zerophish / console
Register Sign in
URL THREAT INTELLIGENCE · v0.5.0 · OPERATIONAL

The full anatomy of a phishing site,
one URL at a time.

ZeroPhish renders the page, runs twelve detection signals against the DOM, certificate chain, brand fingerprint and threat feeds, and returns a typed verdict. Built for security teams and product engineers.

scan
100 scans / day · free · typical scan 2–4 s ·
try
Result scan 4034d85e
Scan another →
CACHED Showing previous scan from 4 d ago. Click Reanalyze to run a fresh scan.
PHISHING · LOW CONFIDENCE

Phishing detected

brand Klug Eignungswerk scan id 4034d85e duration 12.12s signals 2 failing / 25
Risk score 0.70
70 / 100 · High risk
Tags
URL anatomy klugeignungswerk.com
https :// klugeignungswerk . com /
flagged registered domain path protocol / query
Why this verdict 12 contributing signals · model gpt-5.4-nano
×
Credential collection form
Credential collection form detected on the page
↑ risk
×
Email-auth posture (SPF/DMARC)
No DMARC record — domain trivially spoofable in phishing email
↑ risk
!
CAA issuer restriction
No CAA record — any certificate authority may issue a cert for this domain (phishing infra rarely sets CAA)
↑ risk
!
DNSSEC signing
Zone is not DNSSEC-signed — phishing domains are almost never signed
↑ risk
Brand typo-squat detected
No similar legitimate brand within edit-distance 2
↓ risk
Visual similarity to known brand
Brand presentation matches the registered owner
↓ risk
Favicon impersonation
Favicon matches the registered owner
↓ risk
SSL certificate
Served over HTTPS · valid TLS certificate
↓ risk
Brand-in-subdomain attack
No known brand label in subdomain
↓ risk
Homoglyph attack
ASCII only · no mixed-script characters detected
↓ risk
Domain randomness (DGA/entropy)
Registrable label "klugeignungswerk" reads as pronounceable / brand-like (randomness 40%)
↓ risk
Page language
Detected page language: German (de) — best-effort
↓ risk
enrichment used: dns network jarm asn
Indicators of compromise 5 · click any row to copy
URL hxxps://klugeignungswerk[.]com/
Host klugeignungswerk[.]com
Brand Klug Eignungswerk
Screenshot https://cdn.zerophish.ai/8c2af3c4-8256-4a4f-b70e-e337ceaa189b.jpg
Scan ID 4034d85e-887d-48ae-839b-33d5fa3a699f
Detection signals 2 fail · 2 warn · 8 pass
Brand typo-squat detected
No similar legitimate brand within edit-distance 2
critical
Domain age
Awaiting analysis
high
Threat intel blocklists
Awaiting analysis
critical
×
Credential collection form
Credential collection form detected on the page
high
Visual similarity to known brand
Brand presentation matches the registered owner
high
Favicon impersonation
Favicon matches the registered owner
medium
SSL certificate
Served over HTTPS · valid TLS certificate
low
DNS reputation
Awaiting analysis
medium
showing 8 of 25 ·
Captured page from scan
Captured page
screenshot · captured at scan live page render
Brand impersonation visual + DOM analysis
K
Klug Eignungswerk
5%
Technical profile resolved at scan time
Host klugeignungswerk.com
Registered domain klugeignungswerk.com
Scheme https
Content length 222386 B
HTTP 200 · text/html
DMARC policy none
SPF policy none
MX records none
Analyst summary AI-generated
Initial scan heuristic + LLM

The page presents itself as the “offizielle Website von Klug Eignungswerk” and a “KI-gestützte Trading-Plattform” with a “Jetzt registrieren” flow. It contains a credential/lead collection form posting to “/api/send” with fields for name, email, and phone, which is a common setup for harvesting user data or funneling victims to later account/financial steps.

Key suspicious signals include: (1) aggressive onboarding to a trading platform with promises of security/transparency but without verifiable brand/domain ownership signals beyond self-claims, and (2) a data-collection form immediately presented as the primary action, plus marketing claims like “4M+ registrierte Benutzer” and “Kundeneinlagen” that can be used to create legitimacy. The URL is not a lookalike of a major brand (so no clear “favicon impersonation” or PayPal-style mismatch), but the combination of trading-themed urgency and immediate form submission on an unfamiliar domain still warrants a phishing classification with low confidence.

Conclusion: phishing (or scam-likely) rather than clearly legitimate, mainly due to the presence of a lead/credential collection form within a high-risk financial/trading context and insufficient independent verification from the provided content.