ScanMalware.com

Security Scan Report: buildwithespresso.online

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/f07adeeb-600c-4391-a37c-81d7035eadfdDomain and IP registration (RDAP)/api/v1/rdap/f07adeeb-600c-4391-a37c-81d7035eadfdHow often this domain was scanned/api/v1/domain/stats/buildwithespresso.onlineScan history for this domain/api/v1/domain/history/buildwithespresso.online?limit=15
This website contacted 1 IP in 1 country across 1 domain to perform 13 HTTP transactions. The main domain is buildwithespresso.online and was registered 2 weeks ago.

Submitted URL: https://buildwithespresso.online/

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Confirmed malicious ClickFix recruitment lure impersonating Espresso Protocol; hunting rule/kit-roster and IDS hits show it delivers the OverLord stealer. Do not paste or run any commands it provides.

Risk Factors (5)
Known malicious recruitment/ClickFix stealer kit (OverLord) matched by analyst-vetted roster and hunting rule
ClickFix clipboard-execution payload delivery
Impersonation of the Espresso Protocol brand on a non-official domain
High-severity IDS alert for PowerShell stager traffic
Gated 'private invitation' funnel designed to obtain a referral code and drive payload execution
Domain age information unavailable

Details

Page Title

Espresso Protocol — Developer Invitation

Scan Type

public

Domain Name Analysis

The domain name 'buildwithespresso.online' uses the modern generic top-level domain (.online) while skipping any subdomain. Its registrable label 'buildwithespresso' stretches across 17 characters split between six vowels and 11 consonants. It segments into 3 words: build, with, espresso. Expect five characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

$ Espresso Missions Contribute ( Starta conversation © PRIVATE INVITATION Your protocol experience caught our attention. We're inviting experienced engineers from leading open- source hain ecosyst...

Page Load Overview

2.01s
Total Load Time
561 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:1,383 chars
Detector Agreement:100%

All Detected Languages

🇺🇸en(96%)🇮🇹it(4%)

Website Classification

Primary Category

technology software47% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
47%
documentation technical
47%
cryptocurrency blockchain
44%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
13193.160.32.188Nuremberg, Bavaria, Germany
AS206216Advin Services LLC
131--

Detected Technologies2

Ubuntu
40%
Nginxv1.28.3
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1CC83A47493E40368F96B0A5EED973D9405E638A37FC81848F21B54835BBF990392F52E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:8MHDyMW8oOUg3jO/87C0k4qYNGlI8c+lbkJqmkxq7kWOrOCnokCkDXkrqmkxqe3+:8MHDLYk9kokCkLk+3+

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:86300:cBQBwCsQCBQxheCgui8Mmjj2QDAQSAGYUACHIQYJFQ0nXCMAmJdyYDKGpECAgDBkABEqAEABJOAICoJEIABIQgJhAHVXCDFw

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffc3c3c3c3c3c3ff
Perceptual Hash:ed6d926992c2c3c6
Difference Hash:2207070707070730
Wavelet Hash:d38383838383c3ff
Color Hash:06000038000

Other Hashes

Crop Resistant:2207070707070730,2404868686a48464

Scan History

Scan history not available

Unable to load historical scan data