ScanMalware.com
Microsoft logo

Microsoft phishing & impersonation

Tech & Cloudmicrosoft.com
282
Impersonation sightings
159
Distinct hosts
2026-08-16
Last detected
13
Official domains

ScanMalware watches every scanned site for signs it is impersonating Microsoft — the brand name in the page title or screenshot text, the brand's logo/favicon on a non-official host, and lookalike domains. A match on a host outside Microsoft's official domains is recorded below.

Official domains
microsoft.comaka.msazure.comlive.commicrosoftonline.commicrosoftonline.usmsauth.netmsftauth.netoffice.comoffice365.comoutlook.comsharepoint.comwindows.net
Also known as
outlookoffice 365hotmaillive.comonedrivesharepoint

Detected impersonation sites

HostTitleDetected byVerdictDate
protectedcloud-message.merlekw.workers.devMicrosoft VerificationPage text{"verdict": "Medium Risk", "confidence": 43, "risk level": "medium", "risk factors": ["Mixed Content", "Brand Impersonation (Microsoft)"], "overall score": 43, "recommendations": ["⚡ Exercise caution when visiting this website", "🛡️ Ensure your browser and antivirus are up to date", "🔐 Website serves insecure content - data may be intercepted"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (protectedcloud-message.merlekw.workers.dev)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 2, "total risk": 0, "valid count": 2, "invalid count": 0, "not found count": 0}, "network security": {"score": 30, "issues": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected"], "mixed content": true, "secure requests": 2, "security headers": {"detected": true}, "insecure requests": 1, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 10, "rdap data": null, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (protectedcloud-message.merlekw.workers.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-16View scan →
test1.sougoucloud.workers.devSuspected Phishing | CloudflareLogo / favicon{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Mixed Content", "Cloudflare Phishing Warning", "Favicon matches Microsoft but domain 'test1.sougoucloud.workers.dev' is not a legitimate Microsoft domain"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🔐 Website serves insecure content - data may be intercepted"], "detailed analysis": {"html forms": {"score": 50, "issues": [], "password fields": 0, "impersonated brand": null, "brand mismatch detected": false, "impersonated brand slug": null, "disguised password fields": 0, "brand impersonation detected": false}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Cloudflare detected: Suspected Phishing | Cloudflare"], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 3, "total risk": 0, "valid count": 3, "invalid count": 0, "not found count": 0}, "network security": {"score": 30, "issues": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected"], "mixed content": true, "secure requests": 6, "security headers": {"detected": true}, "insecure requests": 1, "certificate issues": []}, "phishing signals": {"score": 65, "issues": ["Favicon matches Microsoft but domain 'test1.sougoucloud.workers.dev' is not a legitimate Microsoft domain"], "details": {"favicon brand": {"brand": "Microsoft", "source": "curated", "penalty": 35, "embed risk": "high", "corroborated": true}, "matched brand": "Microsoft", "signals detected": ["favicon brand mismatch"], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}, "cloudflare phishing": {"source": "Cloudflare", "detected": true, "page title": "Suspected Phishing | Cloudflare", "detected at": "2026-08-16T01:48:34.262498+00:00"}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected", "Cloudflare detected: Suspected Phishing | Cloudflare", "Cloudflare flagged as: Suspected Phishing | Cloudflare", "Favicon matches Microsoft but domain 'test1.sougoucloud.workers.dev' is not a legitimate Microsoft domain"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-16View scan →
test1.sougoucloud.workers.devYour request has been blocked. This could be due to several reasons.Logo / favicon{"verdict": "Low Risk", "confidence": 66, "risk level": "low", "risk factors": ["Mixed Content", "Favicon matches Microsoft but domain 'test1.sougoucloud.workers.dev' is not a legitimate Microsoft domain"], "overall score": 34, "recommendations": ["🔐 Website serves insecure content - data may be intercepted"], "detailed analysis": {"html forms": {"score": 50, "issues": [], "password fields": 0, "impersonated brand": null, "brand mismatch detected": false, "impersonated brand slug": null, "disguised password fields": 0, "brand impersonation detected": false}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 5, "total risk": 0, "valid count": 5, "invalid count": 0, "not found count": 0}, "network security": {"score": 30, "issues": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected"], "mixed content": true, "secure requests": 14, "security headers": {"detected": true}, "insecure requests": 1, "certificate issues": []}, "phishing signals": {"score": 65, "issues": ["Favicon matches Microsoft but domain 'test1.sougoucloud.workers.dev' is not a legitimate Microsoft domain"], "details": {"favicon brand": {"brand": "Microsoft", "source": "curated", "penalty": 35, "embed risk": "high", "corroborated": true}, "matched brand": "Microsoft", "signals detected": ["favicon brand mismatch"], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected", "Favicon matches Microsoft but domain 'test1.sougoucloud.workers.dev' is not a legitimate Microsoft domain"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-15View scan →
defnewfrenchwin-72e1.vercel.appObtenir de l'aide 0121Page text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (defnewfrenchwin-72e1.vercel.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 31, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (defnewfrenchwin-72e1.vercel.app)", "Google Safe Browsing detected phishing"], "positive": ["HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-08-15View scan →
server-static-page--optimumcarasls2.replit.appSecurity verification - Microsoft accountPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (server-static-page--optimumcarasls2.replit.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 5, "total risk": 0, "valid count": 5, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 7, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 45, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 1, "distinct redirect patterns": 1, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (server-static-page--optimumcarasls2.replit.app)", "Google Safe Browsing detected phishing"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-08-15View scan →
simple-security-page--weekkiol.replit.appSecurity verification - Microsoft accountPage text{"verdict": "Low Risk", "confidence": 71, "risk level": "low", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 29, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (simple-security-page--weekkiol.replit.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 6, "total risk": 0, "valid count": 6, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 7, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 45, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 1, "distinct redirect patterns": 1, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (simple-security-page--weekkiol.replit.app)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-15View scan →
defnewfrenchwin-72e1.vercel.appObtenir de l'aide 0121Page text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (defnewfrenchwin-72e1.vercel.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 4, "total risk": 0, "valid count": 4, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 31, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 10, "rdap data": null, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (defnewfrenchwin-72e1.vercel.app)", "Google Safe Browsing detected phishing"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-08-15View scan →
login.squaredup.comSign inPage text{"verdict": "Low Risk", "confidence": 68, "risk level": "low", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 32, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (login.squaredup.com)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 55, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Unusually long URL"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 24, "total risk": 0, "valid count": 24, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 166, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 75, "issues": [], "details": {"matched brand": "Microsoft 365", "signals detected": ["title domain mismatch"], "is legitimate domain": false}, "warnings": ["Page title matches Microsoft 365 login pattern but domain 'login.squaredup.com' is not a legitimate Microsoft 365 domain"]}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 2, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 1, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 1, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (login.squaredup.com)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": ["Page title matches Microsoft 365 login pattern but domain 'login.squaredup.com' is not a legitimate Microsoft 365 domain"]}}2026-08-15View scan →
a5c33326-c5c4-8159-b0a9-docusign.rajesh-das1010.workers.devDocuSign - Review DocumentPage text{"verdict": "Medium Risk", "confidence": 50, "risk level": "medium", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)", "References flagged external domain(s): rajesh-das1010.workers.dev"], "overall score": 50, "recommendations": ["⚡ Exercise caution when visiting this website", "🛡️ Ensure your browser and antivirus are up to date"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (a5c33326-c5c4-8159-b0a9-docusign.rajesh-das1010.workers.dev)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "ioc matches": {"external": [{"indicator": "rajesh-das1010.workers.dev", "threat type": "known attacker"}]}, "url analysis": {"score": 35, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected", "Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 5, "total risk": 0, "valid count": 5, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 10, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 15, "rdap data": null, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (a5c33326-c5c4-8159-b0a9-docusign.rajesh-das1010.workers.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-15View scan →
variousoffers.xyzAccess your file - OneDrivePage text{"verdict": "Low Risk", "confidence": 73, "risk level": "low", "risk factors": ["Brand Impersonation (Microsoft)"], "overall score": 27, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (variousoffers.xyz)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 2, "total risk": 0, "valid count": 2, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 3, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (variousoffers.xyz)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-15View scan →
supp0rt-assistance.vercel.appWindows SecurityPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Mixed Content", "Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🔐 Website serves insecure content - data may be intercepted", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (supp0rt-assistance.vercel.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 8, "total risk": 0, "valid count": 8, "invalid count": 0, "not found count": 0}, "network security": {"score": 30, "issues": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected"], "mixed content": true, "secure requests": 84, "security headers": {"detected": true}, "insecure requests": 1, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 3, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (supp0rt-assistance.vercel.app)", "Google Safe Browsing detected phishing"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "No visual similarity to known brand sites"], "warnings": []}}2026-08-15View scan →
