ScanMalware.com

Security Scan Report: rb922.top

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/87241799-b01c-4691-83fc-9054928bca2bDomain and IP registration (RDAP)/api/v1/rdap/87241799-b01c-4691-83fc-9054928bca2bHow often this domain was scanned/api/v1/domain/stats/rb922.topScan history for this domain/api/v1/domain/history/rb922.top?limit=15
This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main domain is rb922.top and was registered 1 week ago.

Submitted URL: https://rb922.top/

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Fake government eChallan portal on a 3-day-old .top domain that uses a fake 'flagged vehicle' pretext to push an APK and walk users through disabling Android install protections. Malware distribution with brand impersonation.

Risk Factors (6)
Impersonation of the Indian government eChallan/MoRTH/NIC service on a non-official .top domain
Delivers a malicious Android APK and instructs users to bypass Play Protect and enable unknown-source installation
Fabricated 'vehicle flagged for internal review' pretext to pressure the victim into installing the app
Domain registered 3 days ago, unranked in Cisco Umbrella, low legitimacy score
HIGH-severity network IDS alerts for hostile *.top domain traffic
Secondary suspicious *.top external domain (ouseh.4t7t3c.top)
Domain age information unavailable

Details

Page Title

eChallan - Digital Traffic/Transport Enforcement Solution

Scan Type

public

Domain Name Analysis

The domain 'rb922.top' uses the .top top-level domain with no subdomain. The second-level label 'rb922' is 5 characters long split between zero vowels and two consonants, plus three digits. Word splitting yields 2 words: rb, 922. Expect 2.5 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://rb922.top/

Page Load Overview

2.91s
Total Load Time
302 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:2,463 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software52% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
52%
government public service
29%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
338.76.216.221United States
AS401701cognetcloud INC
285.137.240.222Hong Kong
AS401701cognetcloud INC
52--

Detected Technologies2

Nginx
40%
HSTS
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1BA92E7BB76F220357867D19266E11BCB3970D407E4038654B9AD6364CFC3E83A7A7B48

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:B1HZbZ+tmzm7dyDG5Y+YR/Zkf16xfkx0J:TZd+tmzN8Ynlfki

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:19546:IuCTCACgsgVAAAAKMmxhycCIMBlhRSemSeDSBRg84KhJIFDbAJYgI6OATMIlWi4EGSEwqDEBSVDgJZECRGEZgIhABWUYwrOE

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0000ffffe7ffe3ff
Perceptual Hash:d3587163c2c9cce3
Difference Hash:c00833324c100e08
Wavelet Hash:0000ffff070703ff
Color Hash:N/A

Other Hashes

Crop Resistant:0080919180808000,0932324c280e0e08,434424892609a909

Scan History

Scan history not available

Unable to load historical scan data