Security Scan Report: lnk.ink

Redirected to:
https://vmi3580075.contaboserver.net/rdvv/sen/rena/msg.php
Site favicon
Submitted: Completed: publiccompleted
This website contacted 9 IPs in 2 countries across 6 domains to perform 35 HTTP transactions. The main domain is lnk.ink and was registered 1 year 5 months ago.

Submitted URL: https://lnk.ink/Seur-Paquete

Effective URL:
https://vmi3580075.contaboserver.net/rdvv/sen/rena/msg.php
Redirected

The Cisco Umbrella rank of the primary domain is #604,740 of the top 1 million websites

AI Security Verdict

High Risk

Confidence: 80%

8
Risk Score

Fake SEUR package-tracking page reached via a shortener link, hosted on an unrelated VPS and flagged as phishing by OpenPhish. It uses a 24-hour 'action required' deadline to collect data. Do not enter personal information.

Risk Factors (5)
Impersonation of a different entity's brand (SEUR) on a non-official host (contaboserver.net VPS)
Cross-domain redirect from a link shortener to an arbitrary VPS path
Two single-source OpenPhish phishing URL indicators covering both the entry and final URLs
Artificial 24-hour deadline pressuring visitors to submit personal data
Machine-learning classifier flags the page as a phishing scam
Domain age information unavailable

Details

Page Title

SEUR: Envío y transporte de paquetería y mensajería | SEUR

Scan Type

public

Domain Name Analysis

Within the .ink top-level domain, 'lnk.ink' is registered. The second-level label 'lnk' is 3 characters long with zero vowels and three consonants. Breaking it apart gives two words: ln, k. Median word length is 1.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://lnk.ink/Seur-Paquete

Page Load Overview

2.06s
Total Load Time
360 KB
Total Size

Language Analysis

Primary Language

🇪🇸Spanish
Code: es
Confidence:46%
Script:Latin
Direction:ltr

Detection Details

Text Length:1,528 chars
Detector Agreement:75%

Website Classification

Primary Category

phishing scam46% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

phishing scam
46%
government public service
38%
blog personal website
33%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
11194.163.175.27Lauterbourg, Grand Est, France
AS51167Contabo GmbH
3188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3104.17.207.5Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3151.101.1.155Fastly · CDNUnited States
AS54113Fastly, Inc.
3142.251.20.95Google · CDNUnited States
AS15169Google LLC
3188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3104.17.208.5Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3151.101.129.155Fastly · CDNUnited States
AS54113Fastly, Inc.
359--

Detected Technologies7

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1C452882140FB95A7145392C69E252A1BAFC5C707DB0A5B49B2FE07CD1FCBC86CD27928

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

96:ZVcGe9oN01ksfgMS5SZVhMs2Rc+W/vPkGHyO9bJLNgkvKd:ZeGe9oN4kdFolMs26+Qk2ZhvKd

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:13836:Heh0SmJiTAEAAZ2DIAg0M2YZEhSAFUKgAZZOCZQChNYEECBAAIgqQJAVy6KoQSBxCJkxwWACKBqQpJXAxLgAAAY5A0OAKEKI

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:fbffffffffff4200
Perceptual Hash:b8c928e94be94bc9
Difference Hash:33b2a22a589696ed
Wavelet Hash:b9dafedecec60000
Color Hash:#6c7be0

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data