ScanMalware.com

Security Scan Report: kohls.us.qlikcloud.com

Redirected to:
https://kohls.okta.com/oauth2/v1/authorize?client_id=0oalkhapj96yqdyjw...
Site favicon
Submitted: May 16, 2026, 6:38:55 PMCompleted: May 16, 2026, 6:40:09 PMpubliccompleted
Loading additional data...

Summary

This website contacted 4 IPs in 1 country across 4 domains to perform 70 HTTP transactions. The main domain is kohls.okta.com and was registered NaN years ago.

Submitted URL: https://kohls.us.qlikcloud.com

Effective URL: https://kohls.okta.com/oauth2/v1/authorize?client_id=0oalkhapj96yqdyjw1t7&scope=openid%20profile%20groups%20email&response_type=code&redirect_uri=https%3A%2F%2Fcll1vcxctheluib.us.qlikcloud.com%2Flogin%2Fcallback&state=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdGlkIjoiZ0NEVjdpQzJjcUh5UXA1aEJVZjdqTFRVRFJ1RWxGUFZTM2NyS3hDdFBPSSIsImlhdCI6MTc3ODk1Njc0MSwiZXhwIjoxNzc5NTYxNTQxfQ.XQiEYHRbYFFU6YSSnxGfZzp7Gzq_bFklkc0afJEI3GE&nonce=YvqkREtLXYS3WOPYOTA8-BINy9H-o8cwN8TDI6brK6E&code_challenge=8rIrxJsKECgsAH-3IrlTncjfgnFXFiWDvOx79jA6jco&code_challenge_method=S256Redirected

The Cisco Umbrella rank of the primary domain is #48,741 of the top 1 million websites

AI Security Verdict

Low Risk

Confidence: 84%

2
Risk Score

Page impersonates Kohl's login, harvests passwords, and triggers critical malware alerts – treat as confirmed phishing scam.

Risk Factors
Brand impersonation on unrelated domain
Password‑only field (credential harvesting)
Critical IDS alerts for malware/C2 activity
Highly obfuscated JavaScript
Safety Factors
Domain age 8046 days (well‑established)
Domain ranked within top 100 K
Legitimate Okta SSO endpoint used for authentication
Page served from an identity-provider sign-in endpoint (kohls.okta.com); a relying-party brand and login form here are normal SSO, not impersonation — risk clamped from 9 to 2
Domain age information unavailable

Details

Page Title

Kohl's Corporation - Prod - Sign In

Scan Type

public

Language

🇺🇸

English

(80% confidence)

Category

corporate business

(72%)

Domain Information

You're looking at domain 'kohls.us.qlikcloud.com' on the commercial generic top-level domain (.com) and includes subdomain 'kohls.us'. Count 9 characters in 'qlikcloud' split between three vowels and six consonants. Breaking it apart gives three words: ql, ik, cloud. Expect 2 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://kohls.us.qlikcloud.com

Page Load Overview

0.71s
Total Load Time
52
HTTP Requests
5
Domains
627 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

Language Code:en
Detection Confidence:80%
Script Type:Latin
HTML Lang Attribute:en
Text Length:696 chars
Detector Agreement:100%

Website Classification

Primary Category

corporate business72% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

corporate business
72%
documentation technical
54%
technology software
43%
adult content
35%
government public service
28%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1365.9.175.24United States
AS16509Amazon.com, Inc.
1344.215.23.130Ashburn, Virginia, United States
AS14618Amazon.com, Inc.
1315.197.253.65United States
AS16509Amazon.com, Inc.
1365.8.131.23United States
AS16509Amazon.com, Inc.
524--

Detected Technologies2

PasswordField
100%
HSTS
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T18803F7C20E59DDDD12C96D885A3B450A258292D7CA91EEC07AFCCEC9EFA4D0F741E64C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:IzIyF/A5hwk1hgYwrgyvjrgYwrgyvj+MNzgYwrgyvjtwETH:CIyt2b1KYEQYERNkYEBwEb

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:39964:AQQgwJABToAKCSC0AMYBBhCthECwAAmGHQcAtsGDkAlCTQJAcVlIsEn0iQAL/YDZN7dJACdUAgMIgJABCZQANRJAQAMMQwwh

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:3f3fffffffffffff
Perceptual Hash:83030303070fffff
Difference Hash:d0c0000000000000
Wavelet Hash:0040c0c000000000
Color Hash:#3a7869

Other Hashes

Crop Resistant:d0c0000000000000

Scan History

Scan history not available

Unable to load historical scan data