ScanMalware.com

Security Scan Report: rss2.sayler.at

Redirected to:
https://121hiu.senes.at/stakings/
Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/3eb4832a-b0a6-4cb5-8e6e-6aa948ed3426Domain and IP registration (RDAP)/api/v1/rdap/3eb4832a-b0a6-4cb5-8e6e-6aa948ed3426How often this domain was scanned/api/v1/domain/stats/rss2.sayler.atScan history for this domain/api/v1/domain/history/rss2.sayler.at?limit=15
This website contacted 3 IPs in 2 countries across 4 domains to perform 31 HTTP transactions. The main domain is sayler.at and was registered 6 months ago.

Submitted URL: https://rss2.sayler.at/go/z2b4u2/y274x274

Effective URL:
https://121hiu.senes.at/stakings/
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Coinbase-branded fake staking page on 121hiu.senes.at using a fabricated $36,824 balance and expiry deadline to harvest emails; corroborated by two phishing feeds. Do not interact.

Risk Factors (5)
Brand impersonation of Coinbase on an unrelated, unranked domain
Multi-source corroborated phishing threat intelligence on the final domain and URL
Cross-domain redirect chain from a second phishing-flagged domain
Fabricated account balance and portfolio ID used as a credible-looking lure
Credential/contact harvesting form with deceptive 'claim your coins' purpose
Domain age information unavailable

Details

Page Title

Staking

Scan Type

public

Domain Name Analysis

Within the Austrian country-code top-level domain (.at), 'rss2.sayler.at' is registered; it also runs on subdomain 'rss2'. Its registrable label 'sayler' stretches across 6 characters with two vowels and 4 consonants. Segmentation suggests 2 words: say, ler. Median word length is 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://rss2.sayler.at/go/z2b4u2/y274x274

Page Load Overview

4.43s
Total Load Time
600 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:1,283 chars
Detector Agreement:100%

Website Classification

Primary Category

cryptocurrency blockchain82% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

cryptocurrency blockchain
82%
documentation technical
45%
technology software
36%
education learning
33%
adult content
31%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
112.26.124.139Stockholm, Stockholm County, Sweden
AS198550Node Host Limited
10104.26.2.143Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
10104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
313--

Detected Technologies2

Nginx
40%
Tailwind CSS
30%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T124A2D81A65E000BF6C5380E6F5D27A59B635A0C3DD2FC6A9B99F4200BFC7D6688D3348

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:sCWhL7+YDzR9mz5RCANiyEJAW5gL2vIFY:sCWhn+2R9a5YbHJAggL2vIFY

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:21914:A0AI4SiAggFJIgACjmQZ1CtwECkwIDKsnQOKANAaDABApRR4CAADhDZIUhAdpp7ABggcByAgwQIEEMBJAIwBkERAARxIM7pQ

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:bfe7e7e7e7e7e7ff
Perceptual Hash:b78c8c1e9d368c36
Difference Hash:708e4c4c4c4c4c0e
Wavelet Hash:1ee22222e2e2e2fe
Color Hash:#d279cb

Other Hashes

Crop Resistant:708e4c4c4c4c4c0e

Scan History

Scan history not available

Unable to load historical scan data