Security Scan Report: www.zenoyup888.com

Site favicon
Submitted: Completed: publiccompleted
This website contacted 2 IPs in 1 country across 1 domain to perform 2 HTTP transactions. The main domain is zenoyup888.com and was registered 6 years ago.

Submitted URL: https://www.zenoyup888.com/?token=KwdT92yUigzULwyT9gza1gCKn3zLHwBa

AI Security Verdict

Moderate Risk

Confidence: 70%

5
Risk Score

Aged but unranked domain serving a credential login under an 'account suspended' pretext, with displayed text contradicting the page body. Login should not be trusted; do not enter credentials.

Risk Factors (5)
Credential-capture login form paired with an urgent account-suspension pretext
Mismatch between displayed OCR text (English suspension notice) and HTML content (Chinese enterprise login page) suggests injected or cloaked content
Domain unranked in Cisco Umbrella (not in top 1M) despite being 6 years old — aged domains reused for phishing are common
Generic 'enterprise collaboration / unified identity' branding with no real company identity behind it
Tokenized URL typical of targeted or one-time phishing campaign links
Safety Factors (6)
Domain is well established (registered 2019-11-24, ~2509 days old)
No threat-intelligence Indicators of Compromise matches
No JavaScript malware (YARA) patterns detected
No Suricata network IDS alerts
No cross-origin credential exfiltration; all JavaScript served from the site's own domain
Established domain (2509 days old) with no strong malicious indicators — risk clamped from 7 to 5
Domain age information unavailable

Details

Page Title

企业协同中心 · 安全登录

Scan Type

public

Domain Name Analysis

Within the commercial generic top-level domain (.com), 'www.zenoyup888.com' is registered, featuring subdomain 'www'. The registrable portion 'zenoyup888' spans 10 characters containing three vowels alongside four consonants, notching 3 digits. Breaking it apart gives three words: zeno, yup, 888. Expect 3 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://www.zenoyup888.com/?token=KwdT92yUigzULwyT9gza1gCKn3zLHwBa

Page Load Overview

0.56s
Total Load Time
11 KB
Total Size

Language Analysis

Primary Language

🇨🇳Chinese
Code: zh
Confidence:60%
Script:Han
Direction:ltr

Detection Details

HTML Lang Attribute:zh-CN
Text Length:237 chars
Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence
Type: webapp
Method: structural

All Detected Categories

No categories detected

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1104.21.12.136Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1172.67.152.137Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
22--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T169112F46EA44001DB4D64198FE66A2997BA680F0A15A0B2C7CC9D535C39DB28C9FF06C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

24:hR/C0A4UVHrk+G93hI4S0qX46bv4pUjka:TcvN49x19iFwpUt

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:867:ACAAAQAAIBhEAAAACAAAAAAAAIAAAAABAAAgAAAAAAAAAAAAAAACAAACAAAAAAAAAAAAAAAEAABAAAAAAEQwCAAAABAAAAEA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:c7c7fff7ffffffff
Perceptual Hash:b333332666cecc89
Difference Hash:0c1c100400000000
Wavelet Hash:04043c14f0f0f0f0
Color Hash:#40bf51

Other Hashes

Crop Resistant:0c1c100400000000

Scan History

Scan history not available

Unable to load historical scan data