ScanMalware.com

Security Scan Report: ninjavan.cokyt.top

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/1838ac96-9add-493f-ba35-4d463878465cDomain and IP registration (RDAP)/api/v1/rdap/1838ac96-9add-493f-ba35-4d463878465cHow often this domain was scanned/api/v1/domain/stats/ninjavan.cokyt.topScan history for this domain/api/v1/domain/history/ninjavan.cokyt.top?limit=15
This website contacted 2 IPs in 1 country across 1 domain to perform 8 HTTP transactions. The main domain is cokyt.top and was registered 3 months ago.

Submitted URL: https://ninjavan.cokyt.top

AI Security Verdict

High Risk

Confidence: 78%

8
Risk Score

Subdomain ninjavan.cokyt.top impersonates NinjaVan on a new .top domain flagged by threat intelligence as a phishing framework; malicious infrastructure confirmed despite the origin currently returning a 521 error.

Risk Factors (5)
Content-malware threat-intel match on the primary domain (phishing framework)
Brand impersonation of NinjaVan via subdomain naming on an unrelated domain
Domain only 73 days old and unranked (no Cisco Umbrella presence)
Multiple HIGH-severity IDS alerts for hostile .top domain traffic
Origin server currently down (Cloudflare 521), suggesting the phishing page has been taken offline after abuse
Domain age information unavailable

Details

Page Title

cokyt.top | 521: Web server is down

Scan Type

public

Domain Name Analysis

The domain name 'ninjavan.cokyt.top' uses the .top top-level domain; it also runs on subdomain 'ninjavan'. Count 5 characters in 'cokyt' split between one vowel and 4 consonants. Splitting it apart reveals three words: co, ky, t. The median word length lands at 2 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://ninjavan.cokyt.top

Page Load Overview

0.65s
Total Load Time
23 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:687 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical77% confidence
Type: static
Method: ml+structural

All Detected Categories

documentation technical
77%
technology software
68%
government public service
50%
cryptocurrency blockchain
45%
news media journalism
39%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
4172.67.203.221Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4104.21.74.152Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
82--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T185E15771B1B552B70093C1A23695EB6A7AE0C613C7EF4584B3DDC2632F9FE81E903664

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

96:ljHjCIju/Da/D2KUu4G4Fh8/G4FP3424Fh+skKmk2OLwmNnwL5HFRc3YaQxJ:ljHjDjuLa/Cq4emTVO/Q85HF+3jeJ

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:6952:IiRKBIUCobYAKBcIAdAEwgwBDDFOK0ARIIZCEOAKBKIMi2LGhCJQAEaojCAFDoLMBAkNhDgqAURQFAiAFEItAVAmEAJgZYQb

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:c7c70000d7f7ffff
Perceptual Hash:b4389abc9a676531
Difference Hash:1c3e8e8a3406061c
Wavelet Hash:c7000000d7f3f7ff
Color Hash:#ac6553

Other Hashes

Crop Resistant:1c3e8e8a3406061c

Scan History

Scan history not available

Unable to load historical scan data