ScanMalware.com

Security Scan Report: elster.pages.dev

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/58c52cb7-f336-4311-a7b6-a6492d477dddDomain and IP registration (RDAP)/api/v1/rdap/58c52cb7-f336-4311-a7b6-a6492d477dddHow often this domain was scanned/api/v1/domain/stats/elster.pages.devScan history for this domain/api/v1/domain/history/elster.pages.dev?limit=15
This website contacted 2 IPs in 1 country across 1 domain to perform 29 HTTP transactions. The main domain is pages.dev and was registered 6 years ago.

Submitted URL: https://elster.pages.dev

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Phishing clone of Germany's ELSTER tax portal on elster.pages.dev that posts victims' identity and IBAN data to online-finanzministerium.com; flagged by Safe Browsing for social engineering.

Risk Factors (5)
Brand impersonation of a government tax portal (ELSTER) on a non-official host
Cross-origin form action exfiltrating identity and IBAN data to online-finanzministerium.com
Google Safe Browsing Social Engineering detection
Anonymous Cloudflare Pages subdomain with unverifiable creation date behind the shared apex
Cloned ELSTER portal UI (Authenticator handoff notice, certificate/search sidebar, tax-declaration navigation) with broken/translation-placeholder elements
Domain age information unavailable

Details

Page Title

ELSTER - Überprüfen Sie jetzt Ihre Daten

Scan Type

public

Domain Name Analysis

You're looking at domain 'elster.pages.dev' on the developer-focused generic top-level domain (.dev) with subdomain 'elster'. Count 5 characters in 'pages' with two vowels and three consonants. Segmentation suggests 1 word: pages. No strong language cues emerged from the frequency lists.

Screenshot

E LSTE R Ihr Online-Finanzamt Suchen [0] Benutzerkonto erstellen o—o—o-©) Unternehmensdaten aktualisieren Dateneingabe Vorausfüllen der Einkommensteuererklärung Absenden Bestätigung der E-Mail...

Page Load Overview

4.15s
Total Load Time
856 KB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:de
Text Length:4,686 chars
Detector Agreement:100%

Website Classification

Primary Category

finance banking75% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

finance banking
75%
adult content
56%
corporate business
55%
government public service
51%
blog personal website
31%

Detected Features

Search

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
15188.114.97.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
14188.114.96.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
292--

Detected Technologies4

HTTP/3
40%
Cloudflare Bot Management
40%
Cloudflare
40%
JSZip
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1C124C42080F78676127EB485E1E457157B97D33383C9ABFA326C42798BC7CAA4C5B19C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:PnCa6SBq4WhmHMUQTGhYF7cntsq7/msUBKddhzFcV7+esGgEXQEI1BF/WpnKlpk6:PJEmjLKIUuzFcV7+esGg2DQb1

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:225506:JF4IhY88CzUlx5gAAENBCiATcYj0BpIpkGiFIKnAU0QCqCggBjloChPKIcoyIGgLYwhOQDHHxFi0Fg5feBYoAochiQCAAhVC

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:3a8f0387c3c3c7c3
Perceptual Hash:b55fcbcac0cc6461
Difference Hash:625e16160e0e161e
Wavelet Hash:3a8f8383c3c3c7c3
Color Hash:N/A

Other Hashes

Crop Resistant:625e16160e0e161e

Scan History

Scan history not available

Unable to load historical scan data