www.linkedin.comSign Up | LinkedInPage text{"verdict": "Low Risk", "confidence": 71, "risk level": "low", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 29, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (www.linkedin.com)"], "password fields": 2, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 55, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Unusually long URL"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 11, "total risk": 0, "valid count": 11, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 45, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"favicon brand": {"brand": "LinkedIn", "source": "curated", "on legit domain": true}, "matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 40, "issues": [], "total redirects": 4, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 2, "distinct redirect patterns": 2, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (www.linkedin.com)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-14View scan →
office365order.github.ioSign in to your Microsoft accountPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Brand Impersonation (Microsoft)", "Google Safe Browsing Threats", "Page title explicitly mentions Microsoft 365 but domain 'office365order.github.io' is not a legitimate Microsoft 365 domain"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (office365order.github.io)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 2, "total risk": 0, "valid count": 2, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 4, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 40, "issues": ["Page title explicitly mentions Microsoft 365 but domain 'office365order.github.io' is not a legitimate Microsoft 365 domain"], "details": {"matched brand": "Microsoft 365", "signals detected": ["title domain mismatch", "no forms vnc"], "is legitimate domain": false}, "warnings": ["Microsoft 365 login title but no HTML input forms detected (possible VNC/canvas-based phishing)"]}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (office365order.github.io)", "Google Safe Browsing detected phishing", "Page title explicitly mentions Microsoft 365 but domain 'office365order.github.io' is not a legitimate Microsoft 365 domain"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": ["Microsoft 365 login title but no HTML input forms detected (possible VNC/canvas-based phishing)"]}}2026-08-14View scan →
php-web-server--unittec.replit.appIniciar sesión en tu cuenta MicrosoftPage text{"verdict": "High Risk (Credential Phishing on disposable hosting)", "confidence": 75, "risk level": "high", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 60, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (php-web-server--unittec.replit.app)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 9, "total risk": 2, "valid count": 8, "invalid count": 0, "not found count": 1}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 45, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 1, "distinct redirect patterns": 1, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["Credential form on a disposable hosting tenant (php-web-server--unittec.replit.app) whose page does not identify that host as its own brand — the shape of a throwaway credential-harvest deployment.", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (php-web-server--unittec.replit.app)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-14View scan →
promptspark.netAccess your file - OneDrivePage text{"verdict": "Low Risk", "confidence": 72, "risk level": "low", "risk factors": ["Brand Impersonation (Onedrive)"], "overall score": 28, "recommendations": ["📋 Website lacks important security headers"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Onedrive branding on non-official domain (promptspark.net)"], "password fields": 0, "impersonated brand": "Onedrive", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 2, "total risk": 0, "valid count": 2, "invalid count": 0, "not found count": 0}, "network security": {"score": 60, "issues": ["No security headers detected"], "mixed content": false, "secure requests": 1, "security headers": {"detected": false}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["No security headers detected", "⚠️ CRITICAL: Brand impersonation detected - Onedrive branding on non-official domain (promptspark.net)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-14View scan →
jimcooks211.github.ioMicrosoft Personal AccountPage text{"verdict": "High Risk (Credential Phishing on disposable hosting)", "confidence": 75, "risk level": "high", "risk factors": ["Brand Impersonation (Microsoft)"], "overall score": 60, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "📋 Website lacks important security headers"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (jimcooks211.github.io)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 2, "total risk": 0, "valid count": 2, "invalid count": 0, "not found count": 0}, "network security": {"score": 60, "issues": ["No security headers detected"], "mixed content": false, "secure requests": 1, "security headers": {"detected": false}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["Credential form on a disposable hosting tenant (jimcooks211.github.io) whose page does not identify that host as its own brand — the shape of a throwaway credential-harvest deployment.", "No security headers detected", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (jimcooks211.github.io)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-13View scan →
php-web-server--soportemex.replit.appIniciarPage text{"verdict": "Low Risk", "confidence": 72, "risk level": "low", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 28, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (php-web-server--soportemex.replit.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 5, "total risk": 0, "valid count": 5, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (php-web-server--soportemex.replit.app)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-13View scan →
pub-de59803496c8489585895b6917266e7c.r2.devFiles | OneDrivePage text{"verdict": "Low Risk", "confidence": 67, "risk level": "low", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Onedrive)"], "overall score": 33, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Onedrive branding on non-official domain (pub-de59803496c8489585895b6917266e7c.r2.dev)"], "password fields": 0, "impersonated brand": "Onedrive", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 9, "total risk": 0, "valid count": 9, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 14, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 5, "rdap data": {"domain": "r2.dev", "age days": 1450, "category": "ESTABLISHED", "registrar": null, "registration date": "2022-08-23T14:38:38.654000+00:00"}, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Onedrive branding on non-official domain (pub-de59803496c8489585895b6917266e7c.r2.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-13View scan →
sharepoint3883-4388eral-a8qi.bolt.hostSign in to your accountPage text{"verdict": "High Risk", "confidence": 55, "risk level": "high", "risk factors": ["Mixed Content", "Suspicious URL Patterns", "Brand Impersonation (Microsoft)", "References flagged external domain(s): 149.154.166.110", "Favicon matches Microsoft but domain 'sharepoint3883-4388eral-a8qi.bolt.host' is not a legitimate Microsoft domain (credential form present)"], "overall score": 55, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🔐 Website serves insecure content - data may be intercepted"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (sharepoint3883-4388eral-a8qi.bolt.host)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "ioc matches": {"external": [{"indicator": "149.154.166.110", "threat type": "known attacker"}]}, "url analysis": {"score": 40, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected", "Unusually long URL"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 10, "total risk": 0, "valid count": 10, "invalid count": 0, "not found count": 0}, "network security": {"score": 30, "issues": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected"], "mixed content": true, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 1, "certificate issues": []}, "phishing signals": {"score": 40, "issues": ["Favicon matches Microsoft but domain 'sharepoint3883-4388eral-a8qi.bolt.host' is not a legitimate Microsoft domain (credential form present)"], "details": {"favicon brand": {"brand": "Microsoft", "source": "curated", "penalty": 35, "embed risk": "high", "corroborated": true}, "matched brand": "Microsoft 365", "signals detected": ["favicon brand mismatch", "title domain mismatch"], "is legitimate domain": false}, "warnings": ["Page title matches Microsoft 365 login pattern but domain 'sharepoint3883-4388eral-a8qi.bolt.host' is not a legitimate Microsoft 365 domain"]}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 5, "rdap data": {"domain": "bolt.host", "age days": 636, "category": "ESTABLISHED", "registrar": "Cloudflare, Inc.", "registration date": "2024-11-14T18:27:23+00:00"}, "has login forms": true, "is hosting subdomain": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (sharepoint3883-4388eral-a8qi.bolt.host)", "Favicon matches Microsoft but domain 'sharepoint3883-4388eral-a8qi.bolt.host' is not a legitimate Microsoft domain (credential form present)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": ["Page title matches Microsoft 365 login pattern but domain 'sharepoint3883-4388eral-a8qi.bolt.host' is not a legitimate Microsoft 365 domain"]}}2026-08-13View scan →
mynah.pages.devMicrosoft SharePoint | File SharePage text{"verdict": "Low Risk", "confidence": 73, "risk level": "low", "risk factors": ["Brand Impersonation (Microsoft)"], "overall score": 27, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (mynah.pages.dev)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 2, "total risk": 0, "valid count": 2, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (mynah.pages.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-13View scan →
project-token-shakre.replit.appSharing Link ValidationPage text{"verdict": "Low Risk", "confidence": 73, "risk level": "low", "risk factors": ["Brand Impersonation (Microsoft)"], "overall score": 27, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (project-token-shakre.replit.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 8, "total risk": 0, "valid count": 8, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (project-token-shakre.replit.app)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-12View scan →
