Security Scan Report: welcome-ivory-mla3tpma-dpgbipy9x8sc.edgeone.dev

Redirected to:
https://welcome-ivory-mla3tpma-dpgbipy9x8sc.edgeone.dev/
Submitted: Completed: publiccompleted
This website contacted 5 IPs in 3 countries across 3 domains to perform 5 HTTP transactions. The main domain is edgeone.dev and was registered 1 year 4 months ago.

Submitted URL: http://welcome-ivory-mla3tpma-dpgbipy9x8sc.edgeone.dev/

Effective URL:
https://welcome-ivory-mla3tpma-dpgbipy9x8sc.edgeone.dev/
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

Confirmed DKB phishing page on an edgeone.dev subdomain that captures banking login, personal and card details and exfiltrates credentials to Telegram; anti-analysis blocking is enabled. Do not enter any data.

Risk Factors (6)
Brand impersonation of DKB on a non-official edgeone.dev subdomain
Password field + username field harvesting login credentials
Multi-step collection of phone number, birth date and full payment card details
Credential exfiltration to an external Telegram bot endpoint
DevTools and right-click blocking (anti-analysis)
Subdomain on free instant-hosting platform, creation date unknown
Domain age information unavailable

Details

Page Title

Mein Banking - DKB

Scan Type

public

Domain Name Analysis

Within the developer-focused generic top-level domain (.dev), 'welcome-ivory-mla3tpma-dpgbipy9x8sc.edgeone.dev' is registered and includes subdomain 'welcome-ivory-mla3tpma-dpgbipy9x8sc'. Its registrable label 'edgeone' stretches across 7 characters with 4 vowels and 3 consonants. Segmentation suggests two words: edge, one. Median word length is 3.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of http://welcome-ivory-mla3tpma-dpgbipy9x8sc.edgeone.dev/

Page Load Overview

4.30s
Total Load Time
45 KB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:de
Text Length:1,516 chars
Detector Agreement:67%

Website Classification

Primary Category

finance banking57% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

finance banking
57%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
143.174.247.29Singapore
165.21.235.194Helsinki, Uusimaa, Finland
AS24940Hetzner Online GmbH
145.43.142.6United Kingdom
AS16276OVH SAS
143.174.246.29Singapore
145.43.142.8United Kingdom
AS16276OVH SAS
55--

Detected Technologies1

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T15393D86561EB28392793A3F81BE7450E612C8003B01ACE5C7F9D539A4F46B849B77F9C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:p7ayTLlm8olnaz/UeJpNl1BlrYJZeIScOYuHDev4XGXnC3xQckq/5jFPJj:peysfl2UeJpNlh0n6mA

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:89782:UkUsEKNtExgYaQiDo6IBgAQmQsIACBAhEgDsTBkIpQYmBC7qBYkUiMBWES8MScYBEpOAFCOjBCMKGDBGSwewEYOAAkUFAwAL

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:7fffffe7e7ffff00
Perceptual Hash:f793488d62b14c9d
Difference Hash:b22a324c4c320e21
Wavelet Hash:42fefee6e6c24200
Color Hash:#7940bf

Scan History

Scan history not available

Unable to load historical scan data