Is khoindvn.io.vn safe?
http://khoindvn.io.vn/
Coveragestrong3 of 4 applicable core capabilities
Personal site promotes paid iOS certificates and DNS profiles via a flagged affiliate destination.
khoindvn.io.vn presents itself as the personal portal of Vũ Văn Khơi and directs visitors to purchase ESign/KSign certificates for $2 on muacert.com while also offering required DNS profiles and iPA files. Multiple security vendors flag the destination domain as phishing-related, and the site explicitly advertises the paid certificates as the only way to achieve 100% successful app installs.
Loading saved screenshot
Preparing the saved page preview.
Where this site sits
- Dangerous1–20
- High Risk21–44
- Moderate Risk45–69
- Low Risk70–84
- Safe85–100
The score combines saved evidence strength and analysis quality. Coverage is reported separately.
01 · Investigation Brief
Investigation Brief
khoindvn.io.vn presents itself as the personal portal of Vũ Văn Khơi and directs visitors to purchase ESign/KSign certificates for $2 on muacert.com while also offering required DNS profiles and iPA files. Multiple security vendors flag the destination domain as phishing-related, and the site explicitly advertises the paid certificates as the only way to achieve 100% successful app installs.
Strongest evidence
The page contains a prominent multilingual call-to-action offering ESign/KSign certificates for $2 with the explicit claim of 100% successful app installs.
The same section links directly to muacert.com, described as the certificate store, and multiple antivirus services list that domain as a phishing risk.
Technical versus operator risk
The site requires visitors to install a custom DNS profile before downloading ESign/KSign iPA files, a configuration that can reroute device traffic.
Security vendors flag the affiliate destination muacert.com for phishing activity, creating a concrete operator-level risk beyond the technical configuration itself.
Real visitor flow
Visitors first see a warning claiming khoindvn.io.vn is the only official site, then encounter a prominent $2 certificate offer that links to muacert.com.
They are instructed to download a required DNS profile and the ESign/KSign iPA files, both hosted or linked from the same page.
Why the score is 28
A primary play, convert, continue, or download control opened an unrelated external destination. Coverage remains separate so missing sources cannot be mistaken for clean results.
02 · Security Evidence
Security evidence
Antivirus Engines
3/ 92
detectionsSaved result - stale
3 engines flagged this URL
Every saved adverse engine is listed below. The full provider matrix remains available for audit.
- Malicious
- 1
- Suspicious
- 2
- Total
- 92
| Engine | Finding |
|---|---|
| Chong Lua DaoMalicious | malicious |
| alphaMountain.aiSuspicious | suspicious |
| GridinsoftSuspicious | suspicious |
All 92 engine results
- Chong Lua Dao - malicious - Malicious
- alphaMountain.ai - suspicious - Suspicious
- Gridinsoft - suspicious - Suspicious
- 0xSI_f33d - unrated - Clean
- Abusix - clean - Clean
- Acronis - clean - Clean
- ADMINUSLabs - clean - Clean
- AILabs (MONITORAPP) - clean - Clean
- AlienVault - clean - Clean
- AlphaSOC - unrated - Clean
- Antiy-AVL - clean - Clean
- ArcSight Threat Intelligence - unrated - Clean
- AutoShun - unrated - Clean
- Bfore.Ai PreCrime - unrated - Clean
- BitDefender - clean - Clean
- Bkav - unrated - Clean
- BlockList - clean - Clean
- Blueliv - clean - Clean
- Certego - clean - Clean
- ChainPatrol - unrated - Clean
- CINS Army - clean - Clean
- Cluster25 - unrated - Clean
- CRDF - clean - Clean
- Criminal IP - unrated - Clean
- CSIS Security Group - unrated - Clean
- CTX AI - clean - Clean
- Cyan - unrated - Clean
- Cyble - clean - Clean