open-portal-8hjs.p-srkphq9l.workers.devSharePoint - Shared DocumentPage text{"verdict": "Medium Risk", "confidence": 52, "risk level": "medium", "risk factors": ["Mixed Content", "Protocol Downgrade", "Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 52, "recommendations": ["⚡ Exercise caution when visiting this website", "🛡️ Ensure your browser and antivirus are up to date", "🔐 Website serves insecure content - data may be intercepted", "⬇️ Connection was downgraded from HTTPS to HTTP", "📋 Website lacks important security headers"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (open-portal-8hjs.p-srkphq9l.workers.dev)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 15, "issues": ["No HTTPS encryption"], "positive signals": [], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 2, "total risk": 0, "valid count": 2, "invalid count": 0, "not found count": 0}, "network security": {"score": 20, "issues": ["Mixed content detected (HTTP resources on HTTPS page)", "3 insecure HTTP requests detected"], "mixed content": true, "secure requests": 2, "security headers": {"detected": true}, "insecure requests": 3, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 25, "issues": ["HTTPS to HTTP protocol downgrade detected"], "total redirects": 2, "blob url detected": false, "protocol downgrades": 1, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 10, "rdap data": null, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["No HTTPS encryption", "Mixed content detected (HTTP resources on HTTPS page)", "3 insecure HTTP requests detected", "HTTPS to HTTP protocol downgrade detected", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (open-portal-8hjs.p-srkphq9l.workers.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-12View scan →
ecomrestack.comCan I vibe code Sana Commerce? — honest verdict, scores and build promptPage text{"verdict": "Medium Risk", "confidence": 47, "risk level": "medium", "risk factors": ["Brand Impersonation (Microsoft)"], "overall score": 47, "recommendations": ["⚡ Exercise caution when visiting this website", "🛡️ Ensure your browser and antivirus are up to date"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (ecomrestack.com)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 6, "total risk": 0, "valid count": 6, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 37, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 20, "rdap data": {"domain": "ecomrestack.com", "age days": 7, "category": "VERY NEW", "registrar": null, "registration date": "2026-08-04T11:25:24+00:00"}, "has login forms": true, "is hosting subdomain": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (ecomrestack.com)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-12View scan →
learn.ucem.ac.ukLog in to the site | My VLEPage text{"verdict": "Low Risk", "confidence": 73, "risk level": "low", "risk factors": ["Brand Impersonation (Microsoft)"], "overall score": 27, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (learn.ucem.ac.uk)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 5, "total risk": 0, "valid count": 5, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 35, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (learn.ucem.ac.uk)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-10View scan →
cp.intermedia.netIntermedia Customer LoginPage text{"verdict": "Low Risk", "confidence": 73, "risk level": "low", "risk factors": ["Brand Impersonation (Office 365)"], "overall score": 27, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Office 365 branding on non-official domain (cp.intermedia.net)"], "password fields": 1, "impersonated brand": "Office 365", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 15, "total risk": 2, "valid count": 14, "invalid count": 0, "not found count": 1}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 53, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"favicon brand": {"brand": "intermedia.net", "source": "umbrella", "on legit domain": true}, "matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 45, "issues": [], "total redirects": 2, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 1, "distinct redirect patterns": 1, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Office 365 branding on non-official domain (cp.intermedia.net)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-10View scan →
servicedarbrea1.caContact — Service D'arbre A1Page text{"verdict": "High Risk", "confidence": 58, "risk level": "high", "risk factors": ["Mixed Content", "Brand Impersonation (Outlook.Com)"], "overall score": 58, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🔐 Website serves insecure content - data may be intercepted"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Outlook.Com branding on non-official domain (servicedarbrea1.ca)"], "password fields": 0, "impersonated brand": "Outlook.Com", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 5, "total risk": 0, "valid count": 5, "invalid count": 0, "not found count": 0}, "network security": {"score": 30, "issues": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected"], "mixed content": true, "secure requests": 14, "security headers": {"detected": true}, "insecure requests": 1, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 2, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 25, "rdap data": {"domain": "servicedarbrea1.ca", "age days": 4, "category": "CRITICAL", "registrar": null, "registration date": "2026-08-05T21:26:43+00:00"}, "has login forms": true, "is hosting subdomain": false}}, "threat categories": [], "security indicators": {"negative": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected", "⚠️ CRITICAL: Brand impersonation detected - Outlook.Com branding on non-official domain (servicedarbrea1.ca)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-10View scan →
qualitybh.art.brShare Point OnlinePage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Brand Impersonation (Onedrive)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Onedrive branding on non-official domain (qualitybh.art.br)"], "password fields": 1, "impersonated brand": "Onedrive", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 7, "total risk": 0, "valid count": 7, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 21, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Onedrive branding on non-official domain (qualitybh.art.br)", "Google Safe Browsing detected phishing"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-08-09View scan →
secure-static-page--andrewkhan89.replit.appSecurity verification - Microsoft accountPage text{"verdict": "Low Risk", "confidence": 71, "risk level": "low", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 29, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (secure-static-page--andrewkhan89.replit.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 6, "total risk": 0, "valid count": 6, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 7, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 45, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 1, "distinct redirect patterns": 1, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (secure-static-page--andrewkhan89.replit.app)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-09View scan →
mmaglobal.comAndrew Bosworth | MMA / Marketing + Media AlliancePage text{"verdict": "Low Risk", "confidence": 73, "risk level": "low", "risk factors": ["Brand Impersonation (Microsoft)"], "overall score": 27, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (mmaglobal.com)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 74, "total risk": 6, "valid count": 71, "invalid count": 0, "not found count": 3}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 152, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 1, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 1, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (mmaglobal.com)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-09View scan →
qjozvnvk6bohnpfx5m6.8d8yd9prtx649bohfe2jy7hiu.workers.devEstablishing your sessionPage text{"verdict": "Medium Risk", "confidence": 39, "risk level": "medium", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 39, "recommendations": ["⚡ Exercise caution when visiting this website", "🛡️ Ensure your browser and antivirus are up to date"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (qjozvnvk6bohnpfx5m6.8d8yd9prtx649bohfe2jy7hiu.workers.dev)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 40, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Unusually long URL", "Encoded URL/query string embedded in path"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 1, "total risk": 0, "valid count": 1, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 2, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 2, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 10, "rdap data": null, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (qjozvnvk6bohnpfx5m6.8d8yd9prtx649bohfe2jy7hiu.workers.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-08View scan →
outconfiadd.webcindario.comIniciar sesión en tu cuenta MicrosoftPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (outconfiadd.webcindario.com)"], "password fields": 2, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 53, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (outconfiadd.webcindario.com)", "Google Safe Browsing detected phishing"], "positive": ["HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-08-07View scan →
pub-d68525cbc6144dcaaac2fc0354aa17dd.r2.devDocuSign - Review DocumentPage text{"verdict": "Low Risk", "confidence": 67, "risk level": "low", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 33, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (pub-d68525cbc6144dcaaac2fc0354aa17dd.r2.dev)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 2, "total risk": 0, "valid count": 2, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 2, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 5, "rdap data": {"domain": "r2.dev", "age days": 1444, "category": "ESTABLISHED", "registrar": null, "registration date": "2022-08-23T14:38:38.654000+00:00"}, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (pub-d68525cbc6144dcaaac2fc0354aa17dd.r2.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-07View scan →
php-web-server--unittec.replit.appIniciar sesión en tu cuenta MicrosoftPage text{"verdict": "High Risk (Possible Microsoft Phishing on cloud hosting)", "confidence": 80, "risk level": "high", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 60, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (php-web-server--unittec.replit.app)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 9, "total risk": 2, "valid count": 8, "invalid count": 0, "not found count": 1}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 45, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 1, "distinct redirect patterns": 1, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["Microsoft brand impersonation with a credential form on a disposable cloud-hosting/storage subdomain (php-web-server--unittec.replit.app) — consistent with credential phishing.", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (php-web-server--unittec.replit.app)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-07View scan →
outlookmailwww.webcindario.comIniciar sesión en tu cuenta MicrosoftPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (outlookmailwww.webcindario.com)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 14, "total risk": 0, "valid count": 14, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 20, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (outlookmailwww.webcindario.com)", "Google Safe Browsing detected phishing"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-08-07View scan →
