`eco-sales[.]ru`

Recommended actionalert_onlyIOC typedomainVerified2026-08-01

Risk level

Suspicious

score 65 / 100

Why this verdict

Evidence and analysis

VerdictIQ AIGenerated from 20 deterministic signals

eco-sales[.]ru is classified as suspicious with a risk score of 65/100: ambiguous posture; signals suggest concern but lack convergent evidence. The recommended downstream action is alert_only.

The risk model observed 20 signals (including 5 core signals) across 4 taxonomy groups (HTTP Crawling, Threat Intelligence, DNS History, and others). The strongest indicators are SSL Hostname Mismatch, Flagged by Security Vendors, Untrusted Certificate Authority, plus 17 additional supporting signals. Each signal carries its own trigger evidence and direction; signal fusion drives the calibrated tier assignment.

Recommended response. Surface to analyst review or SIEM correlation. Evidence is strong enough to warrant attention but not strong enough to block without context. For active investigation, run POST /verdict with the indicator to confirm the verdict against the current state of the domain. VerdictIQ's scoring recomputes today's signals on every call.

Signal evidence

Top 10 of 20Showing all 20

SSL Hostname MismatchcoreHTTP CrawlingIt means the SSL/TLS certificate’s Common Name (CN) or Subject Alternative Name (SAN) does not match the accessed domain.
Flagged by Security VendorscoreThreat IntelligenceIt means that one or more commercial security vendors, including antivirus engines, sandboxes, or threat intelligence providers, have classified or reported the domain as malicious.
Untrusted Certificate AuthoritycoreHTTP CrawlingIt means that the SSL/TLS certificate presented by the domain was issued or signed by a Certificate Authority that is not included in the trusted CA store of major browsers or operating systems.
Listed in Malware SourcescoreThreat IntelligenceIt means that the domain has appeared in public or open-source malware intelligence feeds.
Critical SSL CA IssuecoreHTTP CrawlingIt means that the SSL/TLS certificate presented by the domain failed critical validation checks.
Newly-Activated DomainDNS HistoryIt indicates that the domain has recently become active and started responding to DNS queries after a period of inactivity or recent registration.
Recently Isolated DomainPopularity & BacklinkA domain whose harmonic centrality places it in the deep tail (very few distinct sources link to it) while PageRank is also in the mid-to-tail range.
Free-Issued SSL CertificateHTTP CrawlingIt indicates that the domain uses an SSL certificate issued by a free or automated Certificate Authority, such as Let's Encrypt.
Newly-Issued SSL CertificateHTTP CrawlingIt indicates that the SSL certificate associated with the domain has been newly created or issued.
Small IP Block AllocationDNS HistoryIt indicates that the IP block allocated to the ASN is unusually small.
Reputation Decay DomainPopularity & BacklinkIt indicates that the domain’s reputation, visibility, and traffic are steadily declining over time.
Inactive HTTP Service Detected (Base Domain)HTTP CrawlingIt indicates that the base domain’s web service (HTTP/HTTPS) is no longer responding or has gone offline.
Short-Term SSL Certificate ValidityHTTP CrawlingIt means the SSL/TLS certificate of the domain has an unusually short validity period, often lasting only days or weeks.
Weak Popularity DomainPopularity & BacklinkIt represents a domain with limited but detectable user traffic or DNS activity.
Country-Level IP Geolocation CentralizationDNS HistoryIt indicates that all currently active IP addresses of a domain are geographically concentrated in a single location scope, typically within one country.
Observed and Registered Geolocation ConsistencyDNS HistoryIt indicates that the observed geolocation of the IP matches its registered geolocation, suggesting a stable and expected geographic placement for the infrastructure at the time of observation.
Web Technology Stack DetectedHTTP CrawlingIt means that the domain uses one or more identifiable web technologies, such as CMS platforms (WordPress, Drupal), JavaScript frameworks (React, Angular, Vue), analytics tools, CDNs, or web servers.
Strict-Policy RIR RegionDNS HistoryIt indicates that the ASN is allocated by a regional internet registry known for strict allocation controls and strong abuse-handling processes, providing supportive safe context for the…
Current and Historical Geolocation AlignmentDNS HistoryIt indicates that the geolocation of the domain’s currently active IP addresses is consistent with the geolocations observed in its historical IP usage, suggesting continuity in infrastructure…
ASN Allocated Long Time AgoDNS HistoryIt means that the ASN was allocated many years ago and has a long operational history.

Read the full scoring methodology at /product/ioc-verdict or the canonical signal taxonomy at /signal-library.

Similar verdicts

Domains sharing signals with eco-sales[.]ru. Pattern similarity often indicates campaign reuse or shared infrastructure.

DomainVerdictScoreLast verifiedTop signal

f3322[.]orgSuspicious662026-08-01Centralized IP-Subdomain Infrastructure Detected allowandgo[.]comSuspicious652026-08-01Paid Public NS Usage Premium Provider bih[.]comSuspicious602026-08-01Large-Scale Enterprise IP Block dacewebsolutions[.]comSuspicious602026-08-01Low-Control General Hosting Network dragonair[.]xyzSuspicious682026-08-01Valid SSL Certificate Authentication

Query any domain, not just this one

POST /verdict returns the same signals, score and recommended action for any indicator you send, computed against today's data.

Run POST /verdict Browse the verdict gallery

Part of a curated wave, re-verified periodically; reports older than 90 days are de-indexed until re-verified. Dispute a verdict at reports@verdictiq.io, response within 5 business days. Trust & compliance →