xn--h1apee0d.xn--p1ai - suspicious URL scan, 23 Aug 2026

MalwareAnalyzer by Cyble scanned xn--h1apee0d.xn--p1ai and returned a suspicious verdict (score 30), categorised as phishing. The page resolved to 62.181.54.86. 1 domain and 1 IP were contacted. 1 malware sample communicates with this URL. The request followed 1 redirect before landing. This is a point-in-time observation from 23 Aug 2026; the page may have changed since.

Scan result

• Verdict: suspicious (score 30) · Confidence 33%
• Scanned URL: http://nsovetnik.ru/files/folder/20150205uvar.png
• Domain: xn--h1apee0d.xn--p1ai · IP: 62.181.54.86
• Server: nginx/1.14.2
• Page title: 404 Not Found
• HTTP status: 404 · text/html; charset=UTF-8
• TLS issuer: C=US, O=Let's Encrypt, CN=YR2 · valid to Oct 22 06: · subject CN=xn--h1apee0d.xn--p1ai
• Scan tier: fast · observed 2026-08-23 23:37:31 UTC

Redirect chain

1. http://nsovetnik.ru/files/folder/20150205uvar.png
2. https://xn--h1apee0d.xn--p1ai/files/folder/20150205uvar.png

Malware communicating with this URL (1)

These samples were observed contacting or being served from xn--h1apee0d.xn--p1ai. Each links to its full analysis.

• 2904992f60c19434db0d82e233024c57d94d51a4d9ae0b42997ab3ad8017a2b7 - referenced · 2904992f60c19434db0d82e233024c57 · first seen 2026-08-23

Antivirus & YARA (0 of 48 engines)

No engine flagged this page's content.

Categories

• phishing

Why this verdict

• Homograph / mixed-script domain (IDN spoofing)

Detected technologies

• Nginx

Observed indicators

• xn--h1apee0d.xn--p1ai
• 62.181.54.86
• https://xn--h1apee0d.xn--p1ai/files/folder/20150205uvar.png

Questions about xn--h1apee0d.xn--p1ai

Is xn--h1apee0d.xn--p1ai safe?

No. MalwareAnalyzer scanned xn--h1apee0d.xn--p1ai on 23 Aug 2026 and returned a suspicious verdict with a score of 30 out of 100, categorised as phishing. Treat it as hostile until it is re-checked.

What malware is associated with xn--h1apee0d.xn--p1ai?

1 analysed samples communicate with this URL.

How was xn--h1apee0d.xn--p1ai checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of xn--h1apee0d.xn--p1ai

Scanned on MalwareAnalyzer by Cyble · Open interactive scan