- CyRadar - clean - Clean
- desenmascara.me - clean - Clean
- DNS8 - unrated - Clean
- Dr.Web - clean - Clean
- EmergingThreats - clean - Clean
- Emsisoft - clean - Clean
- Ermes - unrated - Clean
- ESET - clean - Clean
- ESTsecurity - clean - Clean
- Forcepoint ThreatSeeker - clean - Clean
- Fortinet - clean - Clean
- Fortra - unrated - Clean
- G-Data - clean - Clean
- GCP Abuse Intelligence - unrated - Clean
- Google Safe Browsing - clean - Clean
- GreenSnow - clean - Clean
- GreyNoise - unrated - Clean
- Guardpot - unrated - Clean
- Heimdal Security - clean - Clean
- Hunt.io Intelligence - unrated - Clean
- IPsum - clean - Clean
- Juniper Networks - clean - Clean
- K7AntiVirus - unrated - Clean
- Kaspersky - clean - Clean
- LevelBlue - clean - Clean
- Lionic - clean - Clean
- Lumu - unrated - Clean
- Malwared - clean - Clean
- MalwarePatrol - clean - Clean
- MalwareURL - unrated - Clean
- Mimecast - unrated - Clean
- Netcraft - unrated - Clean
- OpenPhish - clean - Clean
- PhishFort - unrated - Clean
- Phishing Database - clean - Clean
- Phishtank - clean - Clean
- PREBYTES - clean - Clean
- PrecisionSec - unrated - Clean
- Quick Heal - clean - Clean
- Quttera - clean - Clean
- Rising - clean - Clean
- SafeToOpen - unrated - Clean
- Sangfor - clean - Clean
- Sansec eComscan - unrated - Clean
- Scantitan - clean - Clean
- SCUMWARE.org - clean - Clean
- Seclookup - clean - Clean
- Snort IP sample list - unrated - Clean
- SOCRadar - unrated - Clean
- Sophos - clean - Clean
- StopForumSpam - clean - Clean
- Sucuri SiteCheck - clean - Clean
- ThreatHive - clean - Clean
- URLhaus - clean - Clean
- URLQuery - unrated - Clean
- Viettel Threat Intelligence - clean - Clean
- VIPRE - unrated - Clean
- ViriBack - clean - Clean
- VX Vault - clean - Clean
- Webroot - clean - Clean
- Xcitium Verdict Cloud - unrated - Clean
- Yandex Safebrowsing - clean - Clean
- ZeroCERT - clean - Clean
- ZeroFox - unrated - Clean
Security Scans
Checked against the browser threat feeds available to this scan — no hit.
What we observed
Loading saved screenshot
Preparing the saved page preview.
Visual context from the captured page
Buy ESign / KSign certificates for 100% successful app install only $2
What the captured page showed
1 observation- 01
Buy ESign / KSign certificates for 100% successful app install only $2
03 · Investigation Story
Investigation story
What the site claims
Vũ Văn Khơi ( khoindvn )
What we observed
Saved browser evidence recorded cross domain landing.
What independent research found
2 external findings were saved and compared with the page evidence.
What remains unverified
1 of the 4 applicable core capabilities did not complete, so those gaps remain visible in the coverage ledger.
What kind of site and risk is this?
Threat category
Fake Shop & Commercial Deception
Service and business model
Content
Observed behavior
Evidence behind this classification
- 01Site advertises paid ESign/KSign certificates at $2 with 100% success claim.
- 02Website Bán Chứng Chỉ – 50k Certificate Store – $2 证书商店 – $2 Магазин сертификатов – $2 Tienda de Certificados – $2 証明書ストア – $2 인증서 스토어 – $2 Boutique de Certificats – $2 Zertifikat-Shop – $2 Loja de Certificados – $2
- 03Saved antivirus evidence is adverse but is not fresh enough for a current conviction.
Web research findings
Independent findings for khoindvn.io.vn, including public complaints, named review sources, registration records, and look-alike-domain evidence. A missing result is shown as unverified, never converted into a clean bill of health.
- Scam Detectoropen
"The Scam Detector website Validator gives khoindvn.io.vn one of the lowest trust scores on the platform: 10.6. It signals that the business could be defined by the following tags: Untrustworthy. Risky. Danger."
