Security Report: metadata-fetcher.vg - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/84b9090d-1771-426b-bca5-4cf1e2ab8777 Domain and IP registration (RDAP)/api/v1/rdap/84b9090d-1771-426b-bca5-4cf1e2ab8777How often this domain was scanned/api/v1/domain/stats/metadata-fetcher.vg Scan history for this domain/api/v1/domain/history/metadata-fetcher.vg?limit=15

This website contacted 2 IPs in 1 country across 2 domains to perform 15 HTTP transactions. The main domain is metadata-fetcher.vg.

Submitted URL: https://metadata-fetcher.vg

AI Security Verdict

Confirmed Scam

Confidence: 88%

Risk Score

Domain and its own IP are both flagged by multiple threat feeds as malware (xor ddos, Lumma stealer). Page mimics a konsoleH control-panel login; do not enter credentials.

Risk Factors (4)

Two independent content-malware indicators (xor ddos domain tag and lumma stealer IP:port tag) corroborated by multiple feeds

Lumma stealer is an infostealer family typically distributed to harvest credentials and session data

Third-party control-panel branding displayed on a domain unrelated to the official provider

Domain absent from Cisco Umbrella top 1M rankings

Domain age information unavailable

Details

Page Title

konsoleH :: Login

Scan Type

public

Domain Name Analysis

You're looking at domain 'metadata-fetcher.vg' on the .vg country-code top-level domain with no subdomain. Its registrable label 'metadata-fetcher' stretches across 16 characters holding 6 vowels versus nine consonants, plus one hyphen. Splitting it apart reveals three words: metadata, f, etcher. Expect 6 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

KONSOLE® ‘This domain does nat yet support HTTPS, Please add an SSL Certificate. You can find more information in the SSL guide Copyright konsuler 2004-2026 | Alle Rechie vorbehatien | [Impressum ]

Page Load Overview

0.84s

Total Load Time

12 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:52%

Script:Latin

Direction:ltr

Detection Details

Text Length:237 chars

Detector Agreement:100%

Website Classification

Primary Category

documentation technical51% confidence

Type: static

Method: ml+structural+ocr_tiebreaker

All Detected Categories

documentation technical

51%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
8	88.198.29.97	Nuremberg, Bavaria, Germany	AS24940Hetzner Online GmbH
7	78.46.152.77	Nuremberg, Bavaria, Germany	AS24940Hetzner Online GmbH
15	2	-	-

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1D3C16990B9F5330EE9241494CB603EA68FC3902BC3360808B90E75BF5F589E658B763D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

96:sLOqYKiKGVKECQKQCQKlE0iLEhw3CIiX6QEazT/:sLOEfd1JZJn4SIxtuT

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:6069:IEABgKEAQUoAAAAOI2VKPGARoAMAAAgEIEBVwCISiAASAhQCEnBAAgHASUKhfCCZyQGSAkqJhUCIAgAAIYKUEQARmAbIkHgA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffcfc7e7e7ffffff

Perceptual Hash:b33199cc66663399

Difference Hash:00101c0c04000000

Wavelet Hash:3c2c0000033f3f3f

Color Hash:N/A

Other Hashes

Crop Resistant:00101c0c04000000

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: metadata-fetcher.vg