ScanMalware.com

Security Scan Report: joinsaga.xyz

Redirected to:
https://joinsaga.xyz/conversation
Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/b149b652-467a-4129-b033-73f4ff9a2a97Domain and IP registration (RDAP)/api/v1/rdap/b149b652-467a-4129-b033-73f4ff9a2a97How often this domain was scanned/api/v1/domain/stats/joinsaga.xyzScan history for this domain/api/v1/domain/history/joinsaga.xyz?limit=15
This website contacted 3 IPs in 1 country across 3 domains to perform 22 HTTP transactions. The main domain is joinsaga.xyz and was registered 3 weeks ago.

Submitted URL: https://joinsaga.xyz/

Effective URL:
https://joinsaga.xyz/conversation
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Fake 'Saga' careers invitation matching an analyst-vetted ClickFix recruitment kit that installs the OverLord stealer; CRITICAL hunting-rule hit and HIGH PowerShell-stager IDS alerts confirm malicious intent.

Risk Factors (5)
Known malicious ClickFix/OverLord stealer recruitment kit identified by analyst-vetted roster
CRITICAL hunting-rule match for Recruitment_Refcode_ClickFix_Kit
HIGH IDS alerts for PowerShell stager traffic
Fake 'private invitation' careers portal impersonating a Web3/AI company brand on an unrelated 26-day-old domain
Referral-code / verification gate designed to push victims toward a clipboard-run command
Domain age information unavailable

Details

Page Title

Saga | Apply

Scan Type

public

Domain Name Analysis

The domain name 'joinsaga.xyz' uses the open generic top-level domain (.xyz). The registrable portion 'joinsaga' spans 8 characters with 4 vowels and four consonants. It segments into 2 words: join, saga. Median word length is four characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://joinsaga.xyz/

Page Load Overview

5.63s
Total Load Time
286 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:397 chars
Detector Agreement:67%

Website Classification

Primary Category

cryptocurrency blockchain41% confidence
Type: static
Method: ml+structural

All Detected Categories

cryptocurrency blockchain
41%
technology software
40%
social media network
30%
news media journalism
30%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
8208.84.100.64United States
AS22295Advin Services LLC
7142.250.154.95Google · CDNUnited States
AS15169Google LLC
7142.251.110.94Google · CDNUnited States
AS15169Google LLC
223--

Detected Technologies2

Ubuntu
40%
Nginxv1.28.3
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T161B1016360F1547B0293C2C6AEEABB55FED18317CA152D40B2ED0AC84FDAD43DA6761C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

96:1njkvfLaxVWEChq27Nlj8SnCjMS0jJSZ8wWjFSUwoDiLdKF:1ngvjQXChDJ0tZ88UDiLk

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:5586:hZQSURRCGlJQSCEBBANQQAZUCAQAgpEADq4AIAACjQACIICEgkMKIsAiUQQQwIAJAQAoMAFUgQIpJSSoJtQ8oZBBAIAHqIAE

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:6610380038381c0c
Perceptual Hash:9be4b3a4b3b4849c
Difference Hash:9461626060607959
Wavelet Hash:ff30383c3c3c3c2c
Color Hash:N/A

Other Hashes

Crop Resistant:0041aadaca221000,9461626060607959

Scan History

Scan history not available

Unable to load historical scan data