Security Scan Report: budgetforge.ai

Site favicon
Submitted: Completed: publiccompleted

AI Security Verdict

High Risk

Confidence: 78%

7
Risk Score

Page claims to be a free offline budgeting app but a HIGH-severity YARA rule flags a fake app-installer ping kit and its download JS posts to claritycut.ai — avoid downloading the installer.

Risk Factors (3)
HIGH-severity YARA detection of a fake app-installer registration ping kit
Download button/JS exfiltrates click/registration data to an unrelated third-party domain (claritycut.ai) with a hardcoded auth key
Solicits download and execution of an unverified Windows .exe installer
Domain age information unavailable

Details

Page Title

BudgetForge AI: Free Offline Budgeting App for Windows 10/11

Scan Type

public

Domain Name Analysis

The domain name 'budgetforge.ai' uses the Anguillan country-code top-level domain (.ai) without a subdomain. The registrable portion 'budgetforge' spans 11 characters containing four vowels alongside seven consonants. Segmentation suggests 2 words: budget, forge. Median word length is 5.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://budgetforge.ai/

Page Load Overview

2.79s
Total Load Time
1.3 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:10,113 chars
Detector Agreement:80%

Website Classification

Primary Category

technology software56% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

technology software
56%
finance banking
42%
corporate
35%
documentation technical
26%

Detected Features

OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
8188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2142.251.14.95Google · CDNUnited States
AS15169Google LLC
2142.251.14.97Google · CDNUnited States
AS15169Google LLC
2192.178.183.94Google · CDNUnited States
AS15169Google LLC
2216.239.32.36Google · CDNUnited States
AS15169Google LLC
2188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2216.239.34.36Google · CDNUnited States
AS15169Google LLC
2142.251.127.157Google · CDNUnited States
AS15169Google LLC
2142.251.14.94Google · CDNUnited States
AS15169Google LLC
249--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1DD239617A3A8183D712303CAE7AA337E52B66143E20D2514B83E0679AF91DDDE9375C9

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:oU9jgUNJDTSGDnpvbdRhXrCj4cyPArTJ5SbDQntfZfHvjdvbuEEANG3XRoH:nJBDpdPKIPArTJS0tfZTdYRW

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:47620:SAiAhAQAAcAo2ggKYcEhAjNAJhTAxKiGKQERUDR0agkLTaNVAgDh8hYEwCTFumhieEi0ND2kJIARCAEIQALAUbABEMPCQKTy

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:b19c8f8f8b9bffff
Perceptual Hash:bc1cc3436bc33c3c
Difference Hash:6b34353b37370a12
Wavelet Hash:1090858b8393f7ff
Color Hash:#931f91

Other Hashes

Crop Resistant:6b34353b37370a12

Scan History

Scan history not available

Unable to load historical scan data