Security Scan Report: dndair.com

Site favicon
Submitted: Completed: publiccompleted
This website contacted 15 IPs in 1 country across 9 domains to perform 23 HTTP transactions. The main domain is dndair.com and was registered 14 years ago.

Submitted URL: https://dndair.com/iv/cook/index.php

AI Security Verdict

Confirmed Scam

Confidence: 98%

10
Risk Score

Adobe-branded phishing kit on dndair.com harvesting email/password and then a 6-digit code, with Safe Browsing social-engineering hits and multi-feed phishing intel. Do not enter credentials.

Risk Factors (6)
Brand impersonation of Adobe on a non-Adobe, unranked domain
Credential (email + password) harvesting form followed by an OTP interception step
Post-credential submission redirects to attacker-controlled domains (jerimavon.com, clarkservic.icu) unrelated to the hosting domain
Google Safe Browsing Social Engineering detections (2)
Multi-source corroborated phishing threat-intel match on the primary domain
Fake 'shared document' login lure with multiple provider buttons (Outlook, AOL, Office 365, Yahoo!, Gmail) as a credential-collection kit
Domain age information unavailable

Details

Page Title

Cloud Share

Scan Type

public

Domain Name Analysis

The domain 'dndair.com' uses the commercial generic top-level domain (.com) and has no subdomain. The core label 'dndair' covers 6 characters split between 2 vowels and 4 consonants. Word splitting yields 2 words: dnd, air. The median word length lands at three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://dndair.com/iv/cook/index.php

Page Load Overview

1.76s
Total Load Time
612 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:570 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software65% confidence
Type: webapp
Method: ml+structural+ocr_tiebreaker

All Detected Categories

technology software
65%
documentation technical
36%

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
950.87.143.172Phoenix, Arizona, United States
AS46606Unified Layer
1142.251.110.95Google · CDNUnited States
AS15169Google LLC
1151.101.1.155Fastly · CDNUnited States
AS54113Fastly, Inc.
1104.18.10.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.251.14.95Google · CDNUnited States
AS15169Google LLC
1172.64.147.188Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1188.114.97.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.26.9.175Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1151.101.193.155Fastly · CDNUnited States
AS54113Fastly, Inc.
2315--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T17072F921BAAD0827107B90E473B6DF4935749513FE13CD0476FCA7E95FD4E6AA822388

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:KmtpYEeRKtf90dKDNzI5yZsD39u9ZMChxhaHx:KmLYEhEANzI5yZsD3sP14x

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:17244:T2AhEAMBQAKAsQpJMwggQHCgJR9BUQRnEgHEIH9IiAGwcEqCC9EAKIBFQQC4QYSgAESMDD4mGYtIBgACAoBAkHOc0EYQQADh

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:e7e7e7c7e7e7dfff
Perceptual Hash:b663c963cd9c4389
Difference Hash:cc4d0c0c4c0c342c
Wavelet Hash:e6e7878687878386
Color Hash:#d279b3

Scan History

Scan history not available

Unable to load historical scan data