Security Scan Report: trybackers.moonup.fun

Redirected to:
https://trybackers.airdlrop.live/
Site favicon
Submitted: Completed: publiccompleted
This website contacted 5 IPs in 1 country across 6 domains to perform 35 HTTP transactions. The main domain is moonup.fun and was registered 3 weeks ago.

Submitted URL: https://trybackers.moonup.fun/

Effective URL:
https://trybackers.airdlrop.live/
Redirected

AI Security Verdict

High Risk

Confidence: 72%

8
Risk Score

New, unranked crypto 'airdrop' site on a misspelled 'airdlrop.live' domain, reached via redirect, using a Connect-Wallet claim flow and obfuscated text. Classic fake-airdrop/wallet-drainer pattern - avoid connecting a wallet.

Risk Factors (5)
Cross-domain redirect from trybackers.moonup.fun to trybackers.airdlrop.live funnels users to a newly seen host
Fake-airdrop 'Connect Wallet' claim flow consistent with crypto drainer behavior
Deceptive, misspelled hostname mimicking the word 'airdrop'
Text obfuscated with zero-width/homoglyph characters to evade detection
Unranked external script host on a .cc domain plus a HIGH IDS alert for .cc DNS traffic
Domain age information unavailable

Details

Page Title

Backers | Airdrop

Scan Type

public

Domain Name Analysis

The domain 'trybackers.moonup.fun' uses the .fun top-level domain with subdomain 'trybackers'. The second-level label 'moonup' is 6 characters long with three vowels and 3 consonants. Word splitting yields two words: moon, up. Median word length comes out to 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://trybackers.moonup.fun/

Page Load Overview

1.68s
Total Load Time
901 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:1,449 chars
Detector Agreement:67%

Website Classification

Primary Category

finance banking47% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

finance banking
47%
cryptocurrency blockchain
40%
adult content
30%
government public service
30%
entertainment media
29%

Detected Features

OG: website

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
7188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
7142.251.110.95Google · CDNUnited States
AS15169Google LLC
7188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
7142.251.14.94Google · CDNUnited States
AS15169Google LLC
752.222.236.75Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
355--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T15E33D445F584543F3617A1FF8ACAAE4C712230275517EA09B2BC80CAFFC59738AB6958

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:syznzqyrYj5+Z5HyjZ/A46dct5wYKoukL5H:nzqmZ52ZhhXwmukL5H

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:50920:olFjAAHIdgiNADAS6Q1mUYCkoYEGghbCA0AGiJkmxBAdcahcSBQFh4MCEkCiwhSCUAARIkqYkASj7ggCkO0EETUgRZZTjCtA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:7f647c6c61191901
Perceptual Hash:82d28cedb49696e3
Difference Hash:f4c9c9c9d3297171
Wavelet Hash:ff057d6d61191909
Color Hash:#d2512d

Other Hashes

Crop Resistant:f4c9c9c9d3297173

Scan History

Scan history not available

Unable to load historical scan data