busy-apricot-rh2zba1f.edgeone.devSign in to your accountPage text{"verdict": "High Risk (Possible Microsoft Phishing on cloud hosting)", "confidence": 80, "risk level": "high", "risk factors": ["Mixed Content", "Protocol Downgrade", "Brand Impersonation (Microsoft)", "References flagged external domain(s): 43.174.246.29, 43.174.247.29"], "overall score": 60, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🔐 Website serves insecure content - data may be intercepted", "⬇️ Connection was downgraded from HTTPS to HTTP"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (busy-apricot-rh2zba1f.edgeone.dev)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "ioc matches": {"external": [{"indicator": "43.174.246.29", "threat type": "known attacker"}, {"indicator": "43.174.247.29", "threat type": "known attacker"}]}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 8, "total risk": 0, "valid count": 8, "invalid count": 0, "not found count": 0}, "network security": {"score": 25, "issues": ["Mixed content detected (HTTP resources on HTTPS page)", "2 insecure HTTP requests detected"], "mixed content": true, "secure requests": 10, "security headers": {"detected": true}, "insecure requests": 2, "certificate issues": []}, "phishing signals": {"score": 55, "issues": [], "details": {"matched brand": "Microsoft 365", "signals detected": ["title domain mismatch", "aitm bootstrap"], "is legitimate domain": false}, "warnings": ["Page title matches Microsoft 365 login pattern but domain 'busy-apricot-rh2zba1f.edgeone.dev' is not a legitimate Microsoft 365 domain", "Behavioral signature contains AiTM proxy bootstrap pattern (document.write injection)"]}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 25, "issues": ["HTTPS to HTTP protocol downgrade detected"], "total redirects": 3, "blob url detected": false, "protocol downgrades": 1, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["Microsoft brand impersonation with a credential form on a disposable cloud-hosting/storage subdomain (busy-apricot-rh2zba1f.edgeone.dev) — consistent with credential phishing.", "Mixed content detected (HTTP resources on HTTPS page)", "2 insecure HTTP requests detected", "HTTPS to HTTP protocol downgrade detected", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (busy-apricot-rh2zba1f.edgeone.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": ["Page title matches Microsoft 365 login pattern but domain 'busy-apricot-rh2zba1f.edgeone.dev' is not a legitimate Microsoft 365 domain", "Behavioral signature contains AiTM proxy bootstrap pattern (document.write injection)"]}}2026-08-07View scan →
jimcooks211.github.ioMicrosoft Personal AccountPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (jimcooks211.github.io)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 2, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (jimcooks211.github.io)", "Google Safe Browsing detected phishing"], "positive": ["HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-08-06View scan →
pub-de59803496c8489585895b6917266e7c.r2.devFiles | OneDrivePage text{"verdict": "Low Risk", "confidence": 67, "risk level": "low", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Onedrive)"], "overall score": 33, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Onedrive branding on non-official domain (pub-de59803496c8489585895b6917266e7c.r2.dev)"], "password fields": 0, "impersonated brand": "Onedrive", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 10, "total risk": 0, "valid count": 10, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 14, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 5, "rdap data": {"domain": "r2.dev", "age days": 1443, "category": "ESTABLISHED", "registrar": null, "registration date": "2022-08-23T14:38:38.654000+00:00"}, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Onedrive branding on non-official domain (pub-de59803496c8489585895b6917266e7c.r2.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-06View scan →
sfahad-developer.github.ioMicrosoftPage text{"verdict": "Low Risk", "confidence": 73, "risk level": "low", "risk factors": ["Brand Impersonation (Microsoft)"], "overall score": 27, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (sfahad-developer.github.io)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 6, "total risk": 0, "valid count": 6, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 17, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (sfahad-developer.github.io)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-06View scan →
mynah.pages.devMicrosoft SharePoint | File SharePage text{"verdict": "Low Risk", "confidence": 73, "risk level": "low", "risk factors": ["Brand Impersonation (Microsoft)"], "overall score": 27, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (mynah.pages.dev)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 2, "total risk": 0, "valid count": 2, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (mynah.pages.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-05View scan →
security-server-docs--govmentdded.replit.appSign in to OutlookPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (security-server-docs--govmentdded.replit.app)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 5, "total risk": 0, "valid count": 5, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 8, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (security-server-docs--govmentdded.replit.app)", "Google Safe Browsing detected phishing"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-08-05View scan →
sanghagarageservices.caContact & Free Quote | Sangha Garage Services — Greater Toronto AreaPage text{"verdict": "Medium Risk", "confidence": 47, "risk level": "medium", "risk factors": ["Brand Impersonation (Outlook.Com)"], "overall score": 47, "recommendations": ["⚡ Exercise caution when visiting this website", "🛡️ Ensure your browser and antivirus are up to date"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Outlook.Com branding on non-official domain (sanghagarageservices.ca)"], "password fields": 0, "impersonated brand": "Outlook.Com", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 5, "total risk": 0, "valid count": 5, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 20, "rdap data": {"domain": "sanghagarageservices.ca", "age days": 16, "category": "VERY NEW", "registrar": null, "registration date": "2026-07-20T14:42:26+00:00"}, "has login forms": true, "is hosting subdomain": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Outlook.Com branding on non-official domain (sanghagarageservices.ca)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-05View scan →
server-docs--emmamarshall910.replit.appSecurity verification - Microsoft accountPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (server-docs--emmamarshall910.replit.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 6, "total risk": 0, "valid count": 6, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 7, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 45, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 1, "distinct redirect patterns": 1, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 10, "rdap data": null, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (server-docs--emmamarshall910.replit.app)", "Google Safe Browsing detected phishing"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-08-05View scan →
access-form-82h6.p-srkphq9l.workers.devSharePoint - Shared DocumentPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Sharepoint)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Sharepoint branding on non-official domain (access-form-82h6.p-srkphq9l.workers.dev)"], "password fields": 0, "impersonated brand": "Sharepoint", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 3, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 10, "rdap data": null, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Sharepoint branding on non-official domain (access-form-82h6.p-srkphq9l.workers.dev)", "Google Safe Browsing detected phishing"], "positive": ["HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-08-05View scan →
auth0-ms-doc.netlify.appSign in to your Microsoft accountPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Mixed Content", "Brand Impersonation (Microsoft)", "Google Safe Browsing Threats", "Favicon matches live.com but domain 'auth0-ms-doc.netlify.app' is not a legitimate live.com domain (credential form present)", "Page title explicitly mentions Microsoft 365 but domain 'auth0-ms-doc.netlify.app' is not a legitimate Microsoft 365 domain"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🔐 Website serves insecure content - data may be intercepted", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (auth0-ms-doc.netlify.app)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 3, "total risk": 0, "valid count": 3, "invalid count": 0, "not found count": 0}, "network security": {"score": 30, "issues": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected"], "mixed content": true, "secure requests": 8, "security headers": {"detected": true}, "insecure requests": 1, "certificate issues": []}, "phishing signals": {"score": 30, "issues": ["Favicon matches live.com but domain 'auth0-ms-doc.netlify.app' is not a legitimate live.com domain (credential form present)", "Page title explicitly mentions Microsoft 365 but domain 'auth0-ms-doc.netlify.app' is not a legitimate Microsoft 365 domain"], "details": {"favicon brand": {"brand": "live.com", "source": "umbrella", "penalty": 30, "embed risk": "auto", "corroborated": true}, "matched brand": "Microsoft 365", "signals detected": ["favicon brand mismatch umbrella", "title domain mismatch"], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (auth0-ms-doc.netlify.app)", "Google Safe Browsing detected phishing", "Favicon matches live.com but domain 'auth0-ms-doc.netlify.app' is not a legitimate live.com domain (credential form present)", "Page title explicitly mentions Microsoft 365 but domain 'auth0-ms-doc.netlify.app' is not a legitimate Microsoft 365 domain"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "No visual similarity to known brand sites"], "warnings": []}}2026-08-03View scan →
qualitybh.art.brShare Point OnlinePage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Brand Impersonation (Onedrive)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Onedrive branding on non-official domain (qualitybh.art.br)"], "password fields": 1, "impersonated brand": "Onedrive", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 8, "total risk": 0, "valid count": 8, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 21, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Onedrive branding on non-official domain (qualitybh.art.br)", "Google Safe Browsing detected phishing"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-08-02View scan →
secure-static-page--andrewkhan89.replit.appSecurity verification - Microsoft accountPage text{"verdict": "Low Risk", "confidence": 71, "risk level": "low", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 29, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (secure-static-page--andrewkhan89.replit.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 6, "total risk": 0, "valid count": 6, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 7, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 45, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 1, "distinct redirect patterns": 1, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (secure-static-page--andrewkhan89.replit.app)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-02View scan →
php-web-server--mexicoeducation.replit.appIniciar sesión en tu cuenta MicrosoftPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (php-web-server--mexicoeducation.replit.app)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 9, "total risk": 2, "valid count": 8, "invalid count": 0, "not found count": 1}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 45, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 1, "distinct redirect patterns": 1, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 10, "rdap data": null, "has login forms": true, "is hosting subdomain": true}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (php-web-server--mexicoeducation.replit.app)", "Google Safe Browsing detected phishing"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-08-02View scan →
