Security Scan Report: citizenzbank.com

Redirected to:
http://ww1.citizenzbank.com/
Site favicon
Submitted: Completed: publiccompleted
This website contacted 14 IPs in 6 countries across 10 domains to perform 21 HTTP transactions. The main domain is citizenzbank.com and was registered 6 years ago.

Submitted URL: https://citizenzbank.com/

Effective URL:
http://ww1.citizenzbank.com/
Redirected

AI Security Verdict

High Risk

Confidence: 90%

8
Risk Score

Typosquatted banking domain with a Google Safe Browsing Social Engineering flag and redirect to a ww1 subdomain; likely phishing impersonation of Citizens Bank.

Risk Factors (5)
Google Safe Browsing Social Engineering threat
Typosquatted banking domain impersonating Citizens Bank
Redirect to ww1.citizenzbank.com subdomain
Banking/online-banking themed social engineering lure
Unranked domain claiming banking services
Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

The domain 'citizenzbank.com' uses the commercial generic top-level domain (.com) and has no subdomain. The registrable portion 'citizenzbank' spans 12 characters containing 4 vowels alongside 8 consonants. Breaking it apart gives three words: citizen, z, bank. Median word length comes out to four characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://citizenzbank.com/

Page Load Overview

2.19s
Total Load Time
280 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:72%
Script:Latin
Direction:ltr

Detection Details

Text Length:44 chars
Detector Agreement:100%

Website Classification

Primary Category

finance banking61% confidence
Type: dynamic
Method: ml+structural+ocr_tiebreaker

All Detected Categories

finance banking
61%
technology software
55%
blog personal website
55%
corporate business
44%
adult content
43%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
845.82.67.143Naaldwijk, South Holland, Netherlands
AS49981WorldStream B.V.
1208.91.196.145British Virgin Islands
AS40034Confluence Networks Inc
1188.114.97.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
185.9.201.81Frankfurt am Main, Hesse, Germany
AS202053UpCloud Ltd
137.19.194.81Datacamp · CDNFrankfurt am Main, Hesse, Germany
AS60068Datacamp Limited
1104.21.26.182Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1212.147.230.166Finland
AS202053UpCloud Ltd
194.237.101.74Frankfurt am Main, Hesse, Germany
AS202053UpCloud Ltd
1212.102.56.178Datacamp · CDNFrankfurt am Main, Hesse, Germany
AS60068Datacamp Limited
179.127.216.203Datacamp · CDNFrankfurt am Main, Hesse, Germany
AS60068Datacamp Limited
2114--

Detected Technologies3

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T142E2D61446F2082255972135DEBF6A8473355A23714CBC08BDCC9A40EFAD9BB8EB67F4

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:+ZBsjBjrAyhtbgt4MiIO/5/9SLAm4bkUoNG2NGAQ3GG:aMMX6SG8GAU

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:33045:xxUQGaAAgAcCSdCBETCuPQaYAUCYkUNdiYxQALqAxAIEQEMSQJASkOAEoZQFUC4UA6hYoAXBgQ4rAhpIAANcBJOBEyJg1CsI

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0042c300000000ff
Perceptual Hash:b464934e9b4eba26
Difference Hash:31969696b2b2b23b
Wavelet Hash:00e7ffdb421800ff
Color Hash:#e06ca2

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data