Security Scan Report: www.trainsim.ru

Site favicon
Submitted: Completed: publiccompleted
This website contacted 30 IPs in 2 countries across 22 domains to perform 79 HTTP transactions. The main domain is trainsim.ru and was registered 24 years ago.

Submitted URL: https://www.trainsim.ru

AI Security Verdict

Moderate Risk

Confidence: 55%

4
Risk Score

Long-established Russian train-simulator forum using its own brand and same-origin forum login. No impersonation, exfiltration or malware, but HIGH IDS alerts for obfuscated third-party JavaScript warrant caution.

Risk Factors (3)
HIGH IDS signatures for obfuscated JavaScript (twice) — likely from third-party ad/tracking scripts but unresolved
11 redirects with 6 cross-domain hops
Domain absent from Cisco Umbrella top-1M (weak prior only)
Safety Factors (5)
Established 24-year-old domain with long public history as a railway-simulation community
Self-branding confirmed: title/meta match the domain, no impersonation of another brand
Login form is the site's own same-origin forum authentication, no disguised password fields, no payment capture
No credential exfiltration and no cross-origin JS network targets observed
No Indicators of Compromise, YARA malware, or Safe Browsing hits
Domain age information unavailable

Details

Page Title

Новости - ЖД Симуляторы. ЖД Форум. Дополнения для Microsoft Train Simulator, Trainz, RTrainSim, OpenRails, Rail Simulator, RailWorks

Scan Type

public

Domain Name Analysis

Within the Russian country-code top-level domain (.ru), 'www.trainsim.ru' is registered with subdomain 'www'. The registrable portion 'trainsim' spans 8 characters with 3 vowels and five consonants. Word splitting yields two words: trains, im. Median word length is four characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://www.trainsim.ru

Page Load Overview

2.80s
Total Load Time
921 KB
Total Size

Language Analysis

Primary Language

🇷🇺Russian
Code: ru
Confidence:80%
Script:Cyrillic
Direction:ltr

Detection Details

HTML Lang Attribute:ru
Text Length:2,282 chars
Detector Agreement:33%

Website Classification

Primary Category

forum community discussion29% confidence
Type: spa
Method: ml+structural

All Detected Categories

forum community discussion
29%

Detected Features

Login Form
Search

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
21104.21.1.25Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
291.226.30.3Moscow, Moscow, Russia
AS8342JSC RTComm.RU
2188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
294.139.255.28Asbest, Sverdlovsk Oblast, Russia
AS208677Cloud.ru
2142.250.154.138Google · CDNUnited States
AS15169Google LLC
287.250.250.90Yandex · CLOUDRussia
AS13238YANDEX LLC
2142.251.110.139Google · CDNUnited States
AS15169Google LLC
2193.3.184.27Russia
AS50214QWARTA LLC
290.156.233.120Russia
AS47764LLC VK
2142.251.14.97Google · CDNUnited States
AS15169Google LLC
7930--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1F51308119286202F5022A2FCF570FE8CA6D7743BDB528554FD6EF8B6AFC0891582677C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:6QxL8GT1WLYZ68Zfy9DbmFb1fWDUT3Mx/r:RQUuYZ68ZqDbmFb1fKg3Mx/r

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:41899:TEUroIAYRAEkDaASagSEnKaRHihXgECDVCIENMMPy1gGQQFABxEoSMYAgeiAEgAgYtBEQQQBIB2rUMCDP8ACVBsgNlwICLlR

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00000061e3e38000
Perceptual Hash:e01e1fe1a01fff80
Difference Hash:8181219393931085
Wavelet Hash:01c041e3ffffe301
Color Hash:#bfb240

Scan History

Scan history not available

Unable to load historical scan data