ScanMalware.com

Security Scan Report: 193.180.209.78

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/20694593-ef87-46ad-88d6-c5bbd342d5a6Domain and IP registration (RDAP)/api/v1/rdap/20694593-ef87-46ad-88d6-c5bbd342d5a6How often this domain was scanned/api/v1/domain/stats/193.180.209.78Scan history for this domain/api/v1/domain/history/193.180.209.78?limit=15
This website contacted 3 IPs in 2 countries across 2 domains to perform 16 HTTP transactions. The main domain is 193.180.209.78.

Submitted URL: https://193.180.209.78:7443/

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

Live malware payload builder/C2 panel: staged ClickFix encoded PowerShell, macro/LNK/XLL droppers, DLL-sideload packages and VM-evasion, corroborated by 8 CRITICAL malware IDS alerts.

Risk Factors (6)
Staged ClickFix-style encoded PowerShell command with hidden window and IP-literal delivery
Eight CRITICAL IDS malware/phishing alerts tied to PowerShell execution
Malware payload builder: macro, LNK, XLL and DLL-sideload droppers
Anti-analysis VM Guard and sandbox-evasion toggle
Hosted on a bare IP address with no domain, serving executables and archives
Page text asserts 'authorized red team use only' as a cover for a live C2 agent dashboard
Domain age information unavailable

Details

Page Title

Sencillo RMM

Scan Type

public

Domain Name Analysis

Within an unknown top-level domain, '193.180.209.78:7443' is registered without a subdomain. Its registrable label '193.180.209.78' stretches across 14 characters split between 0 vowels and zero consonants, notching eleven digits. Splitting it apart reveals 4 words: 193, 180, 209, 78. Expect three characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

SENCILLO © DORISPALME © DESKTOP-WIN10 © DESKTOP-WINTI © KATHLROGE © Kayode © DESK-453REX6JIU © Pc © Ghepdhhe © PROFORCE © WINDOWS-30NM9M1 © ZJSXSBIA2949639 ADMIN, ADMIN, ADMIN, ADMIN,...

Page Load Overview

14.23s
Total Load Time
681 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:1,372 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software63% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
63%
documentation technical
45%
government public service
40%
download file sharing
37%
cryptocurrency blockchain
28%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
6193.180.209.78Nørre Åby, South Denmark, Denmark
AS44803Webdock.io ApS
5142.251.20.95Google · CDNUnited States
AS15169Google LLC
5142.251.13.94Google · CDNUnited States
AS15169Google LLC
163--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1CB13F779E932F0F6537FF0C2556A1F4A30D09803CE238658EA9824B44FCAD96FF26158

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:3BAQNMB0d+Hw48ALvQTJGXNZPASIRXseV59mhmjiqj7Z4FERJgJIFxN5YSxWJNHg:3+lDvqGXNZPALseV59UmjVZ42bMIFVYu

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:45270:GSAo8DTwBKAAIEGCARoaBABwUEELQAwBFAQIFXgBApQUxjyQCQGgyACCoELtpI8xcKxC1MWl+DNAZWBo4A1SAASaBh8RBEgA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ff80808088808080
Perceptual Hash:ffff80bd81a0a481
Difference Hash:062000281a200000
Wavelet Hash:ffc0c0c8ccc8c0c0
Color Hash:38007008000

Other Hashes

Crop Resistant:062000281a200000

Scan History

Scan history not available

Unable to load historical scan data