Security Scan Report: cdn.dlmafi.top

Site favicon
Submitted: Completed: publiccompleted
This website contacted 21 IPs in 4 countries across 19 domains to perform 37 HTTP transactions. The main domain is dlmafi.top and was registered 5 months ago.

Submitted URL: http://cdn.dlmafi.top/

AI Security Verdict

High Risk

Confidence: 85%

8
Risk Score

Cloned Google Play listing on a .top domain reported as medusa/remcontrol malware, with HIGH IDS alerts for hostile .top traffic. No forms, but brand impersonation plus a malware Indicator of Compromise make it unsafe.

Risk Factors (5)
Named malware family Indicator of Compromise on the primary domain (medusa/remcontrol)
Impersonation of Google Play branding on a non-Google domain
Abuse-prone .top TLD with HIGH IDS alerts for likely hostile DNS/HTTP traffic
Offers free streaming of TV channels and live sports from an unofficial source
Unranked domain with no verifiable business presence beyond a self-claimed company name
Domain age information unavailable

Details

Page Title

TVTAP: Film, TV e Calcio - Google Play

Scan Type

public

Domain Name Analysis

Domain 'cdn.dlmafi.top' uses the .top top-level domain; it also runs on subdomain 'cdn'. The registrable portion 'dlmafi' spans 6 characters with two vowels and 4 consonants. Word splitting yields three words: d, lm, afi. Median word length comes out to two characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of http://cdn.dlmafi.top/

Page Load Overview

6.51s
Total Load Time
1.2 MB
Total Size

Language Analysis

Primary Language

🇮🇹Italian
Code: it
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:it
Text Length:2,259 chars
Detector Agreement:67%

Website Classification

Primary Category

entertainment media81% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

entertainment media
81%
adult content
77%
download file sharing
48%
technology software
43%
government public service
36%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
17172.67.149.138Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.251.13.95Google · CDNUnited States
AS15169Google LLC
1188.114.96.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1185.15.59.240United States
AS14907Wikimedia Foundation Inc.
1207.241.224.2United States
AS7941Internet Archive
1142.251.14.138Google · CDNUnited States
AS15169Google LLC
1142.251.20.119Google · CDNUnited States
AS15169Google LLC
1143.204.181.6Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
187.248.119.252United Kingdom
AS203220Yahoo-UK Limited
199.84.152.29Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
3721--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T119D282A160F2302771B7C0C17D626BAB75A1E907D877A72876FC9AA09FC7C929D1314C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:9xc+cokfXLwkqPspgPfu60uEpNYwLQH5S3oFgH3zOhzgtmCLPW6bnbz9bWbIxba4:9SbfXMkqUpIfuDuEpJs5S35Hj1BWOzv

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:31002:CaBy3ABIsIVgCXBIBMAGKCTCJBY5QIlghjTegQKm4AEMQAEAIhldBLKUnEBSKXkGagIABEAM+QJCRaACAGALgRLwQAiAAdBC

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffe7e7c7e3e7ffef
Perceptual Hash:b374cc333198ce66
Difference Hash:900c0c4c4d4c1818
Wavelet Hash:4ec2c2c3c3c3c7c7
Color Hash:#35d22d

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data