ScanMalware.com

Security Scan Report: zenhof.kozow.com

Redirected to:
https://www.bing.com/
Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/23864b4d-bc9e-4ed4-8283-9bfa5c90f143Domain and IP registration (RDAP)/api/v1/rdap/23864b4d-bc9e-4ed4-8283-9bfa5c90f143How often this domain was scanned/api/v1/domain/stats/zenhof.kozow.comScan history for this domain/api/v1/domain/history/zenhof.kozow.com?limit=15
This website contacted 34 IPs in 5 countries across 15 domains to perform 435 HTTP transactions. The main domain is kozow.com and was registered 11 years ago.

Submitted URL: https://zenhof.kozow.com/go/QS86237468237dghcfdty36546

Effective URL:
https://www.bing.com/
Redirected

AI Security Verdict

Low Risk

Confidence: 78%

3
Risk Score

Entry via a flagged dynamic-DNS redirector (kozow.com) but the page actually served is the genuine Bing search page on bing.com: no credential or payment forms, no impersonation, no threat-intel or malware hits. Only the redirect-prone entry host warrants caution.

Risk Factors (3)
Entry host zenhof.kozow.com is a dynamic-DNS domain flagged by 3 HIGH Suricata ET DYN_DNS alerts, consistent with an ad/redirect funnel or open redirector
Multi-hop redirect chain (kozow.com → bing.com → login.microsoftonline.com → login.live.com) typical of redirect funnels, though the terminal host is the brand owner
Anti-analysis JavaScript detected (DevTools and right-click blocking)
Safety Factors (4)
Final rendered page is the genuine Bing search site; no impersonation of another entity's brand
No password, payment or disguised-credential fields anywhere on the page
No Indicators of Compromise, no JavaScript malware, no Safe Browsing or phishing/malware IDS hits
All form actions are same-origin search endpoints, no cross-origin credential submission or exfiltration
Domain age information unavailable

Details

Page Title

Suche – Microsoft Bing

Scan Type

public

Domain Name Analysis

Domain 'zenhof.kozow.com' uses the commercial generic top-level domain (.com); it also runs on subdomain 'zenhof'. The registrable portion 'kozow' spans 5 characters with two vowels and 3 consonants. Tokenizing the label suggests two words: kozo, w. Average segment length settles at 2.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://zenhof.kozow.com/go/QS86237468237dghcfdty36546

Page Load Overview

1.22s
Total Load Time
6.1 MB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:de
Text Length:4,658 chars
Detector Agreement:80%

Website Classification

Primary Category

social media network67% confidence
Type: spa
Method: ml+structural

All Detected Categories

social media network
67%
technology software
46%
government public service
38%
blog personal website
28%
corporate business
27%

Detected Features

Search
OG: website

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
3989.144.15.177Düsseldorf, North Rhine-Westphalia, Germany
AS207252Felix Gassan
1292.123.104.60Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
1223.207.210.139Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
1292.123.104.61Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
1223.207.210.132Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
1292.123.104.53Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
1292.123.104.58Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
1292.123.104.65Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
1292.123.104.66Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
122.21.15.185Akamai · CDNManchester, England, United Kingdom
AS20940Akamai International B.V.
43534--

Detected Technologies4

X-UA-Compatible
100%
Open-Graph-Protocolvwebsite
100%
Ubuntu
40%
Nginxv1.24.0
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T108949E6AA441303E812B47D0E4DA5B0E73275117BA864F20ED58D22C9BEDFDF1533A6E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

12288:DgiReJIHxcRyFUay3ycIE+APv3Yx4ZqrBVQ6fPHU+WIX3gGGC:neJIH6ay3ycIE+APv3Yx4ZqrBVQy/7gi

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:445918:AaI4EEqmyKiiBQvQgwgTiVBARaiQqCEhKAEWQJNIcoMEQEQJhOZEUCAImNQKEEkY0eQdWF4RNgAgMCiYWBEBBYv2wCcRshKh

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:43fce0700008ffff
Perceptual Hash:c162be1d25c135ee
Difference Hash:c6598cc2d2527056
Wavelet Hash:22fce0780008ffff
Color Hash:#9479d2

Other Hashes

Crop Resistant:c6598cc2d2527056,f2e6c6ce969f5d19,59608ccaf2d05a70,d1c79f9d195a7377

Scan History

Scan history not available

Unable to load historical scan data