The scan of m-s-g.ru on 13 Aug 2026 reached no verdict either way (score 16). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with m-s-g.ru?

2 analysed samples communicate with this URL, including Phishing.

How was m-s-g.ru checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

m-s-g.ru - URL scan, 13 Aug 2026

MalwareAnalyzer by Cyble scanned m-s-g.ru and returned a unknown verdict (score 16), categorised as credential-harvest. The page resolved to 77.222.62.198 on SpaceWeb in RU. 5 domains and 1 IP were contacted, over 10 HTTP requests. 2 malware samples communicate with this URL (Phishing). The request followed 1 redirect before landing. This is a point-in-time observation from 13 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score 16) · Confidence 22%
Scanned URL: http://m-s-g.ru/userfiles/files/34814212467.pdf
Domain: m-s-g.ru · IP: 77.222.62.198 · AS44112 · RU
Server: nginx/1.31.2
Page title: �� -��.
HTTP status: 200 · text/html
HTTP requests captured: 10
Scan tier: fast · observed 2026-08-13 10:55:41 UTC

Redirect chain

http://m-s-g.ru/userfiles/files/34814212467.pdf
http://m-s-g.ru/

Malware communicating with this URL (2)

These samples were observed contacting or being served from m-s-g.ru. Each links to its full analysis.

Phishing - referenced · 1e08ca620c7029e42d30175bcd2bb5e8 · first seen 2026-08-13
Phishing - referenced · fc4bf20ca838e0ceb844e9989ff3152b · first seen 2026-08-12

Antivirus & YARA (0 of 44 engines)

No engine flagged this page's content.

Why this verdict

Credential-harvesting form
Served over plaintext HTTP

Detected technologies

Nginx
PHP
jQuery
Bootstrap

Contacted infrastructure

77.222.62.198 - AS44112 SpaceWeb (Russian Federation)

Observed indicators

m-s-g.ru
allfont.ru
code.jquery.com
www.google.com
mc.yandex.ru
77.222.62.198
http://m-s-g.ru/
http://m-s-g.ru/swtest.ru/favicon.ico
http://m-s-g.ru/main.css
http://m-s-g.ru/print.css
http://m-s-g.ru/bootstrap/css/bootstrap.min.css
http://m-s-g.ru/bootstrap/css/font-awesome.min.css
http://m-s-g.ru/assets/jquery/owl-carousel/owl.carousel.css
http://m-s-g.ru/assets/css/style.cp1251.css
http://m-s-g.ru/assets/jquery/animate/animate.css
http://m-s-g.ru/assets/jquery/photobox/photobox.css
http://m-s-g.ru/assets/jquery/photobox/photobox.ie.css
http://allfont.ru/allfont.css?fonts=roboto-bold
http://allfont.ru/allfont.css?fonts=roboto-regular
http://code.jquery.com/jquery-1.12.4.min.js

Other scans of m-s-g.ru (4)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

24 Aug 2026 - unknown
13 Aug 2026 - unknown
13 Aug 2026 - unknown
12 Aug 2026 - unknown

Questions about m-s-g.ru

Is m-s-g.ru safe?: The scan of m-s-g.ru on 13 Aug 2026 reached no verdict either way (score 16). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with m-s-g.ru?: 2 analysed samples communicate with this URL, including Phishing.
How was m-s-g.ru checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of m-s-g.ru

Scanned on MalwareAnalyzer by Cyble · Open interactive scan