ScanMalware.com

Security Scan Report: telegra.loan

Redirected to:
https://telegra.loan/
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/7c174ac0-7316-4dc2-a7f7-ea6d5b5bbfddDomain and IP registration (RDAP)/api/v1/rdap/7c174ac0-7316-4dc2-a7f7-ea6d5b5bbfddHow often this domain was scanned/api/v1/domain/stats/telegra.loanScan history for this domain/api/v1/domain/history/telegra.loan?limit=15
This website contacted 4 IPs in 3 countries across 3 domains to perform 32 HTTP transactions. The main domain is telegra.loan and was registered 6 days ago.

Submitted URL: https://Telegra.loan

Effective URL:
https://telegra.loan/
Redirected

AI Security Verdict

High Risk

Confidence: 78%

8
Risk Score

2-day-old unranked clone of Telegram's site on telegra.loan with no forms but clear brand impersonation and a flagged /go/d redirect path; treat as a lure, do not download or follow its links.

Risk Factors (5)
Brand impersonation of Telegram on a non-official domain (telegra.loan)
Domain registered 2 days ago (CRITICAL age risk category)
Unranked / no domain reputation while claiming a major brand
Threat-intel flags on the primary domain and a /go/d URL path (single-source, unverified, generic abuse-reputation)
Off-site redirect funnel and third-party logging host (tglog.iwatch.vip) loaded alongside the page
Domain age information unavailable

Details

Page Title

Telegram Messenger

Scan Type

public

Domain Name Analysis

The domain 'Telegra.loan' uses the .loan top-level domain and has no subdomain. Its registrable label 'telegra' stretches across 7 characters split between three vowels and four consonants. Tokenizing the label suggests 2 words: tele, gra. The median word length lands at 3.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://Telegra.loan

Page Load Overview

75.12s
Total Load Time
757 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:54%
Script:Latin
Direction:ltr

Detection Details

Text Length:2,017 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software88% confidence
Type: dynamic
Method: ml+structural+ocr_tiebreaker

All Detected Categories

technology software
88%
social media network
78%
documentation technical
38%
news media journalism
36%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
8104.21.28.254Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
8149.154.167.99Amsterdam, North Holland, Netherlands
AS62041Telegram Messenger Inc
827.124.46.14Singapore
AS152194CTG Server Limited
8172.67.171.51Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
324--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T191A296A763B8A02251D34BCE7B616B1AB9A3D04FCB561B02727C5A47AF93DC2CD5350C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:XQ+fx4izVbhvm0YSklcD/GJuLbmw5fiA+Z2yZOQbBtmiNYzbCVg2tMXWY:gJiz3vm076cD39iA+Z2ywQbBtmiNYzbP

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:22339:WxkOFdUDQADgIgCwUEyNgCEsKLAkQmoBAZFQ0ZkRkqi/KSkFKXEJhAAIEIkQAAElWKABGJvxF7cyBAu6x5AAwMUAQKAIGAHB

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00f7ffe7c3ffe7e7
Perceptual Hash:e659661966194c7d
Difference Hash:320c6a1e16160c0d
Wavelet Hash:00e3e3c3c3c3c7c7
Color Hash:#87a2c5

Other Hashes

Crop Resistant:320c6a1e16160c0d,0c121232b2b21212,988d24a4a5a4a280

Scan History

Scan history not available

Unable to load historical scan data