Security Scan Report: referocheck.se

Redirected to:
https://www.refero.se/refero-check?locale=en
Site favicon
Submitted: Oct 3, 2026, 5:40:17 PMCompleted: Oct 3, 2026, 5:41:32 PMpubliccompleted

This website contacted 37 IPs in 3 countries across 27 domains to perform 126 HTTP transactions. The main domain is refero.se and was registered 14 years ago.

Submitted URL: https://referocheck.se

Effective URL:

https://www.refero.se/refero-check?locale=en
Redirected

AI Security Verdict

Low Risk

Confidence: 68%

2
Risk Score

Cross-domain redirect from referocheck.se to the brand's own refero.se site. Self-branded business page with no forms, no credential/payment collection, and no malware, YARA, IDS, or content-IoC signals. The single threat-intel tag is generic abuse reputation on a third-party address and does not describe this page.

Safety Factors (4)
Content presents a coherent Swedish business (Refero check — transaction/VAT analysis) with a physical address in Stockholm and GDPR/cookie policy text
No credential, login, or payment forms anywhere on the page
No malware, YARA, IDS, or obfuscated-JS-with-network-sink signals; cross-origin scripts are standard analytics/CDN/widget vendors (Google Analytics, Elfsight, ConveyThis)
No brand impersonation — the site displays its own brand, not another entity's
Domain age information unavailable

Details

Page Title

I refer to check — I refer to revision

Scan Type

public

Domain Name Analysis

The domain name 'referocheck.se' uses the Swedish country-code top-level domain (.se). The second-level label 'referocheck' is 11 characters long split between four vowels and seven consonants. Tokenizing the label suggests 3 words: refer, o, check. Median word length comes out to 5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://referocheck.se

Page Load Overview

13.72s
Total Load Time
4.1 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:4,168 chars
Detector Agreement:100%

Website Classification

Primary Category

healthcare medical65% confidence
Type: spa
Method: ml+structural

All Detected Categories

healthcare medical
65%
government public service
58%
documentation technical
57%
finance banking
53%
technology software
46%

Detected Features

OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
18198.49.23.145Squarespace · CLOUDUnited States
AS53831Squarespace, Inc.
3194.9.94.86Sweden
AS39570Loopia AB
3146.75.120.237Fastly · CDNFrankfurt am Main, Hesse, Germany
AS54113Fastly, Inc.
334.160.236.44Google · CDNKansas City, Missouri, United States
AS396982Google LLC
3146.75.120.238Fastly · CDNFrankfurt am Main, Hesse, Germany
AS54113Fastly, Inc.
3104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3151.101.65.155Fastly · CDNUnited States
AS54113Fastly, Inc.
3151.101.65.229Fastly · CDNUnited States
AS54113Fastly, Inc.
318.66.122.48Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
12637--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T181F4D569A531243A004FB1B892AA274D6967E713DDD59FC4B4EC44684FCFFE908A33C9

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:hd9PQ/0cBCOs3N4m5Dflsefoeg7bF39zRWvNWzAlYvN:5o2lsefoejO

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:792844:IgAEARABgQACAGCBBIcQigAAgATABwUAFKDAiAAUAZBCMEQgIAAACJCgAAYAJA0AQAQIAAAAAIUAAQIAAoABBADBAgkOIRAB

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:20ffc7c7c3fffffe
Perceptual Hash:f52a556b552a352a
Difference Hash:c4008c9d1d040030
Wavelet Hash:00ffc701803fff0e
Color Hash:#931f67

Other Hashes

Crop Resistant:c4008c9d1d040030

Scan History

Scan history not available

Unable to load historical scan data