Security Scan Report: www.zknci.buzz

Redirected to:
https://www.zknci.buzz/LLexumXGJy/in-en/#1793792798519
Site favicon
Submitted: Completed: publiccompleted
This website contacted 6 IPs in 1 country across 8 domains to perform 39 HTTP transactions. The main domain is zknci.buzz and was registered 2 months ago.

Submitted URL: https://www.zknci.buzz/LLexumXGJy/in-en/

Effective URL:
https://www.zknci.buzz/LLexumXGJy/in-en/#1793792798519
Redirected

AI Security Verdict

High Risk

Confidence: 88%

8
Risk Score

Fake Airtel Diwali ₹2,000 cash giveaway on the unofficial zknci.buzz domain, using fabricated testimonials and a share-to-5-groups chain to lure users. No credential form here, but it is brand impersonation and a classic reward scam.

Risk Factors (6)
Brand impersonation of Airtel on a domain that is not Airtel's official domain
Unsolicited ₹2,000 cash giveaway tied to a festival, with no verifiable promotion terms
Share-to-unlock (5 groups / 20 friends) pyramid-style distribution mechanic
Fabricated user testimonials and engagement counters used as false social proof
Multiple sibling throwaway domains and 20 HIGH network IDS alerts associated with the *.buzz cluster
Circular redirect / JS history manipulation on the landing URL
Domain age information unavailable

Details

Page Title

🪔Airtel - दिवाली का तोहफ़ा!💵

Scan Type

public

Domain Name Analysis

The domain 'www.zknci.buzz' uses the .buzz top-level domain, featuring subdomain 'www'. The core label 'zknci' covers 5 characters holding one vowel versus four consonants. Tokenizing the label suggests three words: z, k, nci. Median word length is one character. No strong language cues emerged from the frequency lists.

Screenshot

पा 00000! ¥2,000 000 0000! ए 000 पर ए oo ए। एए।॥ए oOo ए doo ३2,000 0 noo Oooo पा oo! 00 ॥॥| SS Gr 26K Likes-4K Comments

Page Load Overview

0.37s
Total Load Time
320 KB
Total Size

Language Analysis

Primary Language

🇮🇳Hindi
Code: hi
Confidence:52%
Script:Devanagari
Direction:ltr

Detection Details

Text Length:1,687 chars
Detector Agreement:100%

Website Classification

Primary Category

social media network92% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

social media network
92%
cryptocurrency blockchain
88%
adult content
87%
blog personal website
86%
healthcare medical
84%

Detected Features

Comments
OG: website

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
9188.114.97.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6188.114.96.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6104.16.133.229Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6172.67.150.132Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6172.67.131.100Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6104.21.3.251Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
396--

Detected Technologies5

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1FBB22E14A711B1B702BBB9C8B0BA6F35A0F1F73BC35982656AAC12DC0FC7CB47565290

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:cHJ9/gJ9/GyJ9/LMZCQmFzcsjx5/tCNa1Ls8rUNdPmHy7nE6usFjDm9:cRLQQmFYsjhZqNdPxg6usFjDm9

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:23466:eBVqLJIiAJUMCqhQIAAGELOInpwfVDEuCkkJwyDMTCADFqxJIi0zBhAtoHAOCcZAQYgAgSWABPIKVFwkRQgqGTBApVSoMABm

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Scan History

Scan history not available

Unable to load historical scan data