Security Scan Report: web.whatsapp.zt.hl.cn

Submitted: Completed: publiccompleted
This website contacted 1 IP in 1 country across 1 domain to perform 5 HTTP transactions. The main domain is zt.hl.cn and was registered 8 months ago.

Submitted URL: https://web.whatsapp.zt.hl.cn/

AI Security Verdict

High Risk

Confidence: 72%

7
Risk Score

Unranked free-host subdomain (web.whatsapp.zt.hl.cn) presenting itself as the official Telegram download site — brand impersonation of a different entity, with a high-severity Spamhaus IDS alert. No credential form, but do not download or trust it.

Risk Factors (4)
Impersonation of a different entity's brand (Telegram) on a non-Telegram domain
Hostname references 'whatsapp' while content claims to be Telegram — mismatched brand signals
Free/shared-hosting subdomain with unknown page age and no reputation
High-severity IDS alert (ET DROP Spamhaus DROP listed traffic)
Domain age information unavailable

Details

Page Title

Telegram - 安全、快速、免费的消息应用 | 官方下载

Scan Type

public

Domain Name Analysis

The domain 'web.whatsapp.zt.hl.cn' uses the Chinese country-code top-level domain (.hl.cn) with subdomain 'web.whatsapp'. Count 2 characters in 'zt' holding zero vowels versus 2 consonants. Splitting it apart reveals two words: z, t. Expect 1 character per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Bs This site can’t be reached The webpage at https://web.whatsapp.zt.hl.cn/ might be temporarily down or it may have moved permanently to a new web address ERR_TUNNEL_CONNECTEON_FATLED

Page Load Overview

2.98s
Total Load Time
163 KB
Total Size

Language Analysis

Primary Language

🇨🇳Chinese
Code: zh
Confidence:60%
Script:Han
Direction:ltr

Detection Details

HTML Lang Attribute:zh-CN
Text Length:2,403 chars
Detector Agreement:60%

Website Classification

Primary Category

social media network52% confidence
Type: static
Method: ml+structural

All Detected Categories

social media network
52%
technology software
40%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
5168.76.146.209South Africa
AS137951ASLINE LIMITED
51--

Detected Technologies2

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T128048F77329A063986558498F05B43099F20B143F506C9BCB9BCBAD9BFDED06107BB78

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:ifQho9PKBb9Js3q9Jzbs6tlg3SBKwdQWgceIszM2bMy8Oldw:ZhoC9JSqzzbs6o3Sj3gcrs42eA+

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:184496:E2EOHADTBA1QS5IeEgbABF5fQkJAOAJoCBCQwEMCkPD+8CNAIgKsSCIaGCkMmYEkMGNSAXIYlKTilHwggjkfgB4EACQMCUEo

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffcfc3c7ffffffff
Perceptual Hash:b3318ccccc673333
Difference Hash:00180c1400000000
Wavelet Hash:f0d0c0ccf0f0f0f0
Color Hash:N/A

Other Hashes

Crop Resistant:00180c1400000000

Scan History

Scan history not available

Unable to load historical scan data