ScanMalware.com

Security Scan Report: claudeprotect.com

Redirected to:
https://claudeprotect.com/
Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/61cbe424-be18-4fde-ae99-4b12a52b3960Domain and IP registration (RDAP)/api/v1/rdap/61cbe424-be18-4fde-ae99-4b12a52b3960How often this domain was scanned/api/v1/domain/stats/claudeprotect.comScan history for this domain/api/v1/domain/history/claudeprotect.com?limit=15
This website contacted 2 IPs in 1 country across 1 domain to perform 18 HTTP transactions. The main domain is claudeprotect.com and was registered 2 weeks ago.

Submitted URL: http://claudeprotect.com

Effective URL:
https://claudeprotect.com/
Redirected

AI Security Verdict

Low Risk

Confidence: 68%

3
Risk Score

Days-old site distributing a one-line PowerShell installer for a 'Claude' toolkit that advertises evading platform verification and handles session tokens; a HIGH IDS PowerShell-stager alert corroborates downloader behaviour. Do not run its commands.

Risk Factors (5)
Very new domain (15 days) used to distribute a downloaded installer
HIGH IDS alert matching PowerShell stager / downloader behaviour
One-command remote installer with session-token handling and no verifiable publisher
Toolkit purpose is circumventing a platform's anti-fraud and identity verification controls
No verifiable organization, legal entity or contact details for the software publisher
Safety Factors (5)
No password, payment or disguised credential fields in the captured DOM (1 form, a 'Persona verification URL' text input)
Self-branded domain (claudeprotect.com matches title/meta) — no impersonation of Anthropic; page explicitly states it is 'not affiliated with Anthropic'
No cross-origin form submissions, credential exfiltration or third-party script hosts detected
No hunting rule malware patterns, no known-kit roster match, no Google Safe Browsing hit reported
No concrete malicious signal: the threat-feed matches name third-party or shared hosts, or rest on a single feed or a reputation label, so they were not counted; no hunting rule / Safe-Browsing / IDS / credential form / brand impersonation either. Elevated risk rested on domain age or reputation alone; clamped from 7 to 3
Domain age information unavailable

Details

Page Title

ClaudeProtect — Stable Claude sessions and WhitePersona

Scan Type

public

Domain Name Analysis

Domain 'claudeprotect.com' uses the commercial generic top-level domain (.com) with no subdomain. The registrable portion 'claudeprotect' spans 13 characters containing 5 vowels alongside eight consonants. Splitting it apart reveals two words: claude, protect. Average segment length settles at 6.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

ClaudeProtect @ THE INDEPENDENT CLAUDE TOOLKIT One command. Stable Claude sessions. ClaudeProtect keeps proxy routing, device fingerprints, and WhitePersona verification in one CLI workfiow for sta...

Page Load Overview

1.87s
Total Load Time
108 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:8,960 chars
Detector Agreement:100%

All Detected Languages

🇺🇸en(92%)🇫🇷fr(4%)🇪🇸ca(3%)🇷🇴ro(1%)

Website Classification

Primary Category

technology software66% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

technology software
66%
healthcare medical
53%
documentation technical
44%
real estate property
42%
corporate
25%

Detected Features

Articles
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
16172.67.212.64Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.21.42.235Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
182--

Detected Technologies3

Open-Graph-Protocolvwebsite
100%
HTTP/3
40%
Cloudflare
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1FEE20922A6F4153B85E343C9B523F3267B51D21BD5192500B6BE4BF80FC3E89AD37949

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:uR6CWdu/mlSpQSnXQ9vBkz3SyvaYhx3DuRUa7JEtISxJfn/yKIwX+FQY0JJ/bmzs:NyJE7JEtISL/yKIwX+FgJJus

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:33214:E4QokJCIECGBgAGAeLRligQiIDcJEYQQAiQoFrkEiCa3r8GQswIAJIHI1YBgGSJq1gxBkAECBDcMUUIhQSFDIygSgvHoQxQZ

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffff91f1f1f1ffff
Perceptual Hash:ec6c92936d986c6c
Difference Hash:6238232323231803
Wavelet Hash:bf9f9191f181cf00
Color Hash:07003000180

Other Hashes

Crop Resistant:6238232323231803,83a2a42450000083

Scan History

Scan history not available

Unable to load historical scan data