ScanMalware.com

Security Scan Report: 1.xn--nebl.xn--9dbq2a.account.auth.google.com.1.145.life

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/f1743b9f-3a20-41ea-ac28-47fbf789cf4cDomain and IP registration (RDAP)/api/v1/rdap/f1743b9f-3a20-41ea-ac28-47fbf789cf4cHow often this domain was scanned/api/v1/domain/stats/1.xn--nebl.xn--9dbq2a.account.auth.google.com.1.145.lifeScan history for this domain/api/v1/domain/history/1.xn--nebl.xn--9dbq2a.account.auth.google.com.1.145.life?limit=15
This website contacted 2 IPs in 1 country across 2 domains to perform 4 HTTP transactions. The main domain is 145.life and was registered 6 months ago.

Submitted URL: https://1.xn--nebl.xn--9dbq2a.account.auth.google.com.1.145.life

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

Credential-phishing page impersonating Google Sign-in on a spoofed nested .life subdomain, flagged by Google Safe Browsing for social engineering; treat as malicious.

Risk Factors (6)
Google Safe Browsing Social Engineering detection
Brand impersonation of Google login on a non-Google domain
Deceptive multi-label subdomain crafted to look like account.auth.google.com
Page text addresses scanners/analysts and self-declares 'Research Only' to avoid classification
Unranked domain posing as a major brand
Suricata HIGH alerts for requests to a suspicious .life domain (corroborating, generic)
Domain age information unavailable

Details

Page Title

Sign in – Google Accounts

Scan Type

public

Domain Name Analysis

Within the .life top-level domain, '1.xn--nebl.xn--9dbq2a.account.auth.google.com.1.145.life' is registered; it also runs on subdomain '1.xn--nebl.xn--9dbq2a.account.auth.google.com.1'. Count 3 characters in '145' holding 0 vowels versus zero consonants, notching three digits. It segments into one word: 145. No strong language cues emerged from the frequency lists.

Screenshot

[Google Sign in Use your Google Account Email or phone Forgot email? Not your computer? Use a Private Window to sign in. Create account Spoofing PoC — Research Only

Page Load Overview

0.94s
Total Load Time
3 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:199 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software43% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
43%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
2216.198.79.65Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
264.29.17.65Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
42--

Detected Technologies2

Vercel
40%
HSTS
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1DCB1DBB766A604227507C46D2BA38B4A22657403F016D5283EED7298CFCEA9495E27F8

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

96:nBr76SpS6aLYFL1fR5qWpkI2VLE1Pw+xTvoPGTwiQqu91AzpMuQsGIet58xj0krX:Br76SpSpLYFL1fR5qqkI2Kpw+xj8GTwo

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:5191:KAjKJBQARRABSSABBEAEEiIgCkgJAAgCEKAAELIVlhRQqAJAgEEYiSBJBIEBEQAAAFwSgmAEBFEYlEgoAJggABICAohBCCQE

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0000181810100800
Perceptual Hash:cc9933661399ce66
Difference Hash:0010323224241000
Wavelet Hash:0c0c1c1c171f0f0f
Color Hash:070000001c0

Other Hashes

Crop Resistant:0010323224241000

Scan History

Scan history not available

Unable to load historical scan data