ScanMalware.com

Security Scan Report: mainnethub-protocol.firebaseapp.com

Submitted: Sep 28, 2026, 5:54:30 PMCompleted: Sep 28, 2026, 5:55:08 PMpubliccompleted

AI Security Verdict

High Risk

Confidence: 88%

7
Risk Score

Fake WalletLink wallet-drainer page on a free firebaseapp.com subdomain that solicits users' private keys and loads a ScamSniffer-flagged drainer domain. Do not connect a wallet or enter keys.

Risk Factors (5)
Impersonation of a different entity's brand (WalletLink) on a non-official domain
Explicit private-key entry solicitation (credential/key harvesting)
Third-party wallet-drainer domain loaded by the page (decentralizedfixapp.site)
Outbound link to flagged wallet-drainer domain (ddex.io)
Instant free hosting subdomain (firebaseapp.com) with unknown actual creation date; apex age not attributable
Domain age information unavailable

Details

Page Title

WalletLink

Scan Type

public

Domain Name Analysis

Domain 'mainnethub-protocol.firebaseapp.com' uses the commercial generic top-level domain (.com), featuring subdomain 'mainnethub-protocol'. Its registrable label 'firebaseapp' stretches across 11 characters holding five vowels versus six consonants. Splitting it apart reveals three words: fire, base, app. Median word length is 4 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://mainnethub-protocol.firebaseapp.com/

Page Load Overview

2.57s
Total Load Time
262 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:3,088 chars
Detector Agreement:100%

Website Classification

Primary Category

cryptocurrency blockchain68% confidence
Type: dynamic
Method: ml+structural+ocr_tiebreaker

All Detected Categories

cryptocurrency blockchain
68%
technology software
68%
gambling betting
46%
documentation technical
45%
finance banking
40%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
5199.36.158.100Fastly · CDNUnited States
AS54113Fastly, Inc.
3104.18.4.118Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3185.199.111.133Fastly · CDNUnited States
AS54113Fastly, Inc.
3192.178.183.101Google · CDNUnited States
AS15169Google LLC
3200.97.244.201United States
AS58658DXTL
3162.159.153.4Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3104.20.36.4Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3104.18.5.118Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3185.199.109.133Fastly · CDNUnited States
AS54113Fastly, Inc.
3192.178.183.113Google · CDNUnited States
AS15169Google LLC
3812--

Detected Technologies6

Nuxt.js
50%
Node.js
50%
HTTP/3
40%
HSTS
40%
Firebase
40%
Vue.js
30%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T19183091B19F3015A0C53D1E46B7A7A44BBA1E207CC0ADC8ABADE1251CF86EB56DD335C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:GbYZiPLM0eEHNGqZbuoQ0E0IDBGkjic1oWefV:Gcio0BHcZDBGWiYoJfV

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:86244:iEwAPFigCoSQkIghEogxYHhAEQQ0IwplECJAzJqIAIjaAMWlgojIk7pEQDIt4iDEYBFIFpHQNBCaAHiQSAcIIQEbAyAQcsqS

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:8181818181bdbdbd
Perceptual Hash:af3c96903495d5c5
Difference Hash:1d45434369696969
Wavelet Hash:85818181b5bdbdbd
Color Hash:#8f1f93

Other Hashes

Crop Resistant:1d45434369696969,dadadbdad2d2dbda,94c1c483c4c4d4d4

Scan History

Scan history not available

Unable to load historical scan data