Scan report · 16 days agoPublic
evrokvarts.bg
79.98.104.4AS8860 · BGthis page offers the visitor no link at all, yet its own script carries the address api-gofiq8bn7.thorkildkristensen.sbs
a different site from the one being visitedand navigates there with what the visitor types. A page whose only destination is somewhere else is a hand-off, not a document
Verdict
1 of 7 enginesSuspiciousAutomated
- Browser Analysissuspicious
- Content Inspectionclean
- Threat Intelligenceclean
- Network & Hostingclean
- Related Infrastructureclean
- Domain Intelligenceunknown
- TLS Fingerprintunknown
Be careful — warning signs found
AutomatedThis site shows signs commonly seen in scams or impersonation, but we could not confirm it for certain. It may be a real threat, or it may be a legitimate site that simply looks unusual to our automated checks.
What to do
Avoid entering passwords or payment details until you are sure it is genuine. Open the company directly from its known website or app instead of this link. Check the evidence below and escalate to your analyst if unsure.
"Suspicious" is a caution, not a confirmation — it can be a false alarm. The evidence below explains why it was flagged.
Infrastructure
- IP
- 79.98.104.4DELTA-BG-AS - Delta HighTech Ltd., BG · AS8860BG
- TLS
- CN=YR2, O=Let's Encrypt, C=US · expires Nov 18, 2026
40 malicious6 suspicious
Hashes & fingerprints
Page Hash07326855cfdbd56585159702e769ec87a79a5cf742811a83c30717b36bf1fe8fDOM Hash1c6a4b8de0734c5ce5de08fed1f338496021220abff4951c2706876ab9f82a70Screenshot pHashed56cdad966132a0JARM29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3aeJA4Xa373a9f83c6b_7022c563de38_2e3757343cb0Cert Thumbprint2584F1AE3D0DDE9F9E3B15D8E060DE299D69304CCert IssuerCN=YR2, O=Let's Encrypt, C=US
Page capture
LiveTitle “CloudVault | File Access”
Engines
7 · time to verdictPage
- HTTP
- 200 · Completed
- Title
- CloudVault | File Access
- Load
- 1.11 s · 3 requests
Stack · 1LiteSpeed