Security Scan Report: grabola.cfd

Redirected to:
https://nedugedela.z12.web.core.windows.net/est1pc3b5b/pe3ppkxp0cw5.ht...
Site favicon
Submitted: Completed: publiccompleted
This website contacted 7 IPs in 2 countries across 5 domains to perform 20 HTTP transactions. The main domain is grabola.cfd and was registered 1 week ago.

Submitted URL: https://grabola.cfd

Effective URL:
https://nedugedela.z12.web.core.windows.net/est1pc3b5b/pe3ppkxp0cw5.ht...
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Confirmed tech-support browser locker: fake 'Windows Update' alert with a support phone number, matched by an analyst-vetted kit roster and a CRITICAL hunting rule, plus right-click blocking and iplogger.com IP harvesting. Never call the number.

Risk Factors (8)
Known tech-support browser-locker kit identified by analyst-vetted roster
Critical hunting rule malware-rule match in page body
Fake Windows/Microsoft security alert impersonating the OS vendor
Phone-based 'support' solicitation with a non-Microsoft number
Right-click blocking and anti-analysis behavior
iplogger.com IP-logging beacon used to fingerprint visitors
Cross-origin fetch to unranked external host fevaguwolu.website
Entry domain grabola.cfd redirects to an Azure blob-storage tenant to evade blocking
Domain age information unavailable

Details

Page Title

プライバシーポリシー

Scan Type

public

Domain Name Analysis

Domain 'grabola.cfd' uses the .cfd top-level domain and has no subdomain. The core label 'grabola' covers 7 characters with 3 vowels and four consonants. Tokenizing the label suggests 2 words: grab, ola. Expect 3.5 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://grabola.cfd

Page Load Overview

6.70s
Total Load Time
769 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:35%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:ko
Text Length:100,157 chars
Detector Agreement:67%
Language mismatch: Declared as ko but detected as en

Website Classification

Primary Category

healthcare medical67% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

healthcare medical
67%
adult content
59%
cryptocurrency blockchain
56%
technology software
56%
government public service
51%

Detected Features

OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
823.132.164.199United States
AS401626Netiface America, Inc.
220.150.4.33Azure · CLOUDSeoul, Seoul, South Korea
AS8075Microsoft Corporation
2172.67.194.172Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2172.67.188.178Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2104.21.34.7Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
207--

Detected Technologies7

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T149F3BE2C9B8C38390923936B6C5566C9967ECE37E1410DD6B12E845D3FC8B9CDD1E2B8

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:07jBtzkoi7yof3A5ST3VoeqCV5ayQArsGEG5RDxj8wVSGiB4Ja9COdvtd507:074kofQ5AVKCVPrsG1tAwM6a9COdvtd8

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:172575:blRRAiVNRRAQrhIBaGwpSDkwYcLBVoRCBkSYiABQACBAoCgT8g4IyhfBCMD8ikCQoQhBCsZBEf6MggBJmAtwABwnAFHYUrFG

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:383c3c3c3c3c0101
Perceptual Hash:cbd734ce7428552c
Difference Hash:c9c9e9e9e1e9f3bb
Wavelet Hash:3c3c7c3c7c7c3901
Color Hash:N/A

Scan History

Scan history not available

Unable to load historical scan data