ScanMalware.com

Security Scan Report: buildwithmercor.site

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/31a91228-fb4e-4147-840f-f15e5ef3d6f9Domain and IP registration (RDAP)/api/v1/rdap/31a91228-fb4e-4147-840f-f15e5ef3d6f9How often this domain was scanned/api/v1/domain/stats/buildwithmercor.siteScan history for this domain/api/v1/domain/history/buildwithmercor.site?limit=15
This website contacted 1 IP in 1 country across 1 domain to perform 8 HTTP transactions. The main domain is buildwithmercor.site and was registered 2 weeks ago.

Submitted URL: https://buildwithmercor.site/

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

Confirmed malicious fake Mercor recruitment page using a referral-code gate to deliver a ClickFix command that installs the OverLord stealer. Do not enter codes or run any terminal commands.

Risk Factors (5)
Known malicious recruitment/ClickFix kit identified by two independent detections (kit roster + hunting rule)
Brand impersonation of Mercor on a lookalike domain with no affiliation
Referral-code gate followed by instructions to run commands in a local terminal — stealer installation
HIGH-severity IDS alert for PowerShell stager traffic
Page text attempts to legitimise itself ('inspired by work.mercor.com', 'Demo content until authorized') while soliciting job applicants
Domain age information unavailable

Details

Page Title

Mercor | Senior Blockchain Experts

Scan Type

public

Domain Name Analysis

You're looking at domain 'buildwithmercor.site' on the .site top-level domain with no subdomain. The registrable portion 'buildwithmercor' spans 15 characters holding five vowels versus 10 consonants. Splitting it apart reveals four words: build, with, mer, cor. Expect 3.5 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

MM MERCOR Mercor is organizing human intelligence to power blockchain Al training. Ethereum Al Evaluation > $i20fhr - Remote - Flexible DeFi Al Training > $110/hr - Remote - Part-time Smart Contr...

Page Load Overview

4.76s
Total Load Time
91 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:2,403 chars
Detector Agreement:100%

Website Classification

Primary Category

cryptocurrency blockchain80% confidence
Type: static
Method: ml+structural

All Detected Categories

cryptocurrency blockchain
80%
technology software
53%
documentation technical
50%
cryptocurrency
22%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
8193.160.32.243Nuremberg, Bavaria, Germany
AS206216Advin Services LLC
81--

Detected Technologies2

Ubuntu
40%
Nginxv1.28.3
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1DD522E75A0F32873C1CB82F7466E6736BEE49403C619514073FD6BAA4FDAD02E95390A

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

96:n4rBsuygL+Ksovc4IG1IKN17+GNtxSOCMnmaffdoomF/04HaqFqGKI1B:49h8xRuxzhSOPnmcfdwM4HZcBy

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:13633:ABY5JOCEoNgJAoEYAE0QIAZDYGAGL4FtJADFCB7oQGjiCGzWIhDwUIELCFQBrdsFQgC0dARQFQAlckjBCQXgQ0RCMSTaIEAG

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:f9fd191919ffdfcf
Perceptual Hash:9f4be0c31f38c329
Difference Hash:2b01733373403018
Wavelet Hash:98f8090919ff8f87
Color Hash:07001000038

Other Hashes

Crop Resistant:2b01733373403018

Scan History

Scan history not available

Unable to load historical scan data