Security Scan Report: citibabank.com

Redirected to:
http://ww19.citibabank.com/
Site favicon
Submitted: Completed: publiccompleted
This website contacted 15 IPs in 5 countries across 10 domains to perform 21 HTTP transactions. The main domain is citibabank.com and was registered 3 years 7 months ago.

Submitted URL: https://citibabank.com/

Effective URL:
http://ww19.citibabank.com/
Redirected

AI Security Verdict

High Risk

Confidence: 85%

8
Risk Score

Typosquatted bank-like domain flagged by Safe Browsing for social engineering and redirecting to ad-serving infrastructure; no real content. Avoid.

Risk Factors (4)
Safe Browsing Social Engineering detection on the domain
Typosquatted bank-like hostname on a domain not owned by the bank
Redirect to a 'ww19.' subdomain associated with ad/parking rotators
Unranked domain with no legitimate organisation footprint despite the banking name
Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

You're looking at domain 'citibabank.com' on the commercial generic top-level domain (.com) and has no subdomain. Its registrable label 'citibabank' stretches across 10 characters containing 4 vowels alongside six consonants. Tokenizing the label suggests three words: citi, ba, bank. Expect 4 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://citibabank.com/

Page Load Overview

2.24s
Total Load Time
279 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:72%
Script:Latin
Direction:ltr

Detection Details

Text Length:44 chars
Detector Agreement:100%

Website Classification

Primary Category

blog personal website52% confidence
Type: dynamic
Method: ml+structural+ocr_tiebreaker

All Detected Categories

blog personal website
52%
technology software
51%
adult content
38%
government public service
33%
documentation technical
33%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
7208.91.196.145British Virgin Islands
AS40034Confluence Networks Inc
1216.245.197.43Dallas, Texas, United States
AS46475Limestone Networks, Inc.
1188.114.96.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1172.67.138.86Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
185.9.206.5Frankfurt am Main, Hesse, Germany
AS202053UpCloud Ltd
1212.102.56.179Datacamp · CDNFrankfurt am Main, Hesse, Germany
AS60068Datacamp Limited
1188.114.97.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
137.19.194.81Datacamp · CDNFrankfurt am Main, Hesse, Germany
AS60068Datacamp Limited
1104.21.26.182Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
185.9.203.211Frankfurt am Main, Hesse, Germany
AS202053UpCloud Ltd
2115--

Detected Technologies3

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T119E2B51446F2042115962075DEBF6F8477351A63358CEC08BD8CAA40EF9EABB4EB67F4

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:+ZBsjBjrAyhtbgt4MiIO/5/9SLW6Nq0RJXK2KyQlGG:aMM1Q+Xt1C

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:33154:wgiHTBBqI0bSQKCIoQsCy4uRTyEAgIxBpgQlzKGRYHAAUAENTgh6E8jMBIwekQG1E5ABKqFA1oQxEhggR0CEJYEAGQeHJLgT

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0042c300000000ff
Perceptual Hash:b4649b4e9a4eba26
Difference Hash:31969696b2b2b23b
Wavelet Hash:00f7e7c35a1810ff
Color Hash:#6c81e0

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data