ScanMalware.com

Security Scan Report: bitrcfill.com

Site favicon
Submitted: Completed: publiccompleted

AI Security Verdict

High Risk

Confidence: 85%

8
Risk Score

Typosquat of Bitrefill (bitrcfill.com) registered ≤1 day ago, unranked, serving the brand's branding and fetching Cloudflare-tunnel and unranked hosts. Impersonation, not the real Bitrefill.

Risk Factors (5)
Typosquatted domain impersonating the Bitrefill crypto gift-card brand
Brand impersonation of a different entity on a non-official domain
Domain ≤1 day old and unranked (Cisco Umbrella)
Page-script fetches to unranked third-party hosts, including Cloudflare tunnel endpoints commonly abused by phishing kits
HIGH-severity network IDS alerts (Spamhaus DROP, Cloudflare tunnel abuse)
Domain age information unavailable

Details

Page Title

Bitrefill (Germany) - Buy Gift Cards, eSIM & Airtime with Bitcoin or Crypto - Bitrefill

Scan Type

public

Domain Name Analysis

You're looking at domain 'bitrcfill.com' on the commercial generic top-level domain (.com) without a subdomain. Count 9 characters in 'bitrcfill' holding two vowels versus 7 consonants. Word splitting yields 3 words: bit, rc, fill. Average segment length settles at three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://bitrcfill.com/?to=bing

Page Load Overview

0.56s
Total Load Time
2.3 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:87 chars
Detector Agreement:100%

Website Classification

Primary Category

e-commerce shopping76% confidence
Type: static
Method: ml+structural

All Detected Categories

e-commerce shopping
76%
cryptocurrency blockchain
68%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
4862.60.226.39Frankfurt am Main, Hesse, Germany
AS214351Femo It Solutions Limited
40104.20.44.133Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
40104.16.231.132Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
40172.66.175.107Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
40104.16.230.132Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4085.137.251.205Amsterdam, North Holland, Netherlands
AS57043Hostkey B.v.
40172.66.166.164Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
403.41.202.170Aws · CLOUDAshburn, Virginia, United States
AS14618Amazon.com, Inc.
40104.20.17.167Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
403.41.202.154Aws · CLOUDAshburn, Virginia, United States
AS14618Amazon.com, Inc.
40810--

Detected Technologies2

Nginxv1.30.5
40%
C3.js
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T19EB1C5FF59C660100A72A13CE12FD108B89389539AA5FD03790D55281FA897E6CB29DD

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

96:oAIGslRXJjfWq5bO9I7nkx9ohCUJvkY8k0VmMEwFKITNdqGl/:oAIGslRXJ1Za9oE2Ik0VVEgKQl

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:5363:AgACIEAEigAADMBlBBBCAAQIMAjQCAAAyQCAFo6IAISAQCSAgYYg4QCEAAiIgABdAUAgJARCQCQwBAUAEhQkUBCgyxEkpAAI

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ff9989fbb9b9ff27
Perceptual Hash:ab3896c2c7a43f1a
Difference Hash:623333366363964d
Wavelet Hash:9b9989bbb9b94301
Color Hash:#783a69

Other Hashes

Crop Resistant:623333366363964d,4124919aced12441

Scan History

Scan history not available

Unable to load historical scan data