)
Unranked domain while presenting as an established AI product
No ownership, company, or legal disclosure on the page
Safety Factors (6)
No credential, login, or payment forms detected (0 forms, 0 password fields, 0 payment fields)
No threat-intelligence Indicators of Compromise matched
No YARA malware patterns or IDS alerts
No cross-origin credential exfiltration detected
Domain registration record is very old (1997), though this reflects the shared net.ru zone rather than this specific host's activity
Established domain (10691 days old) with no strong malicious indicators — risk clamped from 7 to 5
Domain age information unavailable

Details

Page Title

HeyGen - нейросеть для создания видео с ИИ

Scan Type

public

Domain Name Analysis

The domain name 'heygen.net.ru' uses the Russian country-code top-level domain (.ru), featuring subdomain 'heygen'. Count 3 characters in 'net' with one vowel and two consonants. Breaking it apart gives one word: net. The median word length lands at 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://heygen.net.ru/

Page Load Overview

1.27s
Total Load Time
781 KB
Total Size

Language Analysis

Primary Language

🇷🇺Russian
Code: ru
Confidence:80%
Script:Cyrillic
Direction:ltr

Detection Details

HTML Lang Attribute:ru
Text Length:4,410 chars
Detector Agreement:100%

Website Classification

Primary Category

education learning98% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

education learning
98%
government public service
96%
social media network
96%
corporate business
92%
technology software
84%

Detected Features

OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
10153.76.163.101Russia
AS29182JSC IOT
787.250.250.119Yandex · CLOUDRussia
AS13238YANDEX LLC
787.250.251.119Yandex · CLOUDRussia
AS13238YANDEX LLC
777.88.21.119Yandex · CLOUDMoscow, Moscow, Russia
AS13238YANDEX LLC
314--

Detected Technologies3

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1A4F2787391A5207F0213B6CEF411B708A1B741BFDD5B5A6573BC0DAD2BE2C60DA0A51E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:b3ONZo0YSjfj0SRwyT8pLavZEIXOaFqFN0LgOcG1syAQ:L46Kj0kwygpLOEIXOqTAQ

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:35672:FmBcDJIBQEBTiJYiBEBxWggjwoJgAmgBGJALQYXAk5IggjZIMgAhM6RUVSAFURyoKgAsAQZaIizEsQggI4iAp1UmTAiiyrCA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:fff39191f1b1ffff
Perceptual Hash:ee6c919368996d68
Difference Hash:5327232327635803
Wavelet Hash:a99181818191ffff
Color Hash:#61d22d

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data