ScanMalware.com

Security Scan Report: nbrthende.site

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/433dc383-064c-4a2a-801c-f730b7634e87Domain and IP registration (RDAP)/api/v1/rdap/433dc383-064c-4a2a-801c-f730b7634e87How often this domain was scanned/api/v1/domain/stats/nbrthende.siteScan history for this domain/api/v1/domain/history/nbrthende.site?limit=15
This website contacted 1 IP in 1 country across 1 domain to perform 12 HTTP transactions. The main domain is nbrthende.site and was registered 3 months ago.

Submitted URL: https://nbrthende.site/case/?b=YTo0OntzOjU6ImxhYmVsIjtzOjU6IlNIQVJFIjtzOjM6InVzciI7aToxNTY7czo0OiJub3BkIjtzOjE0OiJyc3MyLnNheWxlci5hdCI7czoxOiJvIjtpOjIxNDU7fQ==

AI Security Verdict

High Risk

Confidence: 85%

8
Risk Score

Fake Coinbase 'you received 2.84567 BTC' notification on an unrelated domain, using a 24-hour deadline and a 'temporary password' lure. No real funds exist; treat as brand impersonation fraud.

Risk Factors (5)
Impersonation of Coinbase brand on a non-Coinbase domain
Fabricated cryptocurrency transfer notification with no verifiable blockchain or account evidence
Urgency and loss-framing language designed to force hasty action
Credential lure ('temporary password') setting up a later credential-harvesting step
Base64-encoded serialized tracking payload in the query string linking to an external host
Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

The domain 'nbrthende.site' uses the .site top-level domain with no subdomain. The second-level label 'nbrthende' is 9 characters long split between 2 vowels and 7 consonants. Word splitting yields four words: n, br, then, de. The median word length lands at two characters. No strong language cues emerged from the frequency lists.

Screenshot

‘C) coinbase YOU HAVE A NEW BITCOIN TRANSFER FROM COINBASE ! BTC Balance: 2.84567 A transfer of 2.84567 BTC Attention! 1 transaction was not completed successfully because you did not complete th...

Page Load Overview

1.78s
Total Load Time
1.5 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:50%
Script:Latin
Direction:ltr

Detection Details

Text Length:585 chars
Detector Agreement:100%

Website Classification

Primary Category

cryptocurrency blockchain78% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

cryptocurrency blockchain
78%
finance banking
51%
technology software
35%
adult content
29%
corporate
25%

Detected Features

OG: website

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
12185.135.83.132Russia
AS57494Adman LLC
121--

Detected Technologies4

Open-Graph-Protocolvwebsite
100%
Nginxv1.20.2
40%
HSTS
40%
Ant Design
30%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T14973281AE401385B417B40B976FF93183A3499508607805CBEBCC1D99BEFC67AA367ED

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:CZR2n1OHPmlb4yAEstKrRRp2uZ6UWdIZh9IJrqA:/PwxIZhqqA

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:75602:FVFwRdHIE0XCtmAgBAAQlBRTJVULyQATIUQJEQN+A6CEKAIB7QVEsAILrEDULOAhCCQQgfowIDriIozEkyPBwWXBQAgFoRAh

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:efc3c3c3c3ffffff
Perceptual Hash:f773898c3233994c
Difference Hash:4c120e4c0c160e0c
Wavelet Hash:e782c2c2c3c3c3e7
Color Hash:N/A

Other Hashes

Crop Resistant:4c120e4c0c160e0c,dcd0b0b070d09a48

Scan History

Scan history not available

Unable to load historical scan data