ScanMalware.com

Security Scan Report: tr.ee

Redirected to:
https://vmi3646823.contaboserver.net/df/rts/dyt/msg.php
Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/e8f1b854-370e-489d-9897-ab13003c2c12Domain and IP registration (RDAP)/api/v1/rdap/e8f1b854-370e-489d-9897-ab13003c2c12How often this domain was scanned/api/v1/domain/stats/tr.eeScan history for this domain/api/v1/domain/history/tr.ee?limit=15
This website contacted 10 IPs in 2 countries across 6 domains to perform 35 HTTP transactions. The main domain is tr.ee and was registered 16 years ago.

Submitted URL: https://tr.ee/XE4yUF

Effective URL:
https://vmi3646823.contaboserver.net/df/rts/dyt/msg.php
Redirected

The Cisco Umbrella rank of the primary domain is #145,100 of the top 1 million websites

AI Security Verdict

High Risk

Confidence: 85%

8
Risk Score

Fake SEUR parcel-tracking page on an unrelated Contabo VPS host, reached via a tr.ee short link, using a 48-hour 'missing delivery data' pretext under SEUR branding — brand impersonation phishing.

Risk Factors (5)
Brand impersonation: SEUR branding and copyright reproduced on a non-SEUR, VPS-hosted domain
Fake tracking/undeliverable-package pretext with a 48-hour deadline pressuring the victim to submit information
Destination concealed behind a URL shortener redirect to an unrelated numbered server
Page is a scraped clone of the courier's real website
No verifiable corporate identity or contact information on the destination host
Domain age information unavailable

Details

Page Title

SEUR: Envío y transporte de paquetería y mensajería | SEUR

Scan Type

public

Domain Name Analysis

You're looking at domain 'tr.ee' on the Estonian country-code top-level domain (.ee). Its registrable label 'tr' stretches across 2 characters split between zero vowels and 2 consonants. Segmentation suggests 1 word: tr. Expect two characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

> MIA SEUR — Enviar — Recibir Devolver MiSEUR Empresas PuntosPickup Ayuda Qa Inicia sesi Resultado de la busqueda / Detalles de seguimiento HI SEUR Elnúmero de rastreo 30364601451 N> 16) Llegada...

Page Load Overview

2.03s
Total Load Time
350 KB
Total Size

Language Analysis

Primary Language

🇪🇸Spanish
Code: es
Confidence:46%
Script:Latin
Direction:ltr

Detection Details

Text Length:1,528 chars
Detector Agreement:75%

Website Classification

Primary Category

phishing scam49% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

phishing scam
49%
government public service
40%
blog personal website
35%
technology software
27%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
8169.58.141.220Lauterbourg, Grand Est, France
AS51167Contabo GmbH
3151.101.2.133Fastly · CDNUnited States
AS54113Fastly, Inc.
3151.101.193.229Fastly · CDNUnited States
AS54113Fastly, Inc.
3104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3151.101.65.155Fastly · CDNUnited States
AS54113Fastly, Inc.
3142.251.13.95Google · CDNUnited States
AS15169Google LLC
3151.101.66.133Fastly · CDNUnited States
AS54113Fastly, Inc.
3151.101.65.229Fastly · CDNUnited States
AS54113Fastly, Inc.
3151.101.1.229Fastly · CDNUnited States
AS54113Fastly, Inc.
3151.101.193.155Fastly · CDNUnited States
AS54113Fastly, Inc.
3510--

Detected Technologies6

JQueryv3.7.1
100%
Bootstrapv5.3.1
50%
Varnish
40%
HSTS
40%
jsDelivr
20%
jQuery CDN
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T12752882140FB95A7145392C69E252A1BAFC5C707DB0A5B49B2FE07CD1FCBC86CD27928

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

96:dVcGe9oN01ksfgMS5SZVhMs2Ry+W/vPkGHyO9bJLNgkvKd:deGe9oN4kdFolMs2M+Qk2ZhvKd

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:13821:3FAEjUgjwwDCARCkZhiVEwKIAMJEPSyhAZAIUEAMx8hGGYNHAkEACA8cHiCoQACXQY0aEgKgFqmgAgoRRIYJgCMhQN0wOicE

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:fbffffffffff4200
Perceptual Hash:b8c928e94be94bc9
Difference Hash:33b2a22a589696ed
Wavelet Hash:b9dafedecec60000
Color Hash:N/A

Other Hashes

Crop Resistant:33b2a22a589696ed,4285a1acccd4ed6c

Scan History

Scan history not available

Unable to load historical scan data