rhsmithumdedu.netlify.appSign in to your Microsoft accountPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Mixed Content", "Brand Impersonation (Microsoft)", "Google Safe Browsing Threats", "Page title explicitly mentions Microsoft 365 but domain 'rhsmithumdedu.netlify.app' is not a legitimate Microsoft 365 domain"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🔐 Website serves insecure content - data may be intercepted", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (rhsmithumdedu.netlify.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "network security": {"score": 30, "issues": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected"], "mixed content": true, "secure requests": 7, "security headers": {"detected": true}, "insecure requests": 1, "certificate issues": []}, "phishing signals": {"score": 40, "issues": ["Page title explicitly mentions Microsoft 365 but domain 'rhsmithumdedu.netlify.app' is not a legitimate Microsoft 365 domain"], "details": {"matched brand": "Microsoft 365", "signals detected": ["title domain mismatch", "no forms vnc"], "is legitimate domain": false}, "warnings": ["Microsoft 365 login title but no HTML input forms detected (possible VNC/canvas-based phishing)"]}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (rhsmithumdedu.netlify.app)", "Google Safe Browsing detected phishing", "Page title explicitly mentions Microsoft 365 but domain 'rhsmithumdedu.netlify.app' is not a legitimate Microsoft 365 domain"], "positive": ["HTTPS encryption used", "No visual similarity to known brand sites"], "warnings": ["Microsoft 365 login title but no HTML input forms detected (possible VNC/canvas-based phishing)"]}}2026-08-02View scan →
compliance.it-communications.workers.devSign in to your accountPage text{"verdict": "Malicious (Microsoft 365 Credential Phishing)", "confidence": 90, "risk level": "malicious", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)", "Microsoft login-page config schema ($Config: urlGetCredentialType, iMaxStackForKnockoutAsyncComponents, sFTName, urlMsaSignUp) served on 'compliance.it-communications.workers.dev', not a legitimate Microsoft domain — adversary-in-the-middle (reverse-proxy) or cloned credential-harvest login page", "Hidden form field 'dfpartifact' detected — likely browser fingerprint exfiltration"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (compliance.it-communications.workers.dev)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 55, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Unusually long URL"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 2, "total risk": 0, "valid count": 2, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 24, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 0, "issues": ["Microsoft login-page config schema ($Config: urlGetCredentialType, iMaxStackForKnockoutAsyncComponents, sFTName, urlMsaSignUp) served on 'compliance.it-communications.workers.dev', not a legitimate Microsoft domain — adversary-in-the-middle (reverse-proxy) or cloned credential-harvest login page", "Hidden form field 'dfpartifact' detected — likely browser fingerprint exfiltration"], "details": {"idp config": {"host": "compliance.it-communications.workers.dev", "brand": "Microsoft", "markers": ["urlGetCredentialType", "iMaxStackForKnockoutAsyncComponents", "sFTName", "urlMsaSignUp"]}, "matched brand": "Microsoft 365", "signals detected": ["idp config impersonation", "title domain mismatch", "fingerprint exfil"], "is legitimate domain": false}, "warnings": ["Page title matches Microsoft 365 login pattern but domain 'compliance.it-communications.workers.dev' is not a legitimate Microsoft 365 domain"]}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 10, "rdap data": null, "has login forms": true, "is hosting subdomain": true}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (compliance.it-communications.workers.dev)", "Microsoft login-page config schema ($Config: urlGetCredentialType, iMaxStackForKnockoutAsyncComponents, sFTName, urlMsaSignUp) served on 'compliance.it-communications.workers.dev', not a legitimate Microsoft domain — adversary-in-the-middle (reverse-proxy) or cloned credential-harvest login page", "Hidden form field 'dfpartifact' detected — likely browser fingerprint exfiltration"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": ["Page title matches Microsoft 365 login pattern but domain 'compliance.it-communications.workers.dev' is not a legitimate Microsoft 365 domain"]}}2026-08-02View scan →
gh6i7th5g4c38s82a70aeeb2b0e7u4d.vercel.appweb-app settingsPage text{"verdict": "Low Risk", "confidence": 73, "risk level": "low", "risk factors": ["Brand Impersonation (Microsoft)"], "overall score": 27, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (gh6i7th5g4c38s82a70aeeb2b0e7u4d.vercel.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 8, "total risk": 0, "valid count": 8, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 10, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (gh6i7th5g4c38s82a70aeeb2b0e7u4d.vercel.app)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-01View scan →
bs-deliver-e817.61d8f0e6ac62c139abd08ba5.workers.devMicrosoft SharePoint Online - VerifiedPage text{"verdict": "High Risk", "confidence": 60, "risk level": "high", "risk factors": ["Brand Impersonation (Microsoft)", "Threat-intel IoC on scanned domain (malicious host): bs-deliver-e817.61d8f0e6ac62c139abd08ba5.workers.dev"], "overall score": 60, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (bs-deliver-e817.61d8f0e6ac62c139abd08ba5.workers.dev)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "ioc matches": {"primary": [{"indicator": "bs-deliver-e817.61d8f0e6ac62c139abd08ba5.workers.dev", "threat type": "malicious host"}], "infra ip": [], "score floor": 60}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 1, "total risk": 0, "valid count": 1, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 1, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 10, "rdap data": null, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["Matched 1 threat-intel indicator(s) on site infrastructure: bs-deliver-e817.61d8f0e6ac62c139abd08ba5.workers.dev", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (bs-deliver-e817.61d8f0e6ac62c139abd08ba5.workers.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-08-01View scan →
www.cytheraonline.comMicrosoft - Cythera Device ManagementPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Brand Impersonation (Microsoft)", "Google Safe Browsing Threats", "Favicon matches Microsoft but domain 'www.cytheraonline.com' is not a legitimate Microsoft domain (credential form present)"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (www.cytheraonline.com)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 4, "total risk": 0, "valid count": 4, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 10, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 65, "issues": ["Favicon matches Microsoft but domain 'www.cytheraonline.com' is not a legitimate Microsoft domain (credential form present)"], "details": {"favicon brand": {"brand": "Microsoft", "source": "curated", "penalty": 35, "embed risk": "high", "corroborated": true}, "matched brand": "Microsoft", "signals detected": ["favicon brand mismatch"], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 25, "rdap data": {"domain": "cytheraonline.com", "age days": 2, "category": "CRITICAL", "registrar": null, "registration date": "2026-07-29T06:07:24+00:00"}, "has login forms": true, "is hosting subdomain": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (www.cytheraonline.com)", "Google Safe Browsing detected phishing", "Favicon matches Microsoft but domain 'www.cytheraonline.com' is not a legitimate Microsoft domain (credential form present)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-08-01View scan →
cytheraonline.comMicrosoft - Cythera Device ManagementPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (cytheraonline.com)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 10, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 25, "rdap data": {"domain": "cytheraonline.com", "age days": 2, "category": "CRITICAL", "registrar": null, "registration date": "2026-07-29T06:07:24+00:00"}, "has login forms": true, "is hosting subdomain": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (cytheraonline.com)", "Google Safe Browsing detected phishing"], "positive": ["HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-08-01View scan →
senati-seguridad--senati-2026.replit.appIniciarPage text{"verdict": "Low Risk", "confidence": 70, "risk level": "low", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 30, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (senati-seguridad--senati-2026.replit.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 35, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected", "Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 6, "total risk": 0, "valid count": 6, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (senati-seguridad--senati-2026.replit.app)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-31View scan →
php-web-server--unittec.replit.appIniciar sesión en tu cuenta MicrosoftPage text{"verdict": "High Risk (Possible Microsoft Phishing on cloud hosting)", "confidence": 80, "risk level": "high", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 60, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (php-web-server--unittec.replit.app)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 9, "total risk": 2, "valid count": 8, "invalid count": 0, "not found count": 1}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 45, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 1, "distinct redirect patterns": 1, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["Microsoft brand impersonation with a credential form on a disposable cloud-hosting/storage subdomain (php-web-server--unittec.replit.app) — consistent with credential phishing.", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (php-web-server--unittec.replit.app)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-31View scan →
trax.ensuritymobile.comEnsurity GPSPage text{"verdict": "Low Risk", "confidence": 73, "risk level": "low", "risk factors": ["Brand Impersonation (Microsoft)"], "overall score": 27, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (trax.ensuritymobile.com)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 3, "total risk": 2, "valid count": 2, "invalid count": 0, "not found count": 1}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 9, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (trax.ensuritymobile.com)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-31View scan →
outlookmailwww.webcindario.comIniciar sesión en tu cuenta MicrosoftPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (outlookmailwww.webcindario.com)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 14, "total risk": 0, "valid count": 14, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 20, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (outlookmailwww.webcindario.com)", "Google Safe Browsing detected phishing"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-07-31View scan →
