ScanMalware.com

Security Scan Report: www.xn--pay-bitrefll-fgb.com

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/e96b1d5c-f728-4408-8621-43dfa8bf4a5cDomain and IP registration (RDAP)/api/v1/rdap/e96b1d5c-f728-4408-8621-43dfa8bf4a5cHow often this domain was scanned/api/v1/domain/stats/xn--pay-bitrefll-fgb.comScan history for this domain/api/v1/domain/history/xn--pay-bitrefll-fgb.com?limit=15
This website contacted 4 IPs in 2 countries across 1 domain to perform 2 HTTP transactions. The main domain is xn--pay-bitrefll-fgb.com and was registered 2 months ago.

Submitted URL: https://www.xn--pay-bitrefll-fgb.com

AI Security Verdict

High Risk

Confidence: 92%

8
Risk Score

Punycode look-alike of Bitrefill flagged as phishing by two feeds; a fake 'Bitrefill Checkout' wallet-connect/payment page on a 60-day-old unranked domain. Do not connect a wallet or enter data.

Risk Factors (5)
Punycode homoglyph domain impersonating Bitrefill on a non-official host
Primary domain flagged as phishing by two corroborating threat-intelligence feeds
Fake checkout / wallet-connect flow targeting cryptocurrency users
Recently registered (60 days) and unranked domain claiming a well-known brand
HIGH-severity Suricata/DROP network alert
Domain age information unavailable

Details

Page Title

400 Bad Request

Scan Type

public

Domain Name Analysis

You're looking at domain 'www.xn--pay-bitrefll-fgb.com' on the commercial generic top-level domain (.com); it also runs on subdomain 'www'. Its registrable label 'xn--pay-bitrefll-fgb' stretches across 20 characters containing three vowels alongside 13 consonants, plus four hyphens. It segments into seven words: xn, pay, bit, ref, ll, f, gb. Expect two characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Bitrefill © Connect wallet Contact information Summary Email address for order status updates a USD Store Credit email@example.com Receive exclusive offers and product news by email. You can unsubs...

Page Load Overview

0.54s
Total Load Time
0 KB
Total Size

Language Analysis

Primary Language

🏳️UNKNOWN
Code: unknown
Confidence:0%

Detection Details

Text Length:18 chars
Detector Agreement:0%

Website Classification

Primary Category

unknown0% confidence
Type: static
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
262.60.226.163Frankfurt am Main, Hesse, Germany
AS214351Femo It Solutions Limited
0142.251.110.95Google · CDNUnited States
AS15169Google LLC
0104.20.17.167Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0142.251.20.94Google · CDNUnited States
AS15169Google LLC
24--

Detected Technologies1

Nginxv1.30.3
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T176111E975CD0C809131006966C91F419ED83928B8B089CA8B5FB40FC8F597C64DCB998

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

24:0pIUJD66YOOR/TrHvVcN/2uN/r1cbu8vVSPWUvVX7EM:09WbrHyNXNp37N

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:868:AIACgBAAAAAACgQABACAAEAAAAAIBAAEAAACAFAAAAEAAAgAAAAAAAAgAEAAAAAAAAAAAAACBAAABABhAAAAABAIAAgAAAAA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00ffffffffffffff
Perceptual Hash:a333333333333333
Difference Hash:0c00000000000000
Wavelet Hash:00ffffff00000000
Color Hash:07000000000

Other Hashes

Crop Resistant:0c00000000000000

Scan History

Scan history not available

Unable to load historical scan data