Security Scan: https://fnx.wf/

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/4e894e6c-7049-4b2d-b695-788d1d8f961c Domain and IP registration (RDAP)/api/v1/rdap/4e894e6c-7049-4b2d-b695-788d1d8f961cHow often this domain was scanned/api/v1/domain/stats/fnx.wf Scan history for this domain/api/v1/domain/history/fnx.wf?limit=15

This website contacted 1 IP in 1 country across 1 domain to perform 2 HTTP transactions. The main domain is fnx.wf and was registered 4 years 3 months ago.

Submitted URL: https://fnx.wf/

AI Security Verdict

High Risk

Confidence: 92%

Risk Score

fnx.wf is corroborated by two threat-intel feeds and a CRITICAL IDS alert as Raspberry Robin malware infrastructure; it now returns only sinkhole/EICAR plain text. Do not visit or resolve it.

Risk Factors (3)

Domain operates as (or operated as) Raspberry Robin malware command-and-control infrastructure

Critical network IDS malware detection tied to this exact domain

Serves raw plain-text EICAR/sinkhole content instead of any legitimate service

Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Favicon Hash

MMH3: 1206970201

MD5: 66945541f49e28a5579d7425a42f4b5c

Domain Name Analysis

Domain 'fnx.wf' uses the .wf country-code top-level domain while skipping any subdomain. Count 3 characters in 'fnx' containing zero vowels alongside three consonants. It segments into 2 words: f, nx. The median word length lands at 1.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

this is a sinkhole. X50! P%@AP[4\PZX54(P*) 7CC) 7}$EICAR- STANDARD -ANTIVIRUS-TEST-FILE! $H+H*

Page Load Overview

0.20s

Total Load Time

0 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:68%

Script:Latin

Direction:ltr

Detection Details

Text Length:88 chars

Detector Agreement:100%

Website Classification

Primary Category

documentation technical84% confidence

Type: static

Method: ml+structural

All Detected Categories

documentation technical

84%

healthcare medical

48%

cryptocurrency blockchain

39%

adult content

26%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
2	80.78.24.30	Sweden	AS39287Materialism s.r.l.
2	1	-	-

Detected Technologies1

HTTP/3

40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1F3D09775D55D881EAB3911B48E52B8A05E08826C88701E5479D0A0F4E406AA741E33F8

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6:qzxV/5VHHoB96D3ne1k9YoJnqjJuOgzskE8:kxV7HdBWoYdkL

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:1:0:824da9e72aa037bc2b0ec7ec3fec472f

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:1fffffffffffffff

Perceptual Hash:9c1e1e1e1e1e1e1e

Difference Hash:3000000000000000

Wavelet Hash:10f0f0f0f0f0f0f0

Color Hash:N/A

Other Hashes

Crop Resistant:3000000000000000

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: fnx.wf