ScanMalware.com

Security Scan Report: firsthorizongethelp.com

Site favicon
Submitted: Oct 13, 2026, 6:09:38 PMCompleted: Oct 13, 2026, 6:10:15 PMpubliccompleted

AI Security Verdict

High Risk

Confidence: 75%

7
Risk Score

28-day-old, unranked domain named after First Horizon bank serving only a fake 'Security Verification / keep this window open' gate with no real content — a bank-impersonation phishing go-between. No forms seen, but treat as hostile.

Risk Factors (5)
Deceptive hostname impersonating a bank's name on a non-official domain plus a 'verification' gate is the defining shape of a support/bank phishing intermediary and matches the very-new-domain + brand impersonation pattern (HIGH_RISK)
Fake 'verifying your session' screen using urgency and 'keep this window open' coercion, with an automatic-connection claim the site cannot support
Domain registered 28 days ago (VERY_NEW) and completely absent from Cisco Umbrella
IDS HIGH alert: ET DROP Spamhaus DROP Listed Traffic Inbound
Title/domain mismatch with generic security-warning wording rather than any identifiable business
Domain age information unavailable

Details

Page Title

Security Verification

Scan Type

public

Domain Name Analysis

The domain 'firsthorizongethelp.com' uses the commercial generic top-level domain (.com) with no subdomain. The registrable portion 'firsthorizongethelp' spans 19 characters with 6 vowels and 13 consonants. It segments into four words: first, horizon, get, help. Average segment length settles at 4.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://firsthorizongethelp.com/

Page Load Overview

1.89s
Total Load Time
12 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:281 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical37% confidence
Type: static
Method: ml+structural

All Detected Categories

documentation technical
37%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
4196.251.121.110Seychelles
AS403005Blatant
4104.16.123.96Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4104.16.124.96Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
123--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T15512F9BAB89720256973D1B5577FA3097276A403844BC100BEAD93008FD1796AA72BEC

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:75GG1uevexePzwaSRbJbUbmz9sMHVp32rQGcTKmmiTbhOj:7UGcevexeP7+Dp2rMDm

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:9533:BGmIGSKAoAhISBAf15zEICiEIQBJRDEYEKAkYUNC6JYztxUIJAEGihiQ5AREABoLkhRwozQApJiRGCFECAARiIAgOq9xmQFw

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0008083c3c181800
Perceptual Hash:993366cc66739931
Difference Hash:00081a2a2a321000
Wavelet Hash:041c0818dfdfdbc3
Color Hash:#1f936f

Other Hashes

Crop Resistant:00081a2a2a321000

Scan History

Scan history not available

Unable to load historical scan data