Security Scan Report: website-development-x78k.bolt.host

Submitted: Completed: publiccompleted
This website contacted 16 IPs in 1 country across 8 domains to perform 13 HTTP transactions. The main domain is bolt.host and was registered 1 year 12 months ago.

Submitted URL: https://website-development-x78k.bolt.host/

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Fake example.com mail-authentication portal on a bolt.host subdomain harvesting email and password, with a Telegram bot token in its script for exfiltration. Do not enter credentials.

Risk Factors (6)
Credential (password) form collecting an email/username and password on a URL unrelated to the claimed brand
Impersonation of example.com's mail/authentication branding on website-development-x78k.bolt.host
Telegram bot token embedded in an inline script (credential exfiltration channel)
Visitor IP/geolocation lookups via ipapi.co and api.ipify.org from inline scripts
Network IDS flagged lookups to commonly actor-abused services (image.thum.io)
Randomly generated subdomain name on a free hosting platform, unranked in Cisco Umbrella
Domain age information unavailable

Details

Page Title

PORTAL - example.com Mail Authentication

Scan Type

public

Domain Name Analysis

You're looking at domain 'website-development-x78k.bolt.host' on the .host top-level domain with subdomain 'website-development-x78k'. Count 4 characters in 'bolt' holding 1 vowel versus 3 consonants. Breaking it apart gives 1 word: bolt. Median word length comes out to four characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://website-development-x78k.bolt.host/

Page Load Overview

1.35s
Total Load Time
370 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:403 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software76% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
76%
government public service
35%
documentation technical
32%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
13104.26.13.118Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0104.26.12.118Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0104.26.7.237Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0104.26.8.44Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
052.55.196.165Aws · CLOUDAshburn, Virginia, United States
AS14618Amazon.com, Inc.
0142.251.152.119Google · CDNUnited States
AS15169Google LLC
0142.251.14.105Google · CDNUnited States
AS15169Google LLC
0172.67.73.66Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0104.26.6.237Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1316--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1F973CF6304A70820F527803C3BEB9B08AE75804791C9DC5CB92E72959FD4D5266FFAF6

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:8BfcxosfxlsnlI3uupyybi5oNSPUrI3uupyybi5oNSPUI:BRxn3iC63iCi

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:79998:EgEtiXCgAAEacqCWowQFwCNoNQ4ZurJwksTs0DhjUAC4CSKQoAAxuNDIgQMYBGAIGAY2AB8LLKQjSgJhBAUgJGRAdUSIAoDR

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0018181818181801
Perceptual Hash:98dc2377225d22dd
Difference Hash:4cb2b2b2b2b2b24f
Wavelet Hash:3b1b9b9b98d81801
Color Hash:N/A

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data