pub-d68525cbc6144dcaaac2fc0354aa17dd.r2.devDocuSign - Review DocumentPage text{"verdict": "Low Risk", "confidence": 67, "risk level": "low", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 33, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (pub-d68525cbc6144dcaaac2fc0354aa17dd.r2.dev)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 2, "total risk": 0, "valid count": 2, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 2, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 5, "rdap data": {"domain": "r2.dev", "age days": 1437, "category": "ESTABLISHED", "registrar": null, "registration date": "2022-08-23T14:38:38.654000+00:00"}, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (pub-d68525cbc6144dcaaac2fc0354aa17dd.r2.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-30View scan →
jimcooks211.github.ioMicrosoft Personal AccountPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (jimcooks211.github.io)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 2, "total risk": 0, "valid count": 2, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 2, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (jimcooks211.github.io)", "Google Safe Browsing detected phishing"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-07-30View scan →
afj5-qi87-u2kv.saras-burnabynh-ca-s-account.workers.devAdobe Acrobat SignPage text{"verdict": "High Risk (IDS: ET PHISHING Generic Device Code Landing Page 2026-04-07 +1 more)", "confidence": 82, "risk level": "high", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 60, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (afj5-qi87-u2kv.saras-burnabynh-ca-s-account.workers.dev)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "ids alerts": {"total": 2, "category": "Possible Social Engineering Attempted", "detected": true, "severity": "high", "signature name": "ET PHISHING Generic Device Code Landing Page 2026-04-07"}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 4, "total risk": 0, "valid count": 4, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 8, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 10, "rdap data": null, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (afj5-qi87-u2kv.saras-burnabynh-ca-s-account.workers.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-30View scan →
2fe35958.mscfildoc.pages.dev—Page text{"verdict": "Malicious (Microsoft Credential Phishing on cloud hosting)", "confidence": 88, "risk level": "malicious", "risk factors": ["Suspicious URL Patterns", "Disguised Password Fields", "Brand Impersonation (Microsoft)"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary"], "detailed analysis": {"html forms": {"score": 0, "issues": ["Disguised password field detected (type=text with password placeholder)", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (2fe35958.mscfildoc.pages.dev)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 1, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 7, "total risk": 0, "valid count": 7, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 17, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 5, "rdap data": {"domain": "pages.dev", "age days": 2156, "category": "ESTABLISHED", "registrar": "CloudFlare, Inc.", "registration date": "2020-09-02T02:33:29.228000+00:00"}, "has login forms": true, "is hosting subdomain": true}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["Microsoft brand impersonation with a disguised credential field on a disposable cloud-hosting/storage subdomain (2fe35958.mscfildoc.pages.dev) — credential-harvesting phishing pattern.", "Disguised password field detected (type=text with password placeholder)", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (2fe35958.mscfildoc.pages.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-30View scan →
afj5-qi87-u2kv.saras-burnabynh-ca-s-account.workers.devAdobe Acrobat SignPage text{"verdict": "High Risk (IDS: ET PHISHING Generic Device Code Landing Page 2026-04-07 +1 more)", "confidence": 82, "risk level": "high", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 60, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (afj5-qi87-u2kv.saras-burnabynh-ca-s-account.workers.dev)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "ids alerts": {"total": 2, "category": "Possible Social Engineering Attempted", "detected": true, "severity": "high", "signature name": "ET PHISHING Generic Device Code Landing Page 2026-04-07"}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 4, "total risk": 0, "valid count": 4, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 8, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 10, "rdap data": null, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (afj5-qi87-u2kv.saras-burnabynh-ca-s-account.workers.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-30View scan →
pub-de59803496c8489585895b6917266e7c.r2.devFiles | OneDrivePage text{"verdict": "Low Risk", "confidence": 67, "risk level": "low", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Onedrive)"], "overall score": 33, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Onedrive branding on non-official domain (pub-de59803496c8489585895b6917266e7c.r2.dev)"], "password fields": 0, "impersonated brand": "Onedrive", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 11, "total risk": 0, "valid count": 11, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 14, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 5, "rdap data": {"domain": "r2.dev", "age days": 1436, "category": "ESTABLISHED", "registrar": null, "registration date": "2022-08-23T14:38:38.654000+00:00"}, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Onedrive branding on non-official domain (pub-de59803496c8489585895b6917266e7c.r2.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-29View scan →
mynah.pages.devMicrosoft SharePoint | File SharePage text{"verdict": "Low Risk", "confidence": 73, "risk level": "low", "risk factors": ["Brand Impersonation (Microsoft)"], "overall score": 27, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (mynah.pages.dev)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 2, "total risk": 0, "valid count": 2, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (mynah.pages.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-29View scan →
cozijok.pages.dev4J Games Minecraft / All minecraft games can be played in your browser or mobile. - IjozicoPage text{"verdict": "Low Risk", "confidence": 73, "risk level": "low", "risk factors": ["Brand Impersonation (Microsoft)"], "overall score": 27, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (cozijok.pages.dev)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 23, "total risk": 2, "valid count": 22, "invalid count": 0, "not found count": 1}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 36, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (cozijok.pages.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-29View scan →
www.windows-10-forum.comWindows 10 ForumPage text{"verdict": "Low Risk", "confidence": 73, "risk level": "low", "risk factors": ["Brand Impersonation (Microsoft)"], "overall score": 27, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (www.windows-10-forum.com)"], "password fields": 2, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 9, "total risk": 0, "valid count": 9, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 50, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (www.windows-10-forum.com)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-29View scan →
security-server-docs--govmentdded.replit.appSign in to OutlookPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (security-server-docs--govmentdded.replit.app)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 6, "total risk": 0, "valid count": 6, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 8, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (security-server-docs--govmentdded.replit.app)", "Google Safe Browsing detected phishing"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-07-29View scan →
secure-page-editor--createforlife.replit.appEnter your passwordLogo / favicon{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)", "Google Safe Browsing Threats", "Favicon matches Microsoft but domain 'secure-page-editor--createforlife.replit.app' is not a legitimate Microsoft domain (credential form present)"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (secure-page-editor--createforlife.replit.app)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 6, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 65, "issues": ["Favicon matches Microsoft but domain 'secure-page-editor--createforlife.replit.app' is not a legitimate Microsoft domain (credential form present)"], "details": {"favicon brand": {"brand": "Microsoft", "source": "curated", "penalty": 35, "embed risk": "high", "corroborated": true}, "matched brand": "Microsoft", "signals detected": ["favicon brand mismatch"], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (secure-page-editor--createforlife.replit.app)", "Google Safe Browsing detected phishing", "Favicon matches Microsoft but domain 'secure-page-editor--createforlife.replit.app' is not a legitimate Microsoft domain (credential form present)"], "positive": ["HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-07-29View scan →
secure-page-editor--createforlife.replit.appEnter your passwordPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)", "Google Safe Browsing Threats", "Favicon matches Microsoft but domain 'secure-page-editor--createforlife.replit.app' is not a legitimate Microsoft domain (credential form present)"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (secure-page-editor--createforlife.replit.app)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 6, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 65, "issues": ["Favicon matches Microsoft but domain 'secure-page-editor--createforlife.replit.app' is not a legitimate Microsoft domain (credential form present)"], "details": {"favicon brand": {"brand": "Microsoft", "source": "curated", "penalty": 35, "embed risk": "high", "corroborated": true}, "matched brand": "Microsoft", "signals detected": ["favicon brand mismatch"], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (secure-page-editor--createforlife.replit.app)", "Google Safe Browsing detected phishing", "Favicon matches Microsoft but domain 'secure-page-editor--createforlife.replit.app' is not a legitimate Microsoft domain (credential form present)"], "positive": ["HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-07-29View scan →
itwosite.se-mtwo.cloudLogin: PMImp@ctPage text{"verdict": "Low Risk", "confidence": 73, "risk level": "low", "risk factors": ["Brand Impersonation (Microsoft)"], "overall score": 27, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (itwosite.se-mtwo.cloud)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 2, "total risk": 0, "valid count": 2, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 9, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 2, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (itwosite.se-mtwo.cloud)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-27View scan →
