Security Scan: Login

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/c2bb675f-fe28-4700-a6cc-908ad49020ea Domain and IP registration (RDAP)/api/v1/rdap/c2bb675f-fe28-4700-a6cc-908ad49020eaHow often this domain was scanned/api/v1/domain/stats/5958heh59585958.theloopblog.com Scan history for this domain/api/v1/domain/history/5958heh59585958.theloopblog.com?limit=15

This website contacted 5 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main domain is theloopblog.com and was registered 1 month ago.

Submitted URL: https://5958heh59585958.theloopblog.com/zzr/59585958/bndsbGFAaGVoLnNl

Effective URL:

https://mail3s-zimbra-auth-login.frailsoft.com/zim/web-mail/#nwlla@heh...

Redirected

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Confirmed phishing kit impersonating HEH/Zimbra webmail: a credential-harvesting login form with the victim's base64 email in the URL and cross-origin submission to an unrelated domain.

Risk Factors (6)

Base64-encoded victim email address embedded in URL (phishing-kit tracking token)

Brand/identity impersonation of heh.se mail credentials under a 'HEH' login header

Cross-origin credential submission to hjdjdkd.asusboards.com mimicking a Zimbra webmail path

Deceptive final hostname mail3s-zimbra-auth-login.frailsoft.com impersonating Zimbra authentication

Domain unranked in Cisco Umbrella with no established reputation

Domain age information unavailable

Details

Page Title

Scan Type

public

Domain Name Analysis

The domain name '5958heh59585958.theloopblog.com' uses the commercial generic top-level domain (.com), featuring subdomain '5958heh59585958'. The registrable portion 'theloopblog' spans 11 characters holding four vowels versus 7 consonants. Word splitting yields three words: the, loop, blog. Average segment length settles at four characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

1.28s

Total Load Time

184 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:95 chars

Detector Agreement:100%

Website Classification

Primary Category

news media journalism70% confidence

Type: webapp

Method: ml+structural

All Detected Categories

news media journalism

70%

government public service

56%

healthcare medical

51%

adult content

49%

cryptocurrency blockchain

47%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
1	104.21.82.48Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	172.67.139.20Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	104.21.94.178Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	172.67.153.106Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	178.63.16.224	Falkenstein, Saxony, Germany	AS24940Hetzner Online GmbH
5	5	-	-