ScanMalware.com

Security Scan Report: paypallogon.vg

Redirected to:
https://startpage.vg/?var2=paypallogon.vg
Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/3abe0d9f-f1e4-498a-a690-db584150b523Domain and IP registration (RDAP)/api/v1/rdap/3abe0d9f-f1e4-498a-a690-db584150b523How often this domain was scanned/api/v1/domain/stats/paypallogon.vgScan history for this domain/api/v1/domain/history/paypallogon.vg?limit=15
This website contacted 3 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main domain is paypallogon.vg.

Submitted URL: https://paypallogon.vg

Effective URL:
https://startpage.vg/?var2=paypallogon.vg
Redirected

AI Security Verdict

High Risk

Confidence: 76%

8
Risk Score

Brand-lookalike hostname (paypallogon.vg) redirecting to an unrelated domain that serves no content, while the site's own IP:port carries a multi-feed Lumma stealer malware indicator. Treat as phishing/malware infrastructure.

Risk Factors (3)
Content-malware (Lumma stealer) threat-intel indicator on the site's own IP address:port, corroborated by two independent feeds
Deceptive hostname impersonating a PayPal logon on a non-PayPal domain
Cross-domain redirect from a brand-lookalike hostname to an unrelated unranked domain
Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

Within the .vg country-code top-level domain, 'paypallogon.vg' is registered. Its registrable label 'paypallogon' stretches across 11 characters holding 4 vowels versus 7 consonants. It segments into 3 words: paypal, log, on. The median word length lands at 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://paypallogon.vg

Page Load Overview

3.49s
Total Load Time
2 KB
Total Size

Language Analysis

Primary Language

🏳️UNKNOWN
Code: unknown
Confidence:0%

Detection Details

0
Detector Agreement:0%

Website Classification

Primary Category

unknown0% confidence
Type: static
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
288.198.29.97Nuremberg, Bavaria, Germany
AS24940Hetzner Online GmbH
1159.69.186.9Falkenstein, Saxony, Germany
AS24940Hetzner Online GmbH
195.216.161.60Helsinki, Uusimaa, Finland
AS24940Hetzner Online GmbH
43--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1D7F0A2BC18E5882C42E6724BB93D26417850F2471405E00AF90CEA205FB4E8ACD7A2BE

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

12:j0pwTJeandBANTl5MU455RiEVOayNzpIVWBB/rBpGKxH6b:NYadBq4nQEVOakSVWr/r2Lb

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:589:QAQAAAAAgAAAAAAAQAAAQAAIgAAAAAAAABAIABAAAAAAAAAAAAAAAAAgAAAABAAAAQAAIAAAAIAIAAAAAAABABAAAIAAAIAA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:7fffffffffffffff
Perceptual Hash:870f0f0f0f0f0f0f
Difference Hash:8000000000000000
Wavelet Hash:70f0f0f0f0f0f0f0
Color Hash:#5cac53

Other Hashes

Crop Resistant:8000000000000000

Scan History

Scan history not available

Unable to load historical scan data