Scan report · 16 days agoPublic

thorkildkristensen.sbs

172.67.190.17AS13335 · US

Submittedhttps://thorkildkristensen.sbs/common?key=gofiq8bn7#dGVzdEB0ZXN0LmNvbQ==

Landed onhttps://thorkildkristensen.sbs/common· 1 redirect

this link was addressed to test@test.com

the address was encoded in the URL fragmentand it opens on a fake verification gate that no challenge provider is behind, whose form collects nothing from the visitor and instead submits 10 hidden fields measuring them, one of them a honeypot the visitor cannot see. The page is filtering who may reach what is behind it

Verdict

2 of 8 enginesMaliciousAutomated

Own this site?

Dangerous — confirmed threat

Automated

We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

Suspicious fileSuspicious content in the downloaded file

1530d606-2466-46c0-b833-c5b89d99d0be.html

Our Content Inspection engine downloaded the file this URL serves and analyzed it. The payload shows traits commonly seen in malware. Treat it as unsafe until verified.

Success

SHA-256 73f9175c63d7aa6dd4072c0a30718e96cac9af4a0728c8aee50c9d6740c2d4ca

SupportingTargeted phishing: a visitor-scoring gate, addressed to one person

test@test.com — 10 hidden fields, 1 invisible to the visitor, nothing asked of the visitor

The page prints a verification prompt, but no challenge provider is behind it and its form asks the visitor for nothing: every field is hidden state about whoever arrived (whether scripting is on, a mouse-movement count, how long they took, the device type) or a honeypot they cannot see. A page that SCORES its visitor instead of challenging them is deciding who is allowed to reach what is behind it — the shape of a phishing kit's doorway.

Analyst noteOpen the page's own script: this kit's is a single eval(atob(...)) that starts at a score of 70 and subtracts for navigator.webdriver and for 'headless' in the user agent. A genuine challenge is served by its provider and never scores you in page script. If an address is named above, treat it as the targeted recipient and check whether that mailbox got the message.

Infrastructure

IP: 172.67.190.17CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=WE1, O=Google Trust Services, C=US · expires Nov 29, 2026
Redirects: 1 hop · /common?key=gofiq8bn7 → /common

WHOIS

Registrar: Dynadot Inc
Created: Aug 28, 2026
Expires: Aug 28, 2027
Nameservers: ajay.ns.cloudflare.comkayleigh.ns.cloudflare.com

44 malicious35 suspicious

Hashes & fingerprints

Page Hash2a1015ebc4588a1f7f47f36e2d7d791aa09cf42c3f361a29b443283b02018aac DOM Hashe58766c4177fc0b0e68c4af7b49cfe4204c9a78a6ee871487d4c176dc2f7197d Screenshot pHash8b393463da4e6c9c JARM27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint5B01B12E1C2B3C3BE85FCF893AF6A2C333976834 Cert IssuerCN=WE1, O=Google Trust Services, C=US

Page capture

Live

Title “Human Verification”

Visit Site

Engines

8 · time to verdict