Security Scan: Hostinger Mail

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/efc5943c-70a3-4593-965f-e7a4a229c371 Domain and IP registration (RDAP)/api/v1/rdap/efc5943c-70a3-4593-965f-e7a4a229c371How often this domain was scanned/api/v1/domain/stats/hostinger-mail-ewgjnwrkgnkrw-ykclpumubfuduakwftvyokuk.pages.dev Scan history for this domain/api/v1/domain/history/hostinger-mail-ewgjnwrkgnkrw-ykclpumubfuduakwftvyokuk.pages.dev?limit=15

This website contacted 5 IPs in 1 country across 8 domains to perform 30 HTTP transactions. The main domain is pages.dev and was registered 6 years ago.

Submitted URL: http://hostinger-mail-ewgjnwrkgnkrw-ykclpumubfuduakwftvyokuk.pages.dev/

Effective URL:

https://mail.hostinger.com/auth/login?redirect=%2F%3F_task%3Dmail%26_m...

Redirected

AI Security Verdict

Confirmed Scam

Confidence: 92%

Risk Score

Randomised *.pages.dev host serves the analyst-vetted Multi-Brand pages.dev phishing kit (hostinger-mail cohort) behind a fake 'Hostinger Mail' login, with obfuscated JS, 14 eval() calls and a CRITICAL IDS alert. Confirmed credential phishing kit.

Risk Factors (6)

Known malicious multi-brand pages.dev phishing kit identified by analyst-vetted kit roster (2 CRITICAL sightings)

Randomised subdomain on free hosting platform used to front a branded email login

Credential capture form (password + email/username field)

CRITICAL IDS heap-spray/shellcode alert and hex-obfuscated script encoding

Obfuscated JavaScript with 14 eval() calls

Cross-domain redirect from the pages.dev entry host to the brand's login endpoint (phish-kit relay pattern)

Domain age information unavailable

Details

Page Title

Hostinger Mail

Scan Type

public

Favicon Hash

MMH3: -1870689512

MD5: 2a8d43c7a1c14e15bae8c8e0e97ebfad

Domain Name Analysis

Domain 'hostinger-mail-ewgjnwrkgnkrw-ykclpumubfuduakwftvyokuk.pages.dev' uses the developer-focused generic top-level domain (.dev); it also runs on subdomain 'hostinger-mail-ewgjnwrkgnkrw-ykclpumubfuduakwftvyokuk'. Its registrable label 'pages' stretches across 5 characters split between two vowels and three consonants. Breaking it apart gives one word: pages. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

2.01s

Total Load Time

1.5 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:14 chars

Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence

Type: static

Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
6	104.16.210.83	United States	AS13335Cloudflare, Inc.
6	104.18.94.41	United States	AS13335Cloudflare, Inc.
6	188.114.97.3	United States	AS13335Cloudflare, Inc.
6	104.17.133.104	United States	AS13335Cloudflare, Inc.
6	142.250.154.95	United States	AS15169Google LLC
30	5	-	-

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T156E2C823AE54422F3113C79D7790F5C5A3316A018F16B37BF56453B49F8D1AE2A2338A

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:5xkFqvLh8Oh8XMVk9vjaKObveaIFEmLJkxZCJa4gML9YAiFb6DWgJ:MwDmsSaKObveaIFEmLJkxZCJwMAFWWgJ

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:34031:UqsmDCAAWgEBAYhTPABhiACMQiAEsEIRcNoOxBYFIKHB5BUUUiCQUQSlEAIDmGgp8yCCYtxJCaR+aRzCCJACAALll3EAQRBJ

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffcfc3c7c3c3c7ff

Perceptual Hash:b139cbc4c3cc64ce

Difference Hash:181c161e1e161608

Wavelet Hash:fec6c2c6c2c2c2e6

Color Hash:#a12dd2

Other Hashes

Crop Resistant:181c161e1e161608

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: hostinger-mail-ewgjnwrkgnkrw-ykclpumubfuduakwftvyokuk.pages.dev