ScanMalware.com

Security Scan Report: elster.pages.dev

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/05a8fafa-2910-414d-a32d-fb4a2205da9bDomain and IP registration (RDAP)/api/v1/rdap/05a8fafa-2910-414d-a32d-fb4a2205da9bHow often this domain was scanned/api/v1/domain/stats/elster.pages.devScan history for this domain/api/v1/domain/history/elster.pages.dev?limit=15
This website contacted 2 IPs in 1 country across 1 domain to perform 29 HTTP transactions. The main domain is pages.dev and was registered 6 years ago.

Submitted URL: https://elster.pages.dev

AI Security Verdict

Confirmed Scam

Confidence: 95%

10
Risk Score

Fake ELSTER tax portal on a pages.dev subdomain that impersonates the German tax office and sends personal details plus IBAN to the unrelated domain online-finanzministerium.com.

Risk Factors (5)
Impersonation of a different entity's brand (ELSTER tax portal) on a non-official domain
Personal and financial data (including IBAN) exfiltrated to an external, unrelated domain
Cross-origin form action to online-finanzministerium.com/Report.php
Hosted on an instant/free pages.dev subdomain with unknown real age
Page text attempts to steer automated review ('only IBAN, no card number')
Domain age information unavailable

Details

Page Title

ELSTER - Überprüfen Sie jetzt Ihre Daten

Scan Type

public

Domain Name Analysis

You're looking at domain 'elster.pages.dev' on the developer-focused generic top-level domain (.dev) with subdomain 'elster'. Its registrable label 'pages' stretches across 5 characters with 2 vowels and three consonants. Splitting it apart reveals one word: pages. Average segment length settles at five characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://elster.pages.dev

Page Load Overview

1.60s
Total Load Time
856 KB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:de
Text Length:4,686 chars
Detector Agreement:100%

Website Classification

Primary Category

finance banking75% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

finance banking
75%
adult content
56%
corporate business
55%
government public service
51%
blog personal website
31%

Detected Features

Search

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
15188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
14188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
292--

Detected Technologies4

HTTP/3
40%
Cloudflare Bot Management
40%
Cloudflare
40%
JSZip
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1C124C42080F78676127EB485E1E457157B97D33383C9ABFA326C42798BC7CAA4C5B19C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:PnCa6SBq4WhmHMUQTGhYF7cntsq7/msUBKddhzFcV7+esGgEXQEI1BF/WpnKlpk6:PJEmjLKIUuzFcV7+esGg2DQb1

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:225506:JF4IhY88CzUlx5gAAENBCiATcYj0BpIpkGiFIKnAU0QCqCggBjloChPKIcoyIGgLYwhOQDHHxFi0Fg5feBYoAochiQCAAhVC

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:3a8f0387c3c3c7c3
Perceptual Hash:b55fcbcac0cc6461
Difference Hash:625e16160e0e161e
Wavelet Hash:3a8f8383c3c3c7c3
Color Hash:#d22d9b

Other Hashes

Crop Resistant:625e16160e0e161e

Scan History

Scan history not available

Unable to load historical scan data