ScanMalware.com

Security Scan Report: eoi.voyaemployeebenefits.com

Redirected to:
https://portal.voya.com/authportalui/#/
Site favicon
Submitted: Jul 10, 2026, 3:24:47 PMCompleted: Jul 10, 2026, 3:25:31 PMpubliccompleted
Loading additional data...

Summary

This website contacted 15 IPs in 2 countries across 12 domains to perform 76 HTTP transactions. The main domain is portal.voya.com and was registered NaN years ago.

Submitted URL: https://eoi.voyaemployeebenefits.com

Effective URL: https://portal.voya.com/authportalui/#/Redirected

The Cisco Umbrella rank of the primary domain is #377,772 of the top 1 million websites

AI Security Verdict

Low Risk

Confidence: 78%

3
Risk Score

The site impersonates Voya, has a low reputation ranking and redirects to another domain, indicating a high‑risk phishing attempt.

Risk Factors
Brand impersonation on unrelated domain
Low reputation ranking for a brand‑claiming site
Redirect chain to a different domain
Safety Factors
No malicious JavaScript or YARA matches
No credential or payment collection forms
Old domain age (over 27 years) indicating no new‑site risk
Verdict cited a credential/login form, but DOM analysis found no password field (real or disguised) or payment field, and no other hard signal — credential-phishing framing unsupported; risk adjusted from 7 to 3
Domain age information unavailable

Details

Page Title

Auth Portal

Scan Type

public

Language

🇺🇸

English

(80% confidence)

Category

technology software

(69%)

Domain Information

The domain name 'eoi.voyaemployeebenefits.com' uses the commercial generic top-level domain (.com), featuring subdomain 'eoi'. Its registrable label 'voyaemployeebenefits' stretches across 20 characters containing nine vowels alongside 11 consonants. Tokenizing the label suggests 3 words: voya, employee, benefits. The median word length lands at 8 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://eoi.voyaemployeebenefits.com

Page Load Overview

6.48s
Total Load Time
76
HTTP Requests
12
Domains
821 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

Language Code:en
Detection Confidence:80%
Script Type:Latin
HTML Lang Attribute:en
Text Length:1,545 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software69% confidence
Type: spa
Method: ml+structural

All Detected Categories

technology software
69%
government public service
60%
healthcare medical
56%
cryptocurrency blockchain
45%
news media journalism
44%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
6172.65.90.21Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
554.163.253.6Aws · CLOUDAshburn, Virginia, United States
AS14618Amazon.com, Inc.
5104.20.46.218Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5172.65.90.22Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5172.65.90.23Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5172.65.90.20Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5216.239.34.36Google · CDNUnited States
AS15169Google LLC
5192.178.183.190Google · CDNUnited States
AS15169Google LLC
5142.251.13.190Google · CDNUnited States
AS15169Google LLC
5146.75.123.52Fastly · CDNFrankfurt am Main, Hesse, Germany
AS54113Fastly, Inc.
7615--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1F813D7B05E90403E5587681CB2FAA616B23588A7D50DCEA4B1E9083C5FE4FD358E3F9D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:mNMTQrXpsjDCTAZ9/PVF65R/BWIkO+YhurYHuLk3JDxo4poe:mNjrXpsjDCTAZ1PVsL/BWIuYhurYHuLc

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:42157:SxRIFZ4qAgLQEIJFOaQ1yZEUhYMMIASAowIiCQK+awAB1ccBEuCB2VaMWB0HtOJCgSLQQiFJwJcoEC6cUKcEoSkEimpCapMi

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:fff1fff1e1e1e3ff
Perceptual Hash:e3949c63b6948b99
Difference Hash:47cbd2c74b4b0b39
Wavelet Hash:bf607860e1a1e19f
Color Hash:#2d8649

Other Hashes

Crop Resistant:47cbd2c74b4b0b39,6624a58d72918dcd,6bbbb1641008c8c8,8081f45ae4c8ca30

Scan History

Scan history not available

Unable to load historical scan data