Security Report: xn--olyfans-p13c.com - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/cde4f903-87d3-4bb2-9824-9248fa8b3ca9 Domain and IP registration (RDAP)/api/v1/rdap/cde4f903-87d3-4bb2-9824-9248fa8b3ca9How often this domain was scanned/api/v1/domain/stats/xn--olyfans-p13c.com Scan history for this domain/api/v1/domain/history/xn--olyfans-p13c.com?limit=15

This website contacted 4 IPs in 1 country across 2 domains to perform 6 HTTP transactions. The main domain is xn--olyfans-p13c.com and was registered 4 years 9 months ago.

Submitted URL: https://xn--olyfans-p13c.com

Effective URL:

https://evilwatcher.com/login

Redirected

AI Security Verdict

Low Risk

Confidence: 78%

Risk Score

Login page on 'evilwatcher.com' reached via an 'OnlyFans'-lookalike punycode domain, collecting work email and password while claiming none are collected. Deceptive hostname + credential form; avoid entering credentials.

Risk Factors (5)

Deceptive punycode/IDN host masquerading as an 'OnlyFans'-like name redirecting to a different, unrelated domain

Credential-harvesting login form (email + password) on an unranked domain with no published age or reputation

Cross-domain redirect from the homograph host to a differently-named host before the login is served

Page text claims no credentials are collected despite an active password field

No verifiable organisational identity, legal pages, address or support channels on the served content

Safety Factors (6)

Form action is same-host (flagged as a legitimate SSO flow) rather than an external or exfiltration endpoint

No payment or card fields present

CSRF token present in the form

No Indicators of Compromise, hunting-rule signatures, IDS alerts or credential-exfiltration behaviour detected

No obfuscated or malicious JavaScript observed

The site's own login form (credentials submit to its own domain; 4745 days old) with no strong malicious indicators — a first-party sign-in is normal; risk clamped from 8 to 3

Domain age information unavailable

Details

Page Title

Scan Type

public

Favicon Hash

MMH3: -19725218

MD5: 8fab8ec2e389fd18a4f96bca2e8340ea

Domain Name Analysis

The domain 'xn--olyfans-p13c.com' uses the commercial generic top-level domain (.com) and has no subdomain. The second-level label 'xn--olyfans-p13c' is 16 characters long containing 2 vowels alongside 9 consonants; it also includes two digits and three hyphens. Breaking it apart gives 7 words: xn, o, ly, fans, p, 13, c. Average segment length settles at two characters. No strong language cues emerged from the frequency lists.

Screenshot

Welcome back ‘Sign in to manage authorized training campaigns. Work email Password No recipient credentials are coflected.

Page Load Overview

1.90s

Total Load Time

9 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:58%

Script:Latin

Direction:ltr

Detection Details

Text Length:173 chars

Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence

Type: webapp

Method: structural

All Detected Categories

No categories detected

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
3	188.114.96.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	104.21.55.48Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	172.67.144.137Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	188.114.97.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
6	4	-	-