ScanMalware.com

Security Scan Report: webmailxcueu89-klausefncoi.appwrite.network

Submitted: Mar 27, 2026, 9:55:07 AMCompleted: Mar 27, 2026, 9:56:28 AMpubliccompleted
Loading additional data...

Summary

This website contacted 8 IPs in 3 countries across 6 domains to perform 9 HTTP transactions. The main domain is webmailxcueu89-klausefncoi.appwrite.network and was registered NaN years ago.

Submitted URL: https://webmailxcueu89-klausefncoi.appwrite.network/#[email protected]

AI Security Verdict

High Risk

Confidence: 85%

7
Risk Score

Impersonates Medicinbutiken login on a non‑official subdomain; likely phishing attempt.

Risk Factors
Brand impersonation on an unusual domain
Email address in URL fragment
Cross‑origin data exfiltration attempt
Login UI without proper form handling (potential hidden credential capture)
Unranked domain with brand name
Domain age information unavailable

Details

Page Title

Webmail Portal Login - medicinbutiken

Scan Type

public

Language

🇺🇸

English

(80% confidence)

Category

healthcare medical

(62%)

Domain Information

The domain 'webmailxcueu89-klausefncoi.appwrite.network' uses the .network top-level domain; it also runs on subdomain 'webmailxcueu89-klausefncoi'. The second-level label 'appwrite' is 8 characters long with 3 vowels and 5 consonants. It segments into two words: app, write. The median word length lands at four characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://webmailxcueu89-klausefncoi.appwrite.network/#contact@medicinbutiken.se

Page Load Overview

1.19s
Total Load Time
9
HTTP Requests
6
Domains
126 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

Language Code:en
Detection Confidence:80%
Script Type:Latin
HTML Lang Attribute:en
Text Length:123 chars
Detector Agreement:100%

Website Classification

Primary Category

healthcare medical62% confidence
Type: static
Method: ml+structural

All Detected Categories

healthcare medical
62%
e-commerce shopping
53%
government public service
29%
news media journalism
29%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
213.35.58.104United States
AS16509Amazon.com, Inc.
1151.101.3.52United States
AS54113Fastly, Inc.
1142.251.153.119United States
AS15169Google LLC
1178.63.16.224Falkenstein, Saxony, Germany
AS24940Hetzner Online GmbH
1208.91.114.103Surrey, British Columbia, Canada
AS40934Fortinet Inc.
113.35.58.119United States
AS16509Amazon.com, Inc.
1151.101.194.137United States
AS54113Fastly, Inc.
1142.251.154.119United States
AS15169Google LLC
98--

Detected Technologies5

X-UA-Compatible
100%
PasswordField
100%
JQueryv2.2.4
100%
HSTS
40%
jQuery CDN
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T11392736629F304211597A4BDBBD763093631E007990ACD497FAC87489FA6EC2DD3378D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:nGdMiFoY1ALs4tF2ckOIFHCCDByJHRif3gxreyO73Q+VYOvM1PvCG/W7yBPbkrQl:GTFYLjFIFiCdT3MCTFB6bkrQBASaxw

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:20307:iVhC2ikIKo5Sou6DoCsAYUYCYHgD4ISYBzdioAjwKJshdq2SEniIARGyECBBUABMFpCFnGRkEQqZpLRSElYQp0TEBwVXAJKs

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:08b43c4c38000000
Perceptual Hash:dd0f262719990f66
Difference Hash:d22a2a5222120202
Wavelet Hash:0c3838283a3e3e3e
Color Hash:#503a78

Other Hashes

Crop Resistant:d22a2a5222120202

Scan History

Scan history not available

Unable to load historical scan data