login-murex-sigma.vercel.appSign in to your Microsoft accountPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Mixed Content", "Protocol Downgrade", "Brand Impersonation (Microsoft)", "Google Safe Browsing Threats", "Page title explicitly mentions Microsoft 365 but domain 'login-murex-sigma.vercel.app' is not a legitimate Microsoft 365 domain"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🔐 Website serves insecure content - data may be intercepted", "⬇️ Connection was downgraded from HTTPS to HTTP", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (login-murex-sigma.vercel.app)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 8, "total risk": 0, "valid count": 8, "invalid count": 0, "not found count": 0}, "network security": {"score": 25, "issues": ["Mixed content detected (HTTP resources on HTTPS page)", "2 insecure HTTP requests detected"], "mixed content": true, "secure requests": 16, "security headers": {"detected": true}, "insecure requests": 2, "certificate issues": []}, "phishing signals": {"score": 60, "issues": ["Page title explicitly mentions Microsoft 365 but domain 'login-murex-sigma.vercel.app' is not a legitimate Microsoft 365 domain"], "details": {"matched brand": "Microsoft 365", "signals detected": ["title domain mismatch"], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 25, "issues": ["HTTPS to HTTP protocol downgrade detected"], "total redirects": 5, "blob url detected": false, "protocol downgrades": 1, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 10, "rdap data": null, "has login forms": true, "is hosting subdomain": true}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["Mixed content detected (HTTP resources on HTTPS page)", "2 insecure HTTP requests detected", "HTTPS to HTTP protocol downgrade detected", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (login-murex-sigma.vercel.app)", "Google Safe Browsing detected phishing", "Page title explicitly mentions Microsoft 365 but domain 'login-murex-sigma.vercel.app' is not a legitimate Microsoft 365 domain"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "No visual similarity to known brand sites"], "warnings": []}}2026-07-27View scan →
qualitybh.art.brShare Point OnlinePage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Brand Impersonation (Onedrive)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Onedrive branding on non-official domain (qualitybh.art.br)"], "password fields": 1, "impersonated brand": "Onedrive", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 9, "total risk": 0, "valid count": 9, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 21, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Onedrive branding on non-official domain (qualitybh.art.br)", "Google Safe Browsing detected phishing"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-07-26View scan →
php-web-server--mexicoeducation.replit.appIniciar sesión en tu cuenta MicrosoftPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (php-web-server--mexicoeducation.replit.app)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 9, "total risk": 2, "valid count": 8, "invalid count": 0, "not found count": 1}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 45, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 1, "distinct redirect patterns": 1, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 10, "rdap data": null, "has login forms": true, "is hosting subdomain": true}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (php-web-server--mexicoeducation.replit.app)", "Google Safe Browsing detected phishing"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-07-26View scan →
secure-static-page--andrewkhan89.replit.appSecurity verification - Microsoft accountPage text{"verdict": "Low Risk", "confidence": 71, "risk level": "low", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 29, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (secure-static-page--andrewkhan89.replit.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 6, "total risk": 0, "valid count": 6, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 7, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 45, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 1, "distinct redirect patterns": 1, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (secure-static-page--andrewkhan89.replit.app)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-26View scan →
gh6i7th5g4c38s82a70aeeb2b0e7u4d.vercel.appweb-app settingsPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Mixed Content", "Protocol Downgrade", "Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🔐 Website serves insecure content - data may be intercepted", "⬇️ Connection was downgraded from HTTPS to HTTP", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (gh6i7th5g4c38s82a70aeeb2b0e7u4d.vercel.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "network security": {"score": 25, "issues": ["Mixed content detected (HTTP resources on HTTPS page)", "2 insecure HTTP requests detected"], "mixed content": true, "secure requests": 10, "security headers": {"detected": true}, "insecure requests": 2, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 25, "issues": ["HTTPS to HTTP protocol downgrade detected"], "total redirects": 3, "blob url detected": false, "protocol downgrades": 1, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["Mixed content detected (HTTP resources on HTTPS page)", "2 insecure HTTP requests detected", "HTTPS to HTTP protocol downgrade detected", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (gh6i7th5g4c38s82a70aeeb2b0e7u4d.vercel.app)", "Google Safe Browsing detected phishing"], "positive": ["HTTPS encryption used", "No visual similarity to known brand sites"], "warnings": []}}2026-07-26View scan →
inicioinusual365.webcindario.comIniciar sesión en tu cuenta MicrosoftPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (inicioinusual365.webcindario.com)"], "password fields": 2, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 49, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (inicioinusual365.webcindario.com)", "Google Safe Browsing detected phishing"], "positive": ["HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-07-25View scan →
gh6i7th5g4c38s82a70aeeb2b0e7u4d.vercel.appweb-app settingsPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (gh6i7th5g4c38s82a70aeeb2b0e7u4d.vercel.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 9, "total risk": 0, "valid count": 9, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 10, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (gh6i7th5g4c38s82a70aeeb2b0e7u4d.vercel.app)", "Google Safe Browsing detected phishing"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-07-25View scan →
seg-gob--secretariadee.replit.appIniciarPage text{"verdict": "Low Risk", "confidence": 72, "risk level": "low", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 28, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (seg-gob--secretariadee.replit.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 5, "total risk": 0, "valid count": 5, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (seg-gob--secretariadee.replit.app)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-24View scan →
htyd.vercel.appSign in to your accountLogo / favicon{"verdict": "High Risk (Possible Microsoft 365 Phishing)", "confidence": 80, "risk level": "high", "risk factors": ["Mixed Content", "Suspicious URL Patterns", "Brand Impersonation (Microsoft)", "References flagged external domain(s): 149.154.166.110", "Favicon matches Microsoft but domain 'htyd.vercel.app' is not a legitimate Microsoft domain (credential form present)"], "overall score": 60, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🔐 Website serves insecure content - data may be intercepted"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (htyd.vercel.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "ioc matches": {"external": [{"indicator": "149.154.166.110", "threat type": "known attacker"}]}, "url analysis": {"score": 55, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Unusually long URL"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 6, "total risk": 0, "valid count": 6, "invalid count": 0, "not found count": 0}, "network security": {"score": 30, "issues": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected"], "mixed content": true, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 1, "certificate issues": []}, "phishing signals": {"score": 40, "issues": ["Favicon matches Microsoft but domain 'htyd.vercel.app' is not a legitimate Microsoft domain (credential form present)"], "details": {"favicon brand": {"brand": "Microsoft", "source": "curated", "penalty": 35, "embed risk": "high", "corroborated": true}, "matched brand": "Microsoft 365", "signals detected": ["favicon brand mismatch", "title domain mismatch"], "is legitimate domain": false}, "warnings": ["Page title matches Microsoft 365 login pattern but domain 'htyd.vercel.app' is not a legitimate Microsoft 365 domain"]}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (htyd.vercel.app)", "Favicon matches Microsoft but domain 'htyd.vercel.app' is not a legitimate Microsoft domain (credential form present)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": ["Page title matches Microsoft 365 login pattern but domain 'htyd.vercel.app' is not a legitimate Microsoft 365 domain"]}}2026-07-24View scan →
htyd.vercel.appSign in to your accountPage text{"verdict": "High Risk (Possible Microsoft 365 Phishing)", "confidence": 80, "risk level": "high", "risk factors": ["Mixed Content", "Suspicious URL Patterns", "Brand Impersonation (Microsoft)", "References flagged external domain(s): 149.154.166.110", "Favicon matches Microsoft but domain 'htyd.vercel.app' is not a legitimate Microsoft domain (credential form present)"], "overall score": 60, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🔐 Website serves insecure content - data may be intercepted"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (htyd.vercel.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "ioc matches": {"external": [{"indicator": "149.154.166.110", "threat type": "known attacker"}]}, "url analysis": {"score": 55, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Unusually long URL"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 6, "total risk": 0, "valid count": 6, "invalid count": 0, "not found count": 0}, "network security": {"score": 30, "issues": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected"], "mixed content": true, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 1, "certificate issues": []}, "phishing signals": {"score": 40, "issues": ["Favicon matches Microsoft but domain 'htyd.vercel.app' is not a legitimate Microsoft domain (credential form present)"], "details": {"favicon brand": {"brand": "Microsoft", "source": "curated", "penalty": 35, "embed risk": "high", "corroborated": true}, "matched brand": "Microsoft 365", "signals detected": ["favicon brand mismatch", "title domain mismatch"], "is legitimate domain": false}, "warnings": ["Page title matches Microsoft 365 login pattern but domain 'htyd.vercel.app' is not a legitimate Microsoft 365 domain"]}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["Mixed content detected (HTTP resources on HTTPS page)", "1 insecure HTTP requests detected", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (htyd.vercel.app)", "Favicon matches Microsoft but domain 'htyd.vercel.app' is not a legitimate Microsoft domain (credential form present)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": ["Page title matches Microsoft 365 login pattern but domain 'htyd.vercel.app' is not a legitimate Microsoft 365 domain"]}}2026-07-24View scan →
