ScanMalware.com

Security Scan Report: northstarcouncil.com

Redirected to:
https://forsale.godaddy.com/forsale/northstarcouncil.com?utm_source=TD...
Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/56a3901e-2abc-4d83-bd1d-97a0b7894db4Domain and IP registration (RDAP)/api/v1/rdap/56a3901e-2abc-4d83-bd1d-97a0b7894db4How often this domain was scanned/api/v1/domain/stats/northstarcouncil.comScan history for this domain/api/v1/domain/history/northstarcouncil.com?limit=15
This website contacted 5 IPs in 3 countries across 4 domains to perform 44 HTTP transactions. The main domain is northstarcouncil.com and was registered 3 months ago.

Submitted URL: https://northstarcouncil.com

Effective URL:
https://forsale.godaddy.com/forsale/northstarcouncil.com?utm_source=TD...
Redirected

AI Security Verdict

Low Risk

Confidence: 75%

3
Risk Score

Rendered page is GoDaddy's legitimate domain-for-sale listing (no forms, no impersonation), but the entry domain northstarcouncil.com is flagged by multi-source threat intel as an evilginx phishing kit, driving the risk up.

Risk Factors (2)
Entry domain carries a multi-source corroborated evilginx (reverse-proxy phishing kit) threat-intelligence indicator
Entry domain is now parked/listed for sale, meaning control may change hands and the flagged reputation persists
Safety Factors (4)
Redirect terminates on forsale.godaddy.com, a long-established legitimate brand-owned site (Cisco Umbrella top 1M #82721)
Rendered page contains no login, password, or payment forms
No YARA JavaScript malware, no Suricata IDS alerts, no obfuscated JS or credential exfiltration
Verdict cited a credential/login form, but DOM analysis found no password field (real or disguised) or payment field, and no other hard signal — credential-phishing framing unsupported; risk adjusted from 7 to 3
Domain age information unavailable

Details

Page Title

northstarcouncil.com steht zum Verkauf: jetzt kaufen für 19.888,00 $ oder leasen | GoDaddy

Scan Type

public

Domain Name Analysis

The domain name 'northstarcouncil.com' uses the commercial generic top-level domain (.com) with no subdomain. The registrable portion 'northstarcouncil' spans 16 characters with five vowels and eleven consonants. Breaking it apart gives three words: north, star, council. Median word length comes out to 5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://northstarcouncil.com

Page Load Overview

3.44s
Total Load Time
70 KB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:de
Text Length:947 chars
Detector Agreement:100%

Website Classification

Primary Category

corporate70% confidence
Type: spa
Method: structural

All Detected Categories

corporate
70%

Detected Features

Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1213.248.169.48Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
876.223.54.146Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
823.217.48.12Akamai · CDNVienna, Vienna, Austria
AS16625Akamai Technologies, Inc.
823.207.210.143Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
823.207.210.148Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
445--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T17934E82BE32E8CBECE1536C428953917716B5129CE206759F7D98F3C6359AF8008BE17

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:07owB+mXux1XoT96/0l3hSdigz/Fd3GzQy+y4v+FtuFxiXX1G33fiHXFfZCUSFXF:HwMKux1XoTM0l3hWiOnoXFG0VfZCRsA

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:248336:YgRgCKRCEguI8BAKhUBUBlQIYzCKFgxhCAi/XgBpkaDBQiSy0cQUCQApUpMAMhQJGAyACa1ugkQpgBDAhSYGUeFhEAlBuEiw

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:000004fffbffffff
Perceptual Hash:921203ededfd9292
Difference Hash:53cccc282234326c
Wavelet Hash:00000400fbffffff
Color Hash:#5f3a78

Other Hashes

Crop Resistant:53cccc282234326c,23cdcceccccc2c4c

Scan History

Scan history not available

Unable to load historical scan data