Hi, Have you tried searching your moodle sql database for the page that students are getting redirected?
it looks like it was persistent xss attack and you should find some records related with this .ru site