htyd.vercel.appSign in to your accountLogo / favicon{"verdict": "High Risk (Possible Microsoft 365 Phishing)", "confidence": 80, "risk level": "high", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)", "References flagged external domain(s): 149.154.166.110", "Favicon matches Microsoft but domain 'htyd.vercel.app' is not a legitimate Microsoft domain (credential form present)"], "overall score": 60, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (htyd.vercel.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "ioc matches": {"external": [{"indicator": "149.154.166.110", "threat type": "known attacker"}]}, "url analysis": {"score": 55, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Unusually long URL"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 6, "total risk": 0, "valid count": 6, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 40, "issues": ["Favicon matches Microsoft but domain 'htyd.vercel.app' is not a legitimate Microsoft domain (credential form present)"], "details": {"favicon brand": {"brand": "Microsoft", "source": "curated", "penalty": 35, "embed risk": "high", "corroborated": true}, "matched brand": "Microsoft 365", "signals detected": ["favicon brand mismatch", "title domain mismatch"], "is legitimate domain": false}, "warnings": ["Page title matches Microsoft 365 login pattern but domain 'htyd.vercel.app' is not a legitimate Microsoft 365 domain"]}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (htyd.vercel.app)", "Favicon matches Microsoft but domain 'htyd.vercel.app' is not a legitimate Microsoft domain (credential form present)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": ["Page title matches Microsoft 365 login pattern but domain 'htyd.vercel.app' is not a legitimate Microsoft 365 domain"]}}2026-07-24View scan →
htyd.vercel.appSign in to your accountPage text{"verdict": "High Risk (Possible Microsoft 365 Phishing)", "confidence": 80, "risk level": "high", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)", "References flagged external domain(s): 149.154.166.110", "Favicon matches Microsoft but domain 'htyd.vercel.app' is not a legitimate Microsoft domain (credential form present)"], "overall score": 60, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (htyd.vercel.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "ioc matches": {"external": [{"indicator": "149.154.166.110", "threat type": "known attacker"}]}, "url analysis": {"score": 55, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Unusually long URL"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 6, "total risk": 0, "valid count": 6, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 40, "issues": ["Favicon matches Microsoft but domain 'htyd.vercel.app' is not a legitimate Microsoft domain (credential form present)"], "details": {"favicon brand": {"brand": "Microsoft", "source": "curated", "penalty": 35, "embed risk": "high", "corroborated": true}, "matched brand": "Microsoft 365", "signals detected": ["favicon brand mismatch", "title domain mismatch"], "is legitimate domain": false}, "warnings": ["Page title matches Microsoft 365 login pattern but domain 'htyd.vercel.app' is not a legitimate Microsoft 365 domain"]}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (htyd.vercel.app)", "Favicon matches Microsoft but domain 'htyd.vercel.app' is not a legitimate Microsoft domain (credential form present)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": ["Page title matches Microsoft 365 login pattern but domain 'htyd.vercel.app' is not a legitimate Microsoft 365 domain"]}}2026-07-24View scan →
geoip-prod-b-app.azurewebsites.netMicrosoft Azure App Service - WelcomeLogo / favicon{"verdict": "Low Risk", "confidence": 70, "risk level": "low", "risk factors": ["Suspicious URL Patterns", "Favicon matches Microsoft but domain 'geoip-prod-b-app.azurewebsites.net' is not a legitimate Microsoft domain"], "overall score": 30, "recommendations": [], "detailed analysis": {"html forms": {"score": 50, "issues": ["ℹ️ Microsoft Attack Simulation Training — benign phishing-awareness platform (Microsoft-owned, served under the Microsoft attack-sim TLS cert)"], "password fields": 0, "impersonated brand": null, "brand mismatch detected": false, "impersonated brand slug": null, "disguised password fields": 0, "brand impersonation detected": false, "is microsoft attack simulation": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 2, "total risk": 0, "valid count": 2, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 8, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 65, "issues": ["Favicon matches Microsoft but domain 'geoip-prod-b-app.azurewebsites.net' is not a legitimate Microsoft domain"], "details": {"favicon brand": {"brand": "Microsoft", "source": "curated", "penalty": 35, "embed risk": "high", "corroborated": true}, "matched brand": "Microsoft", "signals detected": ["favicon brand mismatch"], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["ℹ️ Microsoft Attack Simulation Training — benign phishing-awareness platform (Microsoft-owned, served under the Microsoft attack-sim TLS cert)", "Favicon matches Microsoft but domain 'geoip-prod-b-app.azurewebsites.net' is not a legitimate Microsoft domain"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-24View scan →
nq19-o7h8-xixb.natalie-mstpartners-com-s-account.workers.devAdobe Acrobat SignPage text{"verdict": "High Risk (IDS: ET PHISHING Generic Device Code Landing Page 2026-04-07 +1 more)", "confidence": 82, "risk level": "high", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 60, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (nq19-o7h8-xixb.natalie-mstpartners-com-s-account.workers.dev)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "ids alerts": {"total": 2, "category": "Possible Social Engineering Attempted", "detected": true, "severity": "high", "signature name": "ET PHISHING Generic Device Code Landing Page 2026-04-07"}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 4, "total risk": 0, "valid count": 4, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 8, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 10, "rdap data": null, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (nq19-o7h8-xixb.natalie-mstpartners-com-s-account.workers.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-24View scan →
nq19-o7h8-xixb.natalie-mstpartners-com-s-account.workers.devAdobe Acrobat SignPage text{"verdict": "High Risk (IDS: ET PHISHING Generic Device Code Landing Page 2026-04-07 +1 more)", "confidence": 82, "risk level": "high", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 60, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (nq19-o7h8-xixb.natalie-mstpartners-com-s-account.workers.dev)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "ids alerts": {"total": 2, "category": "Possible Social Engineering Attempted", "detected": true, "severity": "high", "signature name": "ET PHISHING Generic Device Code Landing Page 2026-04-07"}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 4, "total risk": 0, "valid count": 4, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 12, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 10, "rdap data": null, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (nq19-o7h8-xixb.natalie-mstpartners-com-s-account.workers.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-24View scan →
status.gosocket.netGosocket StatusPage text{"verdict": "Low Risk", "confidence": 73, "risk level": "low", "risk factors": ["Brand Impersonation (Microsoft)"], "overall score": 27, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (status.gosocket.net)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 13, "total risk": 0, "valid count": 13, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 24, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (status.gosocket.net)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-23View scan →
xwsjl-jjhs-t5dl.p-436szmjv.workers.devMicrosoft User shared a document with youPage text{"verdict": "Medium Risk", "confidence": 52, "risk level": "medium", "risk factors": ["Mixed Content", "Protocol Downgrade", "Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 52, "recommendations": ["⚡ Exercise caution when visiting this website", "🛡️ Ensure your browser and antivirus are up to date", "🔐 Website serves insecure content - data may be intercepted", "⬇️ Connection was downgraded from HTTPS to HTTP", "📋 Website lacks important security headers"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (xwsjl-jjhs-t5dl.p-436szmjv.workers.dev)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 15, "issues": ["No HTTPS encryption"], "positive signals": [], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 2, "total risk": 0, "valid count": 2, "invalid count": 0, "not found count": 0}, "network security": {"score": 20, "issues": ["Mixed content detected (HTTP resources on HTTPS page)", "3 insecure HTTP requests detected"], "mixed content": true, "secure requests": 1, "security headers": {"detected": true}, "insecure requests": 3, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 25, "issues": ["HTTPS to HTTP protocol downgrade detected"], "total redirects": 2, "blob url detected": false, "protocol downgrades": 1, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 0, "distinct redirect patterns": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 10, "rdap data": null, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["No HTTPS encryption", "Mixed content detected (HTTP resources on HTTPS page)", "3 insecure HTTP requests detected", "HTTPS to HTTP protocol downgrade detected", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (xwsjl-jjhs-t5dl.p-436szmjv.workers.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-23View scan →
secure-page-builder--joanpressy.replit.appSecurity verification - Microsoft accountPage text{"verdict": "Low Risk", "confidence": 71, "risk level": "low", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 29, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (secure-page-builder--joanpressy.replit.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 6, "total risk": 0, "valid count": 6, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 7, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 45, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 1, "distinct redirect patterns": 1, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (secure-page-builder--joanpressy.replit.app)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-23View scan →
verificacion-029--tucuenta0102.replit.appIniciarPage text{"verdict": "Medium Risk", "confidence": 35, "risk level": "medium", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 35, "recommendations": ["⚡ Exercise caution when visiting this website", "🛡️ Ensure your browser and antivirus are up to date"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (verificacion-029--tucuenta0102.replit.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 35, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected", "Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 5, "total risk": 0, "valid count": 5, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 5, "rdap data": {"domain": "replit.app", "age days": 1923, "category": "ESTABLISHED", "registrar": "Nom-IQ Limited dba Com Laude", "registration date": "2021-04-16T20:44:58.737000+00:00"}, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (verificacion-029--tucuenta0102.replit.app)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-23View scan →
jimcooks211.github.ioMicrosoft Personal AccountPage text{"verdict": "High Risk (Possible Microsoft Phishing on cloud hosting)", "confidence": 80, "risk level": "high", "risk factors": ["Brand Impersonation (Microsoft)"], "overall score": 60, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (jimcooks211.github.io)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 2, "total risk": 0, "valid count": 2, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 2, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["Microsoft brand impersonation with a credential form on a disposable cloud-hosting