Security Report: redacted-ato-statedoculrziinggf-2025-26.employee-statement.st - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/b241eeb3-85d6-41aa-905f-8da5c122a99e Domain and IP registration (RDAP)/api/v1/rdap/b241eeb3-85d6-41aa-905f-8da5c122a99eHow often this domain was scanned/api/v1/domain/stats/redacted-ato-statedoculrziinggf-2025-26.employee-statement.st Scan history for this domain/api/v1/domain/history/redacted-ato-statedoculrziinggf-2025-26.employee-statement.st?limit=15

This website contacted 2 IPs in 1 country across 1 domain to perform 8 HTTP transactions. The main domain is employee-statement.st and was registered 2 months ago.

Submitted URL: https://redacted-ato-statedoculrziinggf-2025-26.employee-statement.st/?REDACTED-edoc

AI Security Verdict

Moderate Risk

Confidence: 68%

Risk Score

Bot-walled throwaway .st host with a deceptive 'ato…employee-statement' randomised subdomain and per-victim 'edoc' parameter — a textbook tax/payroll document phishing lure. Content unverifiable, so scored on URL structure, 68-day age and zero reputation.

Risk Factors (4)

Long randomised subdomain combining 'ato', 'employee-statement' and a year range on an unrelated .st domain — deceptive hostname consistent with document/tax phishing lures

Domain 68 days old (NEW) and entirely unranked

Real content hidden behind a bot-protection challenge, preventing verification of forms or intent

Query parameters ('?…-edoc') suggest a per-victim tracked link rather than a public page

Safety Factors (6)

No Indicators of Compromise matched against the page or its resources

No JavaScript malware patterns or native-YARA-scanner hits

No network-level IDS alerts

Site is fronted by Cloudflare (not itself a safety signal, only where the challenge originates)

No concrete malicious signal (no IoC / YARA / Safe-Browsing / IDS / credential form / brand impersonation) — elevated risk rested on domain age or reputation alone; clamped from 7 to 5

Verdict cited a credential/login form, but DOM analysis found no password field (real or disguised) or payment field, and no other hard signal — credential-phishing framing unsupported; risk adjusted from 5 to 5

Domain age information unavailable

Details

Page Title

Attention Required! | Cloudflareother network

Scan Type

public

Domain Name Analysis

Within the .st country-code top-level domain, 'redacted-ato-statedoculrziinggf-2025-26.employee-statement.st' is registered with subdomain 'redacted-ato-statedoculrziinggf-2025-26'. The second-level label 'employee-statement' is 18 characters long containing 7 vowels alongside ten consonants, notching one hyphen. Breaking it apart gives two words: employee, statement. Average segment length settles at 8.5 characters. No strong language cues emerged from the frequency lists.