Security Scan Report: winthere1.fr

Site favicon
Submitted: Completed: publiccompleted
This website contacted 5 IPs in 2 countries across 3 domains to perform 42 HTTP transactions. The main domain is winthere1.fr and was registered 1 month ago.

Submitted URL: https://winthere1.fr/

AI Security Verdict

Moderate Risk

Confidence: 62%

4
Risk Score

Gambling promotional page on a 33-day-old look-alike domain with redirect chains, but no forms, no Indicators of Compromise and no malware — risky, not confirmed phishing.

Risk Factors (3)
Unlicensed-appearing online casino promotion aimed at French players with large bonus offers
Recently registered look-alike domain (winthere1.fr vs. the winthere.fr site it references)
Chain of six cross-domain redirects used to reach the page
Safety Factors (4)
No credential, login, or payment forms on the page — nothing is collected here
No Indicators of Compromise, no YARA malware matches, no malicious-kit roster match
Page identifies the official site separately (winthere.fr) rather than claiming to be it
IDS alerts are informational JavaScript-obfuscator heuristics only, uncorroborated by any IoC or YARA hit
Domain age information unavailable

Details

Page Title

Winthere ᐉ Winthere Casino France

Scan Type

public

Domain Name Analysis

The domain 'winthere1.fr' uses the French country-code top-level domain (.fr) without a subdomain. The core label 'winthere1' covers 9 characters containing three vowels alongside five consonants, notching 1 digit. Splitting it apart reveals three words: win, there, 1. The median word length lands at three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://winthere1.fr/

Page Load Overview

1.03s
Total Load Time
569 KB
Total Size

Language Analysis

Primary Language

🇫🇷French
Code: fr
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:fr
Text Length:20,801 chars
Detector Agreement:60%

Website Classification

Primary Category

gambling betting93% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

gambling betting
93%
adult content
86%
entertainment media
56%
corporate
35%
cryptocurrency blockchain
30%

Detected Features

OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
10188.114.96.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
8188.114.97.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
877.88.21.119Yandex · CLOUDMoscow, Moscow, Russia
AS13238YANDEX LLC
887.250.250.119Yandex · CLOUDRussia
AS13238YANDEX LLC
887.250.251.119Yandex · CLOUDRussia
AS13238YANDEX LLC
425--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T14C83C431A1D4203B40A325C4B3257B3FAAD6E60ADE1B5610BBBD57D24BDBCD8DC2315A

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:JMpWnvUIICh1oCGq7idHqL0EZi99ULuSf:JMpWnfhjzI00EWUz

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:80964:EMAAHJQiIUGEHUGI0cgEuACCFYRz1QM3DAIUMZJMUhRDIEQRJiMBVULQmAEQgDqpZhRkmCjEQCCSwRgJBMISKBvCEKIVCXAB

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:021e26363c064440
Perceptual Hash:96b56949696535a5
Difference Hash:8eaccce4e0acac82
Wavelet Hash:073e263e3c3e7c60
Color Hash:#35d22d

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data