Security Scan Report: r4.xiatianxue.net

Site favicon
Submitted: Jul 16, 2026, 4:48:24 PMCompleted: Jul 16, 2026, 4:49:34 PMpubliccompleted
Loading additional data...

Summary

This website contacted 1 IP in 1 country across 1 domain to perform 2 HTTP transactions. The main domain is r4.xiatianxue.net and was registered NaN years ago.

Submitted URL: https://r4.xiatianxue.net/?token=iZh02BJ5smXqwyVXMB39gzajhAb

AI Security Verdict

Low Risk

Confidence: 78%

3
Risk Score

Low risk site with a login form; no strong malicious indicators detected.

Risk Factors
Presence of credential login form
Use of eval() in JavaScript
Unranked domain reputation
Safety Factors
Domain age > 3 years
No external IoC matches
No JavaScript malware YARA detections
No network IDS alerts
Domain age information unavailable

Details

Page Title

Account Suspension Notification

Scan Type

public

Language

🇨🇳

Chinese

(60% confidence)

Category

cryptocurrency blockchain

(83%)

Domain Information

The domain name 'r4.xiatianxue.net' uses the network infrastructure generic top-level domain (.net), featuring subdomain 'r4'. The core label 'xiatianxue' covers 10 characters with six vowels and four consonants. Splitting it apart reveals three words: xia, tian, xue. Median word length comes out to three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://r4.xiatianxue.net/?token=iZh02BJ5smXqwyVXMB39gzajhAb

Page Load Overview

1.06s
Total Load Time
4
HTTP Requests
1
Domains
N/A
Total Size

Language Analysis

Primary Language

🇨🇳Chinese
Code: zh
Confidence:60%
Script:Han
Direction:ltr

Detection Details

Language Code:zh
Detection Confidence:60%
Script Type:Han
HTML Lang Attribute:cn
Text Length:292 chars
Detector Agreement:50%
Language mismatch: Declared as cn but detected as zh

Website Classification

Primary Category

cryptocurrency blockchain83% confidence
Type: webapp
Method: ml+structural+ocr_tiebreaker

All Detected Categories

cryptocurrency blockchain
83%
finance banking
81%
adult content
77%
download file sharing
69%
healthcare medical
67%

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
4104.21.52.11Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
41--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T169112F46EA44001DB4D64198FE66A2997BA680F0A15A0B2C7CC9D535C39DB28C9FF06C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

24:hR/C0A4UVHrk+G93hI4S0qX46bv4pUjka:TcvN49x19iFwpUt

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:867:ACAAAQAAIBhEAAAACAAAAAAAAIAAAAABAAAgAAAAAAAAAAAAAAACAAACAAAAAAAAAAAAAAAEAABAAAAAAEQwCAAAABAAAAEA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:c7c7fff7ffffffff
Perceptual Hash:b333332666cecc89
Difference Hash:0c1c100400000000
Wavelet Hash:c4c4fcd4f0f0f0f0
Color Hash:#6ee06c

Other Hashes

Crop Resistant:0c1c100400000000

Scan History

Scan history not available

Unable to load historical scan data