Security Scan Report: ff-de.shutgpt.ir

Site favicon
Submitted: Completed: publiccompleted
This website contacted 21 IPs in 5 countries across 19 domains to perform 37 HTTP transactions. The main domain is shutgpt.ir.

Submitted URL: http://ff-de.shutgpt.ir/

AI Security Verdict

High Risk

Confidence: 82%

8
Risk Score

Fake Google Play listing for 'TVTAP' hosted on an unrelated domain, flagged in threat intelligence as medusa/remcontrol malware; do not download or install anything from it.

Risk Factors (5)
Impersonation of Google Play store branding on a non-Google domain
Threat-intelligence report of medusa/remcontrol malware associated with the scanned URL
Deceptive hostname unrelated to the brand or the claimed publisher
Unranked domain with no verifiable ownership (legitimacy score 10/100)
Fake listing used to drive users toward an app install from an untrusted source
Domain age information unavailable

Details

Page Title

TVTAP: Film, TV e Calcio - Google Play

Scan Type

public

Domain Name Analysis

Within the Iranian country-code top-level domain (.ir), 'ff-de.shutgpt.ir' is registered with subdomain 'ff-de'. The core label 'shutgpt' covers 7 characters containing one vowel alongside six consonants. It segments into 3 words: shut, gp, t. The median word length lands at two characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of http://ff-de.shutgpt.ir/

Page Load Overview

19.44s
Total Load Time
1.2 MB
Total Size

Language Analysis

Primary Language

🇮🇹Italian
Code: it
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:it
Text Length:2,259 chars
Detector Agreement:67%

Website Classification

Primary Category

entertainment media81% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

entertainment media
81%
adult content
77%
download file sharing
48%
technology software
43%
government public service
36%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
17172.67.169.10Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1192.178.183.95Google · CDNUnited States
AS15169Google LLC
1188.114.97.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1185.15.59.240United States
AS14907Wikimedia Foundation Inc.
1207.241.224.2United States
AS7941Internet Archive
1192.178.183.100Google · CDNUnited States
AS15169Google LLC
1142.251.14.119Google · CDNUnited States
AS15169Google LLC
1143.204.181.47Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
187.248.119.251United Kingdom
AS203220Yahoo-UK Limited
199.84.152.29Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
3721--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1CFD282A160F2302771B7C0C17D626BAB35A1E907D877A72876FC9AA09FC7C929D1314C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:9Ic+cFkfXLwkqPspgPfu60uEpNYwLQH5S3oFgH3zOhzgtmCLPW6bnbz9bWbIxba4:9hOfXMkqUpIfuDuEpJs5S35Hj1BWOzv

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:31006:+MwhUWEhF0QLxAkDMIFABAkExAAFiSUyLsMaWAiYNFMI4M4GBgIYUEUgeMcpAyIkCuGmVABwLFAZR6rCAk6oUQgQAkHCgQgS

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffe7e7c7e3e7ffef
Perceptual Hash:b374cc333198ce66
Difference Hash:900c0c4c4d4c1818
Wavelet Hash:4ec2c2c3c3c3c7c7
Color Hash:#6ce0ca

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data