ScanMalware.com

Security Scan Report: fotoload.ru

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/e8303eda-31ab-43b3-9864-fc34b6662d1cDomain and IP registration (RDAP)/api/v1/rdap/e8303eda-31ab-43b3-9864-fc34b6662d1cHow often this domain was scanned/api/v1/domain/stats/fotoload.ruScan history for this domain/api/v1/domain/history/fotoload.ru?limit=15
This website contacted 14 IPs in 3 countries across 0 domains to perform 0 HTTP transactions. The main domain is fotoload.ru.

Submitted URL: https://fotoload.ru

AI Security Verdict

Low Risk

Confidence: 85%

3
Risk Score

Site hosts credential‑stealing login forms and is linked to a known malicious IP, indicating a high‑risk phishing operation.

Risk Factors (3)
Known malicious IP associated with the site
Credential collection form on an unranked domain
Highly obfuscated JavaScript
Safety Factors (3)
Self‑branding matches the domain (no impersonation)
No payment fields or external credential exfiltration observed
Verdict cited a credential/login form, but DOM analysis found no password field (real or disguised) or payment field, and no other hard signal — credential-phishing framing unsupported; risk adjusted from 8 to 3
Domain age information unavailable

Details

Page Title

Fotoload - это сообщество фотографов и творческих людей. Фотохостинг ruother network

Scan Type

public

Domain Name Analysis

The domain 'fotoload.ru' uses the Russian country-code top-level domain (.ru). Count 8 characters in 'fotoload' holding 4 vowels versus 4 consonants. Splitting it apart reveals two words: foto, load. Expect four characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://fotoload.ru

Page Load Overview

N/A
Total Load Time
N/A
Total Size

Language Analysis

Primary Language

🇷🇺Russian
Code: ru
Confidence:70%
Script:Cyrillic
Direction:ltr

Detection Details

Text Length:23,018 chars
Detector Agreement:100%

Website Classification

Primary Category

download file sharing36% confidence
Type: spa
Method: ml+structural

All Detected Categories

download file sharing
36%
forum
25%
social_media
20%

Detected Features

Login Form
Comments

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
077.88.44.55Moscow, Moscow, Russia
AS13238YANDEX LLC
0193.3.184.27Russia
AS50214QWARTA LLC
088.212.202.52Moscow, Moscow, Russia
AS39134Edinaya Set Limited Liability Company
087.250.251.119Russia
AS13238YANDEX LLC
0172.217.18.2Google · CDNUnited States
AS15169Google LLC
037.9.64.225Russia
AS13238YANDEX LLC
087.250.250.119Russia
AS13238YANDEX LLC
0142.251.141.99Google · CDNUnited States
AS15169Google LLC
0193.3.184.133Russia
AS50214QWARTA LLC
0104.18.40.68Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
014--

Detected Technologies1

PasswordField
100%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1F664D821B4F5C1731A57705DD965FA0AAB31260F8C46CE0CF7AC4DA4BF82BA5CE921C6

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:Kf0HTRqHbIIIIYpU1grE9L7hGE/CnZ4UPNFSFlkF6RFqbF02F7YFV1kZeQERUg6W:kkUWE9L7hGE/CnZ4UmkZ7kdxPRsDtCwK

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:333654:jSAERCjBDBSzMAHYulJDPAQIYWIyTR0TgiGriSESM6hmBDbFTAiJbDAmJQDICSAZ7CWQomAJIUIADIhQgAmIZlEC2DCEkhAC

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Scan History

Scan history not available

Unable to load historical scan data