Security Scan Report: postzustellen.com

Redirected to:
https://swispostch.com/portal/home/index.php?MTc5MzY4NDA2NTYxOGNmMjNmN...
Submitted: Completed: publiccompleted
This website contacted 3 IPs in 3 countries across 3 domains to perform 12 HTTP transactions. The main domain is postzustellen.com and was registered 1 week ago.

Submitted URL: https://postzustellen.com/portal

Effective URL:
https://swispostch.com/portal/home/index.php?MTc5MzY4NDA2NTYxOGNmMjNmN...
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 92%

10
Risk Score

Lookalike 'Swiss Post' portal on swispostch.com reached via a 4-day-old redirect domain; a decoy math CAPTCHA fronts hidden LOGIN/PASSWORD/CARD_NUMBER fields — a credential and card phishing kit.

Risk Factors (5)
Hidden credential and card-number fields collected behind a decoy arithmetic challenge
Brand impersonation of Swiss Post on a lookalike non-official domain
Obfuscated base64 parameter in the landing URL after multi-hop cross-domain redirects
Entry domain only 4 days old and unranked in Cisco Umbrella
Pretends to be 'protected by reCAPTCHA' while serving its own self-made challenge
Domain age information unavailable

Details

Page Title

.

Scan Type

public

Domain Name Analysis

Domain 'postzustellen.com' uses the commercial generic top-level domain (.com) while skipping any subdomain. Its registrable label 'postzustellen' stretches across 13 characters holding 4 vowels versus 9 consonants. Breaking it apart gives four words: post, zu, st, ellen. Average segment length settles at three characters. No strong language cues emerged from the frequency lists.

Screenshot

uP Bitte lésen Sie diese einfache mathematische Rechnung, um zu bestatigen, dass Sie ein Mensch und kein Roboter sind. 7+6= Bitte geben Sie das Ergebnis ein Diese Seite ist durch reCAPTCHA geschiitz...

Page Load Overview

0.88s
Total Load Time
54 KB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:50%
Script:Latin
Direction:ltr

Detection Details

Text Length:225 chars
Detector Agreement:100%

Website Classification

Primary Category

adult content60% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

adult content
60%
finance banking
44%
government public service
33%
documentation technical
30%
e-commerce
20%

Detected Features

Payment

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
4107.6.142.186Amsterdam, North Holland, Netherlands
AS32475Internap Holding LLC
450.6.42.251Mumbai, Maharashtra, India
AS31898Oracle Corporation
4142.251.127.95Google · CDNUnited States
AS15169Google LLC
123--

Detected Technologies2

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1EBB2C66A9D571C035B02916627EE2BC9196D938FF5C6C8ED3E0DD348CF8A76908C57C8

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:PC9V6BuHP2IHo9SveEaykhCL87VW0lX5IMb5HOZ0WefCdCXFJfz9PH6sE:P8V6OP2Uo9SyEL8RD5IMb5HA0T6oFJfg

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:23927:AAeQbhjAC4QsAMEgJ61GpmKOYCAqAGJIzADaAVE4bggCdAAESiy0MADjKggNkEcjCMAhpMSLCQQOIECUgBcaGCKAFU5YDUwB

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:e7e7e7e7e7ffffff
Perceptual Hash:e6669b99cccc8839
Difference Hash:280c4c0408100000
Wavelet Hash:0707272707070f0f
Color Hash:N/A

Other Hashes

Crop Resistant:280c4c0408100000

Scan History

Scan history not available

Unable to load historical scan data