ScanMalware.com

Security Scan Report: linkedin.increvalor.com

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/8df213e6-8f95-4d33-8b18-66c16dcdd883Domain and IP registration (RDAP)/api/v1/rdap/8df213e6-8f95-4d33-8b18-66c16dcdd883How often this domain was scanned/api/v1/domain/stats/linkedin.increvalor.comScan history for this domain/api/v1/domain/history/linkedin.increvalor.com?limit=15
This website contacted 4 IPs in 2 countries across 4 domains to perform 13 HTTP transactions. The main domain is increvalor.com and was registered 5 years ago.

Submitted URL: https://linkedin.increvalor.com/lind/mnx/

AI Security Verdict

Confirmed Scam

Confidence: 98%

10
Risk Score

Confirmed credential-phishing page: Safe Browsing social-engineering flags and two HIGH Suricata phishing alerts back an email/password form on mismatched LinkedIn/NetEase branding.

Risk Factors (4)
Google Safe Browsing social-engineering detection
Two HIGH Suricata phishing alerts
Credential-harvesting login form
Mismatched LinkedIn / 网易企业邮箱 branding on a non-official domain
Domain age information unavailable

Details

Page Title

网易企业邮箱 - 登录入口

Scan Type

public

Domain Name Analysis

Within the commercial generic top-level domain (.com), 'linkedin.increvalor.com' is registered with subdomain 'linkedin'. The second-level label 'increvalor' is 10 characters long holding four vowels versus 6 consonants. Tokenizing the label suggests 3 words: inc, re, valor. Median word length is three characters. No strong language cues emerged from the frequency lists.

Screenshot

四 Q search ° =) cD a fa = ~ Home My Network Jobs Messaging = Notif...

Page Load Overview

2.15s
Total Load Time
774 KB
Total Size

Language Analysis

Primary Language

🇨🇳Chinese
Code: zh
Confidence:60%
Script:Han
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:95 chars
Detector Agreement:100%
Language mismatch: Declared as en but detected as zh

Website Classification

Primary Category

phishing scam55% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

phishing scam
55%
corporate business
51%
adult content
38%
finance banking
28%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
4162.241.60.182Vinhedo, São Paulo, Brazil
AS31898Oracle Corporation
3104.18.10.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3104.18.40.68Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3104.18.11.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
134--

Detected Technologies6

JQueryv3.1.1
100%
Bootstrapv4.0.0
100%
Font Awesome
40%
Apache HTTP Server
40%
Popper
20%
BootstrapCDN
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T19EF1A600BCF655A7013360DD3FBF65083EA5C40B9208CE047AAD7B905F95E1B78676C6

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:WiuScUBeHsqltvdEf02I9yfXBAYJIHLS25wB:WCcSeMq/vd54/

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:7975:hFVKmCWwqzsDCDRImvaU4oXAFAuFBDKURlIiBJQALQjQyWgLhAJSBc9gNQiihE/AKdBAEiQWwhirnDAOYVfmFABokHXhKoUL

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0000183c3c100000
Perceptual Hash:9dd2372c883f238e
Difference Hash:60ccb3b2b2336e73
Wavelet Hash:7340797c7f19031b
Color Hash:N/A

Other Hashes

Crop Resistant:92aeacc2e8e480a9,60ccb3b2b2336e73

Scan History

Scan history not available

Unable to load historical scan data