ScanMalware.com

Security Scan Report: multi-xchange.web.app

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/8a1e5a07-3119-4d90-8d0a-b525b5c42f14Domain and IP registration (RDAP)/api/v1/rdap/8a1e5a07-3119-4d90-8d0a-b525b5c42f14How often this domain was scanned/api/v1/domain/stats/multi-xchange.web.appScan history for this domain/api/v1/domain/history/multi-xchange.web.app?limit=15
This website contacted 5 IPs in 1 country across 4 domains to perform 39 HTTP transactions. The main domain is web.app and was registered 7 years ago.

Submitted URL: https://multi-xchange.web.app/

AI Security Verdict

Confirmed Scam

Confidence: 93%

9
Risk Score

Firebase-hosted 'WalletLink' imitation with a critical Telegram credential-exfiltration script and a wallet-drainer threat-intel report. Do not connect a wallet; report it.

Risk Factors (5)
Critical-severity JavaScript credential-exfiltration pattern (Telegram bot token embedded in page script)
Brand impersonation of WalletLink on a non-official, free hosting subdomain
Threat intelligence reports the primary domain as a wallet drainer / phishing
Wallet-connect lure aimed at convincing visitors to connect a crypto wallet, consistent with a drainer
Unknown-age subdomain on a shared hosting platform
Domain age information unavailable

Details

Page Title

WalletLink

Scan Type

public

Domain Name Analysis

Domain 'multi-xchange.web.app' uses the application-focused generic top-level domain (.app) with subdomain 'multi-xchange'. The second-level label 'web' is 3 characters long split between 1 vowel and 2 consonants. Segmentation suggests 1 word: web. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://multi-xchange.web.app/

Page Load Overview

2.23s
Total Load Time
1.5 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:1,412 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software71% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

technology software
71%
cryptocurrency blockchain
42%
documentation technical
26%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
11199.36.158.100Fastly · CDNUnited States
AS54113Fastly, Inc.
7104.20.35.94Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
7172.64.150.129Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
7104.18.37.127Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
7172.66.147.126Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
395--

Detected Technologies6

Node.js
50%
HTTP/3
40%
HSTS
40%
Firebase
40%
Vue.js
30%
Nuxt.js
30%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T12FF24B1D6E48116E2467C1F5F090AB9CA101F347CB23A5E9F6AD2651CFC6FF68F22608

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:DUcG9mWHkGLXeZvOEPuopqTyE5RRwCYF2K3s/kS+lLE/HcuQAriDd8Aoz+Sk:o9vcOEeyEGCYFxQcfU6ozjk

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:35209:Ah8BSICC4VAOFQFjUFgERFChIFEBpAkPGgkFeAKMaWgFQaVOSIYFCAD29wFSVyKJp4dKgkAANCUbABAIBOOh3GqCwqCxCAiA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:81818181bdbd8181
Perceptual Hash:af743c96383c9634
Difference Hash:0d434b136961691b
Wavelet Hash:85a1a181fdbdbd81
Color Hash:#763a78

Other Hashes

Crop Resistant:0202020202020202,a2a2a2a2a0a0a0a0,a4d2da69c8dada80,96c1c093d4c0d41b

Scan History

Scan history not available

Unable to load historical scan data