ScanMalware.com

Security Scan Report: romabelt1492.cam

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/9f3ef23f-10ed-4903-8ade-6b4720d88699Domain and IP registration (RDAP)/api/v1/rdap/9f3ef23f-10ed-4903-8ade-6b4720d88699How often this domain was scanned/api/v1/domain/stats/romabelt1492.camScan history for this domain/api/v1/domain/history/romabelt1492.cam?limit=15
This website contacted 17 IPs in 1 country across 13 domains to perform 164 HTTP transactions. The main domain is romabelt1492.cam and was registered 2 weeks ago.

Submitted URL: https://romabelt1492.cam/promotions

AI Security Verdict

Moderate Risk

Confidence: 68%

5
Risk Score

Turkish online gambling site on a 10-day-old .cam mirror domain with an account login form. Login is for user accounts, not credential phishing, so the gambling rule caps this at MODERATE_RISK; unlicensed betting plus a fresh evade-block domain warrants caution.

Risk Factors (5)
Very new domain (10 days old)
Unranked / no domain reputation
Online gambling content with aggressive bonus marketing ('%500 çevrimsiz yatırım bonusu', '230 milyon TL dağıttık')
Login form on a fresh, block-evading .cam domain
Obfuscated JavaScript IDS alert (ET WEB_CLIENT)
Safety Factors (4)
Contact and company registration details present (Exelogix Ltd., St Vincent and the Grenadines)
Site behind Cloudflare
No threat-intelligence indicators of compromise, no YARA malware, no credential exfiltration detected
Login form is same-origin for user accounts, not a cross-origin credential harvester
Domain age information unavailable

Details

Page Title

RomaBet Güncel Kampanyalar - Prestijli Resmi Erişim Rehberi

Scan Type

public

Domain Name Analysis

Within the .cam top-level domain, 'romabelt1492.cam' is registered while skipping any subdomain. The second-level label 'romabelt1492' is 12 characters long split between three vowels and 5 consonants, notching four digits. Segmentation suggests 3 words: roma, belt, 1492. Expect 4 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://romabelt1492.cam/promotions

Page Load Overview

6.09s
Total Load Time
28.0 MB
Total Size

Language Analysis

Primary Language

🇹🇷Turkish
Code: tr
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:tr
Text Length:3,987 chars
Detector Agreement:80%

Website Classification

Primary Category

gambling betting70% confidence
Type: spa
Method: ml+structural

All Detected Categories

gambling betting
70%
corporate business
52%
government public service
41%
social_media
25%
corporate
25%

Detected Features

Login Form
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
20172.67.223.246Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
9142.251.20.97Google · CDNUnited States
AS15169Google LLC
9104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
9151.101.193.155Fastly · CDNUnited States
AS54113Fastly, Inc.
9104.17.208.5Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
9104.18.95.41Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
9192.178.183.95Google · CDNUnited States
AS15169Google LLC
9216.239.34.36Google · CDNUnited States
AS15169Google LLC
9142.251.127.154Google · CDNUnited States
AS15169Google LLC
9142.251.20.94Google · CDNUnited States
AS15169Google LLC
16417--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T170742A12F4982209A037C75096E19F899264E117C5062BEDB9AFD624CFC7EC73E7329D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:9/UpnZMQYelNclgkBhRGSf9G1XaMrYY89Cry2gS3hjyO5ZSqqFd/dINrBs:9/UpnZMQYenclgkBhRGSf9G1XaMb8YrQ

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:357230:rAFnICNRFKBYmCALMjAAIiUEuDIOJFCwAMFsFYFCxiU4RaYIOQyVDp3CgUVyocKI4hygKAhKFFKDmkR2oDhCPSDBFmRgBFAI

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:183c3c1c181c1800
Perceptual Hash:99cd673232309e6d
Difference Hash:717171b170717078
Wavelet Hash:3c3c3c3c3c3c3c3c
Color Hash:#761f93

Other Hashes

Crop Resistant:323232b8f2a49ed6,6b632387e7268cd8,717171b170717078

Scan History

Scan history not available

Unable to load historical scan data