ScanMalware.com

Security Scan Report: ww547.loginnorton.com

Redirected to:
https://ww547.loginnorton.com/
Submitted: Oct 5, 2026, 11:13:06 PMCompleted: Oct 5, 2026, 11:15:30 PMpubliccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/9d3456a0-209d-4bb3-9959-5cec97716670Domain and IP registration (RDAP)/api/v1/rdap/9d3456a0-209d-4bb3-9959-5cec97716670Certificate Transparency/api/v1/ct/ww547.loginnorton.comHow often this domain was scanned/api/v1/domain/stats/ww547.loginnorton.comScan history for this domain/api/v1/domain/history/ww547.loginnorton.com?limit=15

This website contacted 6 IPs in 3 countries across 1 domain to perform 3 HTTP transactions. The main domain is ww547.loginnorton.com and was registered 12 years ago.

Submitted URL: http://ww547.loginnorton.com

Effective URL:

https://ww547.loginnorton.com/
Redirected

AI Security Verdict

Moderate Risk

Confidence: 78%

5
Risk Score

Page presents itself as Norton's login/renewal portal on the non-official, unranked domain loginnorton.com with no forms, funneling clicks to ad/redirect endpoints. Impersonation of Norton, not the official vendor site.

Risk Factors (5)
Norton brand impersonation on a non-official domain (loginnorton.com)
Norton login/renewal wording designed to look like the vendor's own portal
Unranked domain claiming to represent a major brand
Bot-protection/challenge serving a block page to datacenter scanners
Ad/redirect-style outbound links and search-monetization resources
Safety Factors (6)
No credential, password or payment form was found on the captured page (0 forms, 0 password fields)
No Indicators of Compromise matched the page or its resources
No JavaScript YARA malware patterns and no IDS/Suricata alerts
No cross-origin credential exfiltration detected
Domain registration is old (registered 2014, ~4598 days)
Established domain (4598 days old) with no strong malicious indicators — risk clamped from 7 to 5
Domain age information unavailable

Details

Page Title

login nortonother network

Scan Type

public

Domain Name Analysis

You're looking at domain 'ww547.loginnorton.com' on the commercial generic top-level domain (.com) and includes subdomain 'ww547'. The second-level label 'loginnorton' is 11 characters long holding 4 vowels versus 7 consonants. It segments into two words: login, norton. Median word length comes out to 5.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of http://ww547.loginnorton.com

Page Load Overview

2.29s
Total Load Time
0 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:188 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software84% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

technology software
84%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
334.160.121.137Google · CDNKansas City, Missouri, United States
AS396982Google LLC
034.149.1.127Google · CDNKansas City, Missouri, United States
AS396982Google LLC
0188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
087.248.119.252United Kingdom
AS203220Yahoo-UK Limited
046.137.126.110Aws · CLOUDDublin, Leinster, Ireland
AS16509Amazon.com, Inc.
0212.82.100.137Dublin, Leinster, Ireland
AS34010Yahoo-UK Limited
36--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T140E22B9E65F3612114A3F0B957AFA244B229D003A45ADC6CBD9C83089F99DD5C9F3B8C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:hdbF2BuqGFGlvVxVVHsGvL/GwdaQGmm1GWU:QBuvcfT3ieG71i

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:32409:EAgKKCAYCSgGQFJCFAigpE0g24ACg4biZCnJVlQIowAmD8sEkjpkDBEYIiI+jAFIUqQFSAzEuRAQEVQhMRFQDJCEhqDUSFnJ

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:303c183818000000
Perceptual Hash:cccc6767c6233331
Difference Hash:2020303030080010
Wavelet Hash:3c3c3c3c3c3c3c3c
Color Hash:#1f2f93

Other Hashes

Crop Resistant:2020303030080010

Scan History

Scan history not available

Unable to load historical scan data