Security Scan: PDF Viewer

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/e28c3cc5-cb50-4ff3-a9f0-4a0d21bf9bce Domain and IP registration (RDAP)/api/v1/rdap/e28c3cc5-cb50-4ff3-a9f0-4a0d21bf9bceHow often this domain was scanned/api/v1/domain/stats/dndair.com Scan history for this domain/api/v1/domain/history/dndair.com?limit=15

This website contacted 14 IPs in 2 countries across 10 domains to perform 17 HTTP transactions. The main domain is dndair.com and was registered 14 years ago.

Submitted URL: https://dndair.com/iv/doc.html

Downloads:

AI Security Verdict

Confirmed Scam

Confidence: 97%

Risk Score

Compromised/abused domain serving a known fake 'PDF Viewer' kit: it lures Windows users with an Adobe update pretext and downloads a ScreenConnect remote-access installer. Confirmed malicious kit and critical hunting-rule match.

Risk Factors (7)

Known malicious phishing kit identified by the analyst-vetted kit roster

Critical hunting-rule detection for a fake Adobe Acrobat/PDF-viewer installer kit

Direct delivery of an executable (ScreenConnect client) presented as a document viewer update

Impersonates Adobe branding/update messaging on a domain unrelated to Adobe

Windows-only gate plus blurry/illegible document lure designed to force installer execution

Anti-analysis form artifacts (honeypots, browser fingerprint, challenge token) and obfuscated inline script

Five redirects (four cross-domain) leading from google/gstatic to this page — traffic laundering

Domain age information unavailable

Details

Page Title

PDF Viewer

Scan Type

public

Favicon Hash

MMH3: -1482289937

MD5: 45d4414e5d5a8b0d273c811595d550da

Domain Name Analysis

Domain 'dndair.com' uses the commercial generic top-level domain (.com) with no subdomain. The second-level label 'dndair' is 6 characters long split between 2 vowels and four consonants. It segments into two words: dnd, air. Median word length is three characters. No strong language cues emerged from the frequency lists.

Screenshot

BUSINESS CONTRACT Ota treet & heme bees. Saw be dae @ ~ ate swewme ttmme me y come 8 tow a doce Fate epee em sh © tgw Ep hee be bbe owes Oe eRe oes yey el bo podem cn ap ws pas Ohd @ fu bey bow de...

Page Load Overview

2.84s

Total Load Time

576 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:943 chars

Detector Agreement:100%

Website Classification

Primary Category

technology software83% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

technology software

83%

documentation technical

72%

corporate business

57%

entertainment media

39%

adult content

38%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
4	50.87.143.172	Phoenix, Arizona, United States	AS46606Unified Layer
1	104.26.15.77Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	142.251.150.119Google · CDN	United States	AS15169Google LLC
1	192.178.183.104Google · CDN	United States	AS15169Google LLC
1	142.251.14.106Google · CDN	United States	AS15169Google LLC
1	192.178.183.103Google · CDN	United States	AS15169Google LLC
1	172.67.68.67Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	142.251.151.119Google · CDN	United States	AS15169Google LLC
1	142.251.153.119Google · CDN	United States	AS15169Google LLC
1	142.251.155.119Google · CDN	United States	AS15169Google LLC
17	14	-	-