Security Scan Report: nhcylxx-ohrannikdocsohrannikdocsohrannikdocs-ohrannikdocs.click

Site favicon
Submitted: Completed: publiccompleted
This website contacted 7 IPs in 4 countries across 7 domains to perform 44 HTTP transactions. The main domain is nhcylxx-ohrannikdocsohrannikdocsohrannikdocs-ohrannikdocs.click and was registered 2 weeks ago.

Submitted URL: https://nhcylxx-ohrannikdocsohrannikdocsohrannikdocs-ohrannikdocs.click/products/diplom-chastnogo-ohrannika

AI Security Verdict

High Risk

Confidence: 78%

8
Risk Score

Page sells forged private-security-guard diplomas/certificates on a 4-day-old obfuscated domain with a 6-hop redirect chain. The service itself is illegal document fraud; do not submit personal data or pay.

Risk Factors (5)
Advertises sale of counterfeit/forged official certification documents (illegal service)
Very newly registered domain (4 days) on a .click TLD
Long cross-domain redirect chain (6 hops)
Obfuscated, repetitive keyword-stuffed hostname typical of throwaway fraud domains
Personal data collection used to push customers toward a paid illegal transaction over the phone
Domain age information unavailable

Details

Page Title

Купить диплом частного охранника образца 2026 года в России

Scan Type

public

Domain Name Analysis

Domain 'nhcylxx-ohrannikdocsohrannikdocsohrannikdocs-ohrannikdocs.click' uses the .click top-level domain with no subdomain. Count 57 characters in 'nhcylxx-ohrannikdocsohrannikdocsohrannikdocs-ohrannikdocs' holding 16 vowels versus 39 consonants; it also includes 2 hyphens. Segmentation suggests 19 words: nhc, y, lxx, oh, ran, nik, docs, oh, ran, nik, docs, oh, ran, nik, docs, oh, ran, nik, docs. Median word length is three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://nhcylxx-ohrannikdocsohrannikdocsohrannikdocs-ohrannikdocs.click/products/diplom-chastnogo-ohrannika

Page Load Overview

1.49s
Total Load Time
945 KB
Total Size

Language Analysis

Primary Language

🇷🇺Russian
Code: ru
Confidence:80%
Script:Cyrillic
Direction:ltr

Detection Details

HTML Lang Attribute:ru
Text Length:5,349 chars
Detector Agreement:80%

Website Classification

Primary Category

healthcare medical44% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

healthcare medical
44%
education learning
39%
corporate business
31%
documentation technical
28%
government public service
26%

Detected Features

OG: website

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
8145.63.129.127Frankfurt am Main, Hesse, Germany
AS211381Podaon SIA
65.101.71.73Yerevan, Yerevan, Armenia
AS201589edgeam LLC
687.250.250.119Yandex · CLOUDRussia
AS13238YANDEX LLC
6185.71.67.146Russia
AS43298Storm Networks LLC
687.250.251.119Yandex · CLOUDRussia
AS13238YANDEX LLC
677.88.21.119Yandex · CLOUDMoscow, Moscow, Russia
AS13238YANDEX LLC
694.131.94.24Kazakhstan
AS208795Cloud Services Kazakhstan LLP
447--

Detected Technologies3

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T10AF2961041E5246B1103E196ED603A0D7DA6917FFF1B5A2530AC3EBE7FD2C96892B32D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:9g428ey7EpIwedII5Wes32wMN6FmF/D0QlFyIbqvJR5wMNrPChW4nLxRXssKW:uOdIIU7i4Ql/qvpCh5NRcsKW

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:35898:F2CPjgVjaYFgQEY8I/RS2mADgBOJg4CQiCQEUFgECBssosQASdQhCuOEEgJDiySBQhTgAiAZiCqgPhkKxUAAwQDJeAT4pbHB

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0000ffffffffffff
Perceptual Hash:b057027e067734b7
Difference Hash:cd1810060e369eba
Wavelet Hash:0000cfc7c7cfc35f
Color Hash:#77862d

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data