Security Report: check-qnvr8u.devwatchbuild.me - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/622477a1-41ef-450c-9e82-0f8c2a637053 Domain and IP registration (RDAP)/api/v1/rdap/622477a1-41ef-450c-9e82-0f8c2a637053 Certificate Transparency/api/v1/ct/check-qnvr8u.devwatchbuild.me How often this domain was scanned/api/v1/domain/stats/check-qnvr8u.devwatchbuild.me Scan history for this domain/api/v1/domain/history/check-qnvr8u.devwatchbuild.me?limit=15

This website contacted 6 IPs in 1 country across 6 domains to perform 17 HTTP transactions. The main domain is check-qnvr8u.devwatchbuild.me and was registered 3 years ago.

Submitted URL: https://check-qnvr8u.devwatchbuild.me/?address=CtzPWv73Sn1dMGVU3ZtLv9yWSyUAanBni19YWDaznnkn

AI Security Verdict

Low Risk

Confidence: 58%

Risk Score

New 3-day-old self-branded Solana 'rug check' tool with no forms, no IoC/YARA, and no impersonation; asks to connect a wallet on an unranked domain flagged by a generic .cc IDS alert. No confirmed malice — treat as moderate risk.

Risk Factors (5)

Domain registered only 3 days ago — no operational track record

Unranked/unknown reputation domain requesting a wallet connection before revealing results

External .cc domain (data-repo.cc) contacted, correlated with a HIGH Severity IDS DNS alert

Function() constructor usage indicates dynamic code generation

Displays absolute risk claims ('65% rug rate', '15 rugged') for an arbitrary address — possible manufactured urgency to push a wallet connect

Safety Factors (6)

No Indicators of Compromise matched against the page or its resources

No JavaScript YARA malware patterns and no known malicious kit in the kit roster

No credential, password, or payment form present (verified: 0/0/0)

No brand impersonation — the page displays its own 'DEVWATCH' brand, not another entity's

No cross-origin credential exfiltration detected; uses legitimate Solana infrastructure (mainnet.helius-rpc.com, frontend-api.pump.fun, Google Fonts)

Verdict cited a credential/login form, but DOM analysis found no password field (real or disguised) or payment field, and no other hard signal — credential-phishing framing unsupported; risk adjusted from 4 to 3

Domain age information unavailable

Details

Page Title

DEVWATCH — Analysis: CtzPWv73...nnkn

Scan Type

public

Favicon Hash

MMH3: 1051558944

MD5: 2010b80e2ec9ace8f950311195a66d50

Domain Name Analysis

Domain 'check-qnvr8u.devwatchbuild.me' uses the Montenegrin country-code top-level domain (.me); it also runs on subdomain 'check-qnvr8u'. The second-level label 'devwatchbuild' is 13 characters long split between four vowels and nine consonants. Breaking it apart gives three words: dev, watch, build. The median word length lands at 5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

1.64s

Total Load Time

424 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:2,932 chars

Detector Agreement:67%

Website Classification

Primary Category

corporate50% confidence

Type: static

Method: structural

All Detected Categories

corporate

50%

Detected Features

OG: website

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
7	188.114.96.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	142.250.154.95Google · CDN	United States	AS15169Google LLC
2	188.114.97.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	142.251.20.94Google · CDN	United States	AS15169Google LLC
2	172.64.151.87Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	172.64.153.234Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
17	6	-	-