- Gridinsoftopen
"We flagged Muacert.com as phishing. The page behavior matches a common credential-theft flow: impersonation first, urgency second, data request last."
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
04 · Domain & Infrastructure
Domain & infrastructure
The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too. Use this to corroborate the verdict, not to overturn it.
Infrastructure map
How the saved page connected to the wider web.
- Domainkhoindvn.io.vn
- Redirects tokhoindvn.io.vn
- Hosted byCloudflare, Inc.
- Referencesgoogletagmanager.com · images.dmca.com
Contact Verification
Saved contact details can help identify the operator. Their presence supports traceability; it does not prove the business is trustworthy.
- No direct contact email found on the captured page.
- Links to 4 social profiles.
Domain & Encryption
Redirect Chain
- 1301http://khoindvn.io.vn/
- 2200https://khoindvn.io.vn/
Server Reputation
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
05 · Evidence Ledger
Evidence ledger
- Antiviruspartial
- Browser threat feedcomplete
- Page contentcomplete
- Analysiscomplete
- Visual evidencecomplete
The conclusion is supported by the evidence saved with this report.
Technical threat
suspiciousMalware, phishing, credential theft and hostile infrastructure.
Additional evidence review · Additional evidence review
Operator / customer risk
suspiciousComplaints, withdrawals, business conduct and commercial traps.
Additional evidence review · Additional evidence review
Source coverage and freshness
Status shows whether usable evidence was saved; finding shows what that evidence observed.
| Source | Result | Completion | Finding | Freshness |
|---|---|---|---|---|
| Antivirus | 3 of 92 engines flagged | Limited | Adverse | stale fallback · Aug 9, 2026 |
| Browser protection | No browser threat-list match | Completed | No adverse finding | Not available |
| Page content | Page fetched · HTTP 200 | Completed | No adverse finding | Not available |
| Visual evidence | 1 visible observation saved with the page capture | Completed | No adverse finding | Not available |
| Independent research | 2 independent findings were saved | Completed | Adverse | Not available |
- Antivirus
- Result3 of 92 engines flagged
- CompletionLimited
- FindingAdverse
- Freshnessstale fallback · Aug 9, 2026
- Browser protection
- ResultNo browser threat-list match
- CompletionCompleted
- FindingNo adverse finding
- FreshnessNot available
- Page content
- ResultPage fetched · HTTP 200
- CompletionCompleted
- FindingNo adverse finding
- FreshnessNot available
- Visual evidence
- Result1 visible observation saved with the page capture
- CompletionCompleted
- FindingNo adverse finding
- FreshnessNot available
- Independent research
- Result2 independent findings were saved
- CompletionCompleted
- FindingAdverse
- FreshnessNot available
07 · Safety FAQ
Safety FAQ
Common questions, answered directly from the scan data above — so the answers reflect the saved verdict and evidence in this report.
Is khoindvn.io.vn a scam or a legit online store?
Is khoindvn.io.vn safe to use?
I already paid or entered my details on khoindvn.io.vn — what should I do?
Can I get my money back from khoindvn.io.vn?
I ordered from khoindvn.io.vn but nothing arrived — is it a fake shop?
How do I report khoindvn.io.vn?
khoindvn.io.vn looks professional — how can it still be a scam?
Has khoindvn.io.vn been flagged by antivirus engines?
Is khoindvn.io.vn on any phishing or malware blacklists?
Does khoindvn.io.vn have a valid SSL certificate?
Where is khoindvn.io.vn hosted?
How often is the khoindvn.io.vn report updated?
08 · Final Verdict
Final verdict
Personal site promotes paid iOS certificates and DNS profiles via a flagged affiliate destination.
khoindvn.io.vn presents itself as the personal portal of Vũ Văn Khơi and directs visitors to purchase ESign/KSign certificates for $2 on muacert.com while also offering required DNS profiles and iPA files. Multiple security vendors flag the destination domain as phishing-related, and the site explicitly advertises the paid certificates as the only way to achieve 100% successful app installs.
09 · Community
