Security Scan Report: rlp.dupintt.com

Submitted: Completed: publiccompleted
This website contacted 12 IPs in 2 countries across 5 domains to perform 13 HTTP transactions. The main domain is dupintt.com and was registered 12 years ago.

Submitted URL: https://rlp.dupintt.com/data/voice-service-verify/

AI Security Verdict

High Risk

Confidence: 80%

8
Risk Score

Fake 'PDF Viewer' gate with garbled content, honeypot/hidden fields, a Windows-only coercion message, redirect chaining, and an inline script carrying a Telegram bot token for exfiltration. Do not proceed.

Risk Factors (5)
Inline JavaScript exfiltrates via a Telegram bot token
Honeypot and hidden anti-bot/fingerprint fields on a page that has no legitimate function requiring them
Fake document/PDF viewer with unreadable garbled content
OS-gated 'Windows required' interception with software-download lures
Four cross-domain redirects obscuring the landing source
Domain age information unavailable

Details

Page Title

PDF Viewer

Scan Type

public

Domain Name Analysis

The domain 'rlp.dupintt.com' uses the commercial generic top-level domain (.com); it also runs on subdomain 'rlp'. Its registrable label 'dupintt' stretches across 7 characters holding two vowels versus five consonants. Segmentation suggests 2 words: dupin, tt. Average segment length settles at 3.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://rlp.dupintt.com/data/voice-service-verify/

Page Load Overview

4.16s
Total Load Time
412 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:943 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software84% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

technology software
84%
documentation technical
72%
corporate business
57%
entertainment media
39%
adult content
37%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
289.163.155.33Germany
AS24961WIIT AG
1104.26.15.77Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.251.154.119Google · CDNUnited States
AS15169Google LLC
1142.251.127.147Google · CDNUnited States
AS15169Google LLC
1142.251.14.106Google · CDNUnited States
AS15169Google LLC
1104.26.14.77Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.251.151.119Google · CDNUnited States
AS15169Google LLC
1142.251.153.119Google · CDNUnited States
AS15169Google LLC
1192.178.183.106Google · CDNUnited States
AS15169Google LLC
1192.178.183.99Google · CDNUnited States
AS15169Google LLC
1312--

Detected Technologies5

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T19395961B8E0F96A06B3828BF5787E6497010F79399C3A7A4F0DE4C4DF746E19264D26C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

24576:3z+EHVWfOTr31XuT8+o7rfyHlnayVXuT8+o7rly2lnm:a5f2XS8+QTMlnaWXS8+Q5Rlnm

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:2037852:gsSx+gH6IIXEFBAUIYOYAAQJgClyoWGkhjKUAJAhcYHJoHEMYQjDJqAHmIE1SCgCcxBLb7BCRgGpYz2DXBQKCDkwiEgAMyFB

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:90a2a0a2bcb83c38
Perceptual Hash:df7708dd58307f00
Difference Hash:624c4c4c72727272
Wavelet Hash:a0a6a2a6beba3e38
Color Hash:#40acbf

Scan History

Scan history not available

Unable to load historical scan data