ScanMalware.com

Security Scan Report: xn--d1a.rest-icone.rent

Redirected to:
https://try-ondrela.com/ondrela/product?vndr=evf&evf=1&offid=98&affili...
Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/36167557-3558-4596-9879-54b00cc7112cDomain and IP registration (RDAP)/api/v1/rdap/36167557-3558-4596-9879-54b00cc7112cHow often this domain was scanned/api/v1/domain/stats/xn--d1a.rest-icone.rentScan history for this domain/api/v1/domain/history/xn--d1a.rest-icone.rent?limit=15
This website contacted 21 IPs in 3 countries across 18 domains to perform 87 HTTP transactions. The main domain is rest-icone.rent and was registered 1 month ago.

Submitted URL: https://xn--d1a.rest-icone.rent/WnRNUZvW/

Effective URL:
https://try-ondrela.com/ondrela/product?vndr=evf&evf=1&offid=98&affili...
Redirected

AI Security Verdict

Moderate Risk

Confidence: 60%

4
Risk Score

Affiliate-driven product landing page for an 'Ondrela' tracker card reached via an unrelated punycode redirect. No forms, credentials or payment capture on the page and no threat-intel or malware hits, but the unknown-age destination, urgency marketing and 81% phishing classifier score warrant caution.

Risk Factors (4)
Marketing redirect chain from an unrelated punycode entry domain into an affiliate-tracked product funnel
Destination domain reputation/age unknown; the measured 131-day age belongs to the entry domain only
ML classifier returns an 81% 'phishing scam' probability
High-pressure discount timers and unverifiable customer-count/testimonial claims
Safety Factors (6)
No threat-intelligence Indicators of Compromise matched the page or its resources
No JavaScript YARA malware patterns and no known malicious kit in the roster
No network IDS alerts; no cross-origin credential exfiltration detected
Zero forms, zero password fields, zero payment fields on the captured page
Self-branding: the destination domain try-ondrela.com matches the product brand 'Ondrela' — no impersonation of a third-party brand
Cross-origin POST goes only to the site's own domain (try-ondrela.com/send-meta-event), consistent with analytics/meta-event tracking
Domain age information unavailable

Details

Page Title

Zeitlich begrenzte Aktion: 70 % Rabatt auf Ondrela! | Ondrela

Scan Type

public

Domain Name Analysis

The domain name 'xn--d1a.rest-icone.rent' uses the .rent top-level domain; it also runs on subdomain 'xn--d1a'. The second-level label 'rest-icone' is 10 characters long split between four vowels and 5 consonants, along with one hyphen. Segmentation suggests three words: rest, i, cone. Expect 4 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://xn--d1a.rest-icone.rent/WnRNUZvW/

Page Load Overview

0.46s
Total Load Time
3.4 MB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:de
Text Length:8,142 chars
Detector Agreement:75%

Website Classification

Primary Category

finance banking93% confidence
Type: spa
Method: ml+structural

All Detected Categories

finance banking
93%
phishing scam
81%
adult content
69%
government public service
68%
e-commerce shopping
64%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
7104.18.29.91Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4146.190.240.53Toronto, Ontario, Canada
AS14061DigitalOcean, LLC
4172.67.148.159Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4172.67.160.126Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4142.251.20.94Google · CDNUnited States
AS15169Google LLC
434.36.244.111Google · CDNKansas City, Missouri, United States
AS396982Google LLC
4142.251.110.97Google · CDNUnited States
AS15169Google LLC
4151.101.66.217Fastly · CDNUnited States
AS54113Fastly, Inc.
4104.26.6.169Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4157.240.0.6Facebook · CDNFrankfurt am Main, Hesse, Germany
AS32934Facebook, Inc.
8721--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1F654297694BA203F8C1381DC9B6D255A6A1EF0EFE76E8480B6DC07107F97CD29D0B658

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:RJ+TiY/11ctrAdniYS0Q7jrJ+kI60TfdF51bD5WfKok3QXtkAD6XbqvWYcC/fwo8:AXEyvgrJ+kahkD6XbqvWYcGJaGy

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:285013:IBIwc6FICVQEAAw8Q9ARRhbnaQkCoWaC6GSQ04HhQDzF8TicCEuAnD4YgMAkAhAcFkUgQrKICEIBKOJCBRLkCAEYOI6gAAxq

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00f9c9c0d1f3ff7f
Perceptual Hash:ea5a176c5916331b
Difference Hash:c9011911332764d6
Wavelet Hash:00e0c0c0d1f3ff7f
Color Hash:#1f5393

Other Hashes

Crop Resistant:c9011911332764d6,018989d9dc290041,0e27434351712171,112504c43106c6d2,333232eaf9d18193,08a6588aa6a65984

Scan History

Scan history not available

Unable to load historical scan data