spa-salon.ru - URL scan, 23 Aug 2026
MalwareAnalyzer by Cyble scanned spa-salon.ru and returned a unknown verdict (score -12). The page resolved to 95.163.244.135 on Domain names registrar REG.RU, Ltd in RU. 1 domain and 1 IP were contacted. 4 malware samples communicate with this URL (Phishing). This is a point-in-time observation from 23 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -12) · Confidence 15%
- Scanned URL:
https://spa-salon.ru/ckfinder/userfiles/files/jelamowagoditezemewozu.pdf - Domain: spa-salon.ru · IP: 95.163.244.135 · AS197695 · RU
- Server: openresty
- HTTP status: 403
- TLS issuer: C=US, O=Let's Encrypt, CN=YR2 · valid to Nov 8 02: · subject CN=spa-salon.ru
- Scan tier: fast · observed 2026-08-23 00:11:41 UTC
Malware communicating with this URL (4)
These samples were observed contacting or being served from spa-salon.ru. Each links to its full analysis.
- Phishing - referenced ·
ffffcbbe08a4085a713a661ecb6bdbb7· first seen 2026-08-23 - Phishing - referenced ·
f01bca5e1b34614780875b9294f2f700· first seen 2026-08-21 - Phishing - referenced ·
a98a21ff8df7af3d61fdf4e32cf44dd8· first seen 2026-08-21 - Phishing - referenced ·
f087eb083074033b9c5f815c3611b5f2· first seen 2026-08-20
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
Contacted infrastructure
- 95.163.244.135 - AS197695 Domain names registrar REG.RU, Ltd (Russian Federation)
Observed indicators
- spa-salon.ru
- 95.163.244.135
- https://spa-salon.ru/ckfinder/userfiles/files/jelamowagoditezemewozu.pdf
Questions about spa-salon.ru
- Is spa-salon.ru safe?
- The scan of spa-salon.ru on 23 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with spa-salon.ru?
- 4 analysed samples communicate with this URL, including Phishing.
- How was spa-salon.ru checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of spa-salon.ru
Scanned on MalwareAnalyzer by Cyble · Open interactive scan