Security Scan Report: rechnungen-portal-imwowelt.com

Site favicon
Submitted: Completed: publiccompleted
This website contacted 13 IPs in 3 countries across 7 domains to perform 10 HTTP transactions. The main domain is rechnungen-portal-imwowelt.com and was registered 1 week ago.

Submitted URL: https://rechnungen-portal-imwowelt.com/

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Phishing clone of Immowelt on a 3-day-old lookalike domain, harvesting email/password via a login form and flagged by Google Safe Browsing for social engineering.

Risk Factors (5)
Brand impersonation of Immowelt on a lookalike domain
Login form collecting email and password, posted to 'do.php'
Domain only 3 days old
Google Safe Browsing Social Engineering detection
No legitimate registration link to the impersonated brand
Domain age information unavailable

Details

Page Title

Rechnung Portal | Immowelt

Scan Type

public

Domain Name Analysis

The domain 'rechnungen-portal-imwowelt.com' uses the commercial generic top-level domain (.com). The second-level label 'rechnungen-portal-imwowelt' is 26 characters long holding 8 vowels versus 16 consonants; bonus characters include 2 hyphens. It segments into eight words: re, ch, nun, gen, portal, im, wo, welt. Average segment length settles at 2.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Gap wate Willkommen zurück! E-Mail-Adresse Bitte E-Mail-Adresse eingeben Passwort Bitte Passwort eingeben © ‚Anmelden Passwort vergessen? oder Jetzt kostenfrei registrieren © AVIV Germany GmbH 2...

Page Load Overview

1.17s
Total Load Time
471 KB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:de
Text Length:529 chars
Detector Agreement:75%

Website Classification

Primary Category

real estate property80% confidence
Type: webapp
Method: ml+structural

All Detected Categories

real estate property
80%
government public service
34%

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
10198.251.89.161Luxembourg, Luxembourg, Luxembourg
AS53667FranTech Solutions
018.64.195.35Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
063.188.42.46Aws · CLOUDFrankfurt am Main, Hesse, Germany
AS16509Amazon.com, Inc.
018.173.205.82Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
0143.204.181.67Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
0192.178.183.97Google · CDNUnited States
AS15169Google LLC
013.32.121.108Cloudfront · CDNNew York, New York, United States
AS16509Amazon.com, Inc.
018.157.58.21Aws · CLOUDFrankfurt am Main, Hesse, Germany
AS16509Amazon.com, Inc.
018.173.205.17Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
018.173.205.106Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
1013--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1B643E8C0F7CD28778316712D592E65CC713DE4B2AD424CABFC69E02458E4CAE87399B5

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:32e6hC8BxDAcAbHMitq2Ag+ONTF2rcxkgHzggkyYyTIrnwu51B:30Mh9TK0l05VGIrnwu5D

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:58590:SyDZAmACBILJAGNhRBABGFxFZiB4AAEAQBBYAGEhyIEAS6FGGNUOgAIuN7GMmlEpCBC8QooQZddAOgHADAgECyDG0giEzSyY

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:f0f1f0b0f0f0fbff
Perceptual Hash:e656a96956d491a9
Difference Hash:2525642423230725
Wavelet Hash:f090b090f0f0f1ff
Color Hash:N/A

Other Hashes

Crop Resistant:2525642423230725

Scan History

Scan history not available

Unable to load historical scan data