ScanMalware.com

Security Scan Report: turbo-rs.ch

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/e937bac6-5f7f-40bc-b316-b99d167605ccDomain and IP registration (RDAP)/api/v1/rdap/e937bac6-5f7f-40bc-b316-b99d167605ccHow often this domain was scanned/api/v1/domain/stats/turbo-rs.chScan history for this domain/api/v1/domain/history/turbo-rs.ch?limit=15
This website contacted 12 IPs in 3 countries across 11 domains to perform 135 HTTP transactions. The main domain is turbo-rs.ch and was registered 11 months ago.

Submitted URL: https://turbo-rs.ch

AI Security Verdict

High Risk

Confidence: 72%

8
Risk Score

Legitimate-looking Swiss turbo-repair site, but network IDS flagged CRITICAL EtherHiding exfiltration malware and blockchain RPC C2 traffic — likely a compromised site. Avoid interaction until cleared.

Risk Factors (5)
CRITICAL IDS malware alerts for EtherHiding exfiltration
Blockchain RPC / smart-contract connections with no legitimate purpose on a turbo repair site
External script/reference to 'brows-check.codes'
ET DROP Spamhaus-listed traffic observed
Domain unranked in Cisco Umbrella (weak prior only)
Domain age information unavailable

Details

Page Title

turbo-rs.ch – Le spécialiste du turbocompresseur de haute précision

Scan Type

public

Domain Name Analysis

The domain 'turbo-rs.ch' uses the Swiss country-code top-level domain (.ch) without a subdomain. Its registrable label 'turbo-rs' stretches across 8 characters holding two vowels versus five consonants; it also includes 1 hyphen. Splitting it apart reveals 2 words: turbo, rs. Expect 3.5 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://turbo-rs.ch

Page Load Overview

5.27s
Total Load Time
4.2 MB
Total Size

Language Analysis

Primary Language

🇫🇷French
Code: fr
Confidence:47%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:pl-PL
Text Length:12,243 chars
Detector Agreement:75%
Language mismatch: Declared as pl-PL but detected as fr

Website Classification

Primary Category

documentation technical99% confidence
Type: spa
Method: ml+structural

All Detected Categories

documentation technical
99%
travel tourism
96%
corporate business
89%
government public service
83%
technology software
82%

Detected Features

Search
Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
14188.210.222.87Poland
AS50599Dataspace P.s.a.
11142.251.127.95Google · CDNUnited States
AS15169Google LLC
11142.250.154.139Google · CDNUnited States
AS15169Google LLC
11192.178.183.94Google · CDNUnited States
AS15169Google LLC
11142.251.14.94Google · CDNUnited States
AS15169Google LLC
11188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
11142.250.154.100Google · CDNUnited States
AS15169Google LLC
11142.251.20.94Google · CDNUnited States
AS15169Google LLC
11188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
11172.217.113.4Google · CDNUnited States
AS15169Google LLC
13512--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T165141921755A583A216F53CFE117770C60ABD7FAE68096F4F5FA002892F5CE472C72A8

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:oR8IErBfBwibVp5uhC0sSFs14mTnugxs3GpVIAtTgxmhHPG16rtVaNFa77:tIUpwibVpcFsus14mcNFu

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:195973:UINVAbAHfQXACWOMggEooAM0cIwQXwOAIYMEcAgAGlEBKoWCFUQgBwQpgGCAwMAItABY6hGQMZAGbgpwB9hKgAPjGAQDAMIE

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Scan History

Scan history not available

Unable to load historical scan data