Security Scan Report: 1.win-faw.win

Redirected to:
https://mp.weixin.qq.com/
Site favicon
Submitted: Completed: publiccompleted
This website contacted 13 IPs in 4 countries across 9 domains to perform 102 HTTP transactions. The main domain is win-faw.win and was registered 3 weeks ago.

Submitted URL: https://1.win-faw.win/

Effective URL:
https://mp.weixin.qq.com/
Redirected

AI Security Verdict

High Risk

Confidence: 68%

7
Risk Score

Days-old .win domain bounces across domains to the genuine WeChat login — a classic scanner-cloaking redirector pattern. No kit or IoC was observed on the entry domain itself, but the link is not trustworthy.

Risk Factors (4)
Newly registered .win domain acting as a cross-domain redirector to a brand sign-in page
No plausible ownership or branding relationship between win-faw.win and WeChat/Tencent
Scanner-facing redirect to the brand's real login is consistent with phishing-kit cloaking
Anti-analysis behavior (right-click blocked)
Domain age information unavailable

Details

Page Title

微信公众平台

Scan Type

public

Domain Name Analysis

You're looking at domain '1.win-faw.win' on the .win top-level domain; it also runs on subdomain '1'. Count 7 characters in 'win-faw' containing two vowels alongside four consonants; it also includes one hyphen. Segmentation suggests 3 words: win, f, aw. Median word length comes out to two characters. No strong language cues emerged from the frequency lists.

Screenshot

XQ UBER | @ ah ~ RERES RFD AGAAMME OpeniD HAH SEOF a SeES MEE Fc} wt ait & » aia 3, fee HAY:

Page Load Overview

7.97s
Total Load Time
2.9 MB
Total Size

Language Analysis

Primary Language

🇨🇳Chinese
Code: zh
Confidence:60%
Script:Han
Direction:ltr

Detection Details

Text Length:543 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software70% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

technology software
70%
corporate business
70%
social media network
58%
documentation technical
29%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
18203.205.232.110China
AS132203Tencent Building, Kejizhongyi Avenue
7188.114.97.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
743.175.168.193Singapore
743.152.26.110Singapore
7203.205.239.154China
AS132203Tencent Building, Kejizhongyi Avenue
7223.167.82.229Shanghai, Shanghai, China
AS140979China Unicom Shanghai FuTe IDC network
743.163.178.44Hong Kong, Hong Kong
AS132203Tencent Building, Kejizhongyi Avenue
743.154.252.67Singapore
AS132203Tencent Building, Kejizhongyi Avenue
743.152.26.209Singapore
743.152.29.149Singapore
10213--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T132132BBA0CA900371533A4A986BBF71D72B3492B8805CD00FDFC4B446FD5EEA55936E9

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:TA/LD6MSzIo7I7a7R78NhewZmgRjySfS8DZaL3aFxFFjq7k7Q7Y7G74:TbIo7I7a7R78Nhew1RhfS8DZaDaFxTqS

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:42405:jOGiA0ACoVBEQZYkQBPgm4skMR43kQAIQEmjQLAAhC4zxuHEBEDG2AwQwLcIIQgmw3IcDUDKIRhDRggBBkTJhMYsOYqkwFYX

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:1c040404ffffffff
Perceptual Hash:921a8cecede131b3
Difference Hash:a1e9591900261616
Wavelet Hash:10000000fffbffff
Color Hash:N/A

Scan History

Scan history not available

Unable to load historical scan data