https://nevapotolok.ru/%D1%83%D1%81%D0%BB%D1%83%D0%B3%D0%B8/%D1%80%D0%B5%D0%BC%D0%BE%D0%BD%D1%82-%D0%BD%D0%B0%D1%82%D1%8F%D0%B
Original URL from the Raw Access log ...
It was de-obfuscated three times. The three pairs of scripts are basically identical,
but the URLs quoted at the end of the second of each script pair keep getting longer.
https://nevapotolok.ru/услуги/ремонт-натя - one decode ...
https://nevapotolok.ru/%D1%83%D1%81%D0%BB%D1%83%D0%B3%D0%B8/%D1%80%D0%B5%D0%BC%D0%BE%D0%BD%D1%82-%D0%BD%D0%B0%D1%82%D1%8F
https://nevapotolok.ru/ÑÑлÑги/ÑемонÑ-наÑÑ - another decode ...
https://nevapotolok.ru/%C3%91%C2%83%C3%91%C2%81%C3%90%C2%BB%C3%91%C2%83%C3%90%C2%B3%C3%90%C2%B8/%C3%91%C2%80%C3%90%C2%B5%C3%90%C2%BC%C3%90%C2%BE%C3%90%C2%BD%C3%91%C2%82-%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%82%C3%91%C2%8F
https://nevapotolok.ru/ÃÂÃÂûÃÂóø/ÃÂõüþýÃÂ-ýðÃÂà- a third decode ...
https://nevapotolok.ru/%C3%83%C2%91%C3%82%C2%83%C3%83%C2%91%C3%82%C2%81%C3%83%C2%90%C3%82%C2%BB%C3%83%C2%91%C3%82%C2%83%C3%83%C2%90%C3%82%C2%B3%C3%83%C2%90%C3%82%C2%B8/%C3%83%C2%91%C3%82%C2%80%C3%83%C2%90%C3%82%C2%B5%C3%83%C2%90%C3%82%C2%BC%C3%83%C2%90%C3%82%C2%BE%C3%83%C2%90%C3%82%C2%BD%C3%83%C2%91%C3%82%C2%82-%C3%83%C2%90%C3%82%C2%BD%C3%83%C2%90%C3%82%C2%B0%C3%83%C2%91%C3%82%C2%82%C3%83%C2%91%C3%82%C2%8F
Note: The obfuscated URL gets longer each time the index file is reloaded.