mass.report
Scan Intelligence Report0/100
low Risk
jo-hh.com
https://jo-hh.com
IP
37.1.195.36 · IROKO Networks Corporation
Location
Frankfurt am Main, Germany
Domain Age
37 days
HTTP
404 · 82.1s
SSL
Valid· E7, Let's Encrypt, US
Status
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Unknown
Vendors
27/31
Status
partial
✓ phishtank✓ avast✗ chainpatrol✗ brightcloud✓ bitdefender✓ eset✓ spamhaus✓ urlquery✓ urlscan✓ netcraft✓ apwg✓ apple✓ emsisoft✓ openphish✗ norton✗ threatyeti✓ google✓ mcafee✓ fortiguard✓ isitphish✓ sophos✓ cisa✓ phishreport✓ yandex✓ microsoft✓ virustotal✓ polyswarm✓ urlabuse✓ avg✓ drweb✓ kaspersky
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Unknown
UnknownTechnology · 7/19/2026
Summary
The scan shows a 404 Not Found page at jo-hh.com with a minimal nginx 404 response and a fresh domain (37 days old) using a Let's Encrypt SSL certificate. Network requests include a call to api.ipify.org, but there is no credential form, login, or brand-impostor content observed in the static HTML. The screenshot provided does not reveal any recognizable brand logos or impersonation of a known service. Based on the evidence, there is no clear phishing or impersonation detected from the page content itself; the site appears to be a benign or placeholder page at a newly registered domain.
Evidence Summary
▸Observed 2 capture stage(s); canonical stage is settled_render.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 1
Hosts: 1
Domains: 1
Observed Signals (1)
No visible login forms, credential capture UI, or impersonated branding in static HTML
Observed Indicators (0)
No suspicious indicators identified
Risk AssessmentUsed in abuse reports
The site currently presents as a minimal 404 placeholder on a recently registered domain with a valid but short-lived SSL certificate. There is no evidence of credential harvesting, MFA phishing, or impersonation of a known brand in the static content or network activity. The presence of an external IPify lookup is benign in itself. Given the lack of brand impersonation or user interaction elements, this scan does not confirm an abuse case; continue monitoring for any rehosting or branding changes that could indicate misconfiguration or preparatory setup for abuse.
Recommended Action
Monitor
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API