ScanMalware.com

Security Scan Report: www.mediafire.com

Site favicon
Submitted: Oct 14, 2026, 2:20:23 AMCompleted: Oct 14, 2026, 2:21:51 AMpubliccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/bbaafa17-36d2-48b8-ba11-cb349d8dc19fDomain and IP registration (RDAP)/api/v1/rdap/bbaafa17-36d2-48b8-ba11-cb349d8dc19fCertificate Transparency/api/v1/ct/mediafire.comHow often this domain was scanned/api/v1/domain/stats/mediafire.comScan history for this domain/api/v1/domain/history/mediafire.com?limit=15

This website contacted 139 IPs in 6 countries across 101 domains to perform 356 HTTP transactions. The main domain is mediafire.com and was registered 30 years ago.

Submitted URL: https://www.mediafire.com/file/kn035c5b2hu307w/FreeRobuxandTixgenerator.exe/file

The Cisco Umbrella rank of the primary domain is #42,756 of the top 1 million websites

AI Security Verdict

Moderate Risk

Confidence: 72%

5
Risk Score

This is an ordinary sign-in page on a long-established, well-ranked domain, with credentials submitted to a host the operator controls.

Risk Factors (5)
Distributes a Windows executable named as a 'free Robux/Tix generator' lure
Large 104 MB executable of unknown provenance uploaded anonymously
Download flow funnels users through advertising/redirect interstitials (50 redirects, 25 cross-domain)
DevTools blocking / anti-analysis JavaScript present on the page
Third-party ad/tracking scripts (ezoic, doubleclick, amplitude, id5-sync) obscuring the true download path
Safety Factors (7)
Scanned domain (mediafire.com) is a well-established, legitimate file-sharing service with 24-year history and a Cisco Umbrella top-100K ranking
SELF-BRANDING: title/meta reference MediaFire, matching the domain — not brand impersonation
No Indicators of Compromise matched against the page or its resources
No JavaScript malware (YARA) patterns and no known malicious kit detected
Network IDS alerts are INFO-only (file-sharing heuristic, hex-encoding heuristic) and are not corroborated by IoC/YARA/Safe Browsing
No credential, login or payment form on the page; no cross-origin credential exfiltration
Established domain (8829 days old) with no strong malicious indicators — risk clamped from 7 to 5
Domain age information unavailable

Details

Page Title

FreeRobuxandTixgenerator

Scan Type

public

Domain Name Analysis

The domain name 'www.mediafire.com' uses the commercial generic top-level domain (.com), featuring subdomain 'www'. Its registrable label 'mediafire' stretches across 9 characters holding five vowels versus four consonants. Breaking it apart gives two words: media, fire. Expect 4.5 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://www.mediafire.com/file/kn035c5b2hu307w/FreeRobuxandTixgenerator.exe/file

Page Load Overview

17.31s
Total Load Time
5.7 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:2,690 chars
Detector Agreement:75%

Website Classification

Primary Category

corporate50% confidence
Type: spa
Method: structural

All Detected Categories

corporate
50%

Detected Features

OG: website

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
80104.18.213.225Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2172.67.199.186Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2142.251.20.97Google · CDNUnited States
AS15169Google LLC
2172.66.171.133Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2172.67.170.144Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2142.250.154.113Google · CDNUnited States
AS15169Google LLC
2104.16.79.73Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2104.21.42.32Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
218.245.86.4Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
2104.18.214.225Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
356139--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T136842A22F1D2A02B551F4077B13B332CB63FA1439201C968BA2CD2E49FD59CB6277B95

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:Y1pgAkHnjzxQ6KSAfTNbNHqnAMtaW+LN7uxRLlzglKkf2daD7S:igAkHnjzxQBSAlNKAMtCN78Bkf2daC

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:391047:UhCaBYpAAEdAaKCHAfhskoGIWQEJoIACWIilgQAiJWCY0AJyHOr2EgDBiKhQZVoKo4YIwHXJK6UgBAsUgAAOiLBAC0PEWQQC

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:000000000000ffff
Perceptual Hash:ef64e9149b98199a
Difference Hash:a7464f0b0d193b23
Wavelet Hash:03030303e701ffff
Color Hash:#c59087

Other Hashes

Crop Resistant:a7464f0b0d193b23,b046460a0a0c4c10

Scan History

Scan history not available

Unable to load historical scan data