Security Scan Report: 2hlk.fptingche.com

Redirected to:
https://2hlk.fptingche.com/1.html?channelCode=tbl199
Submitted: Completed: publiccompleted
This website contacted 5 IPs in 2 countries across 2 domains to perform 38 HTTP transactions. The main domain is fptingche.com and was registered 1 year 5 months ago.

Submitted URL: https://2hlk.fptingche.com

Effective URL:
https://2hlk.fptingche.com/1.html?channelCode=tbl199
Redirected

AI Security Verdict

Moderate Risk

Confidence: 76%

5
Risk Score

Landing page instructs users to install an Android package while in airplane mode to defeat antivirus detection — malware distribution behavior; do not download or install anything.

Risk Factors (4)
Explicit instructions to enable airplane mode to bypass malware detection during APK installation
Distribution page for a package the page itself says is flagged as malicious
Cross-origin requests to an unranked punycode IDN domain
Channel-coded, content-free landing page with no legitimate business information
Safety Factors (5)
No credential or payment form on the page (0 password, 0 payment, 0 forms)
No threat-intelligence match against the page or its loaded resources
No JavaScript malware patterns or native hunting-rule hits
Domain registered 523 days ago
No concrete malicious signal (no IoC / hunting rule / Safe-Browsing / IDS / credential form / brand impersonation) — elevated risk rested on domain age or reputation alone; clamped from 8 to 5
Domain age information unavailable

Details

Page Title

欢迎访问

Scan Type

public

Domain Name Analysis

Within the commercial generic top-level domain (.com), '2hlk.fptingche.com' is registered with subdomain '2hlk'. Its registrable label 'fptingche' stretches across 9 characters with two vowels and 7 consonants. Splitting it apart reveals three words: fp, ting, che. Average segment length settles at 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

AUF |X relbar

Page Load Overview

9.88s
Total Load Time
718 KB
Total Size

Language Analysis

Primary Language

🇨🇳Chinese
Code: zh
Confidence:60%
Script:Han
Direction:ltr

Detection Details

HTML Lang Attribute:zh-CN
Text Length:40 chars
Detector Agreement:50%

Website Classification

Primary Category

unknown0% confidence
Type: static
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
10193.239.151.32Hong Kong
AS137427KIDC LIMITED
745.91.227.72Hong Kong
AS137427KIDC LIMITED
747.254.186.254Frankfurt am Main, Hesse, Germany
AS45102Alibaba (US) Technology Co., Ltd.
7138.113.219.71Meteverse · CDNFrankfurt am Main, Hesse, Germany
AS54994Meteverse Limited.
7193.239.151.33Hong Kong
AS137427KIDC LIMITED
385--

Detected Technologies1

Nginxv1.25.2
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1AC9255660744912FBBAD07C82C24FF4CAE9AB2CED8E6C89D9D740AC2B71797D47850D0

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:vicpFrcZT/YzAKcT5GjkENwaXFRAAfF4BTp6R:W8ApT5GlNwOR7F4dwR

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:20266:AJD4QCEyTUCBCIsQATiMJQiZpr4IgFslBBoCgwJiXJ9UhCoAoxYSGwABJE/wBEORAhJGhCQaYgEI86MXRHqABQISIQQEGktQ

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:1018181818180018
Perceptual Hash:cccc666789339933
Difference Hash:32b2b2b2b2322832
Wavelet Hash:3c3c3c3c3c3c383c
Color Hash:38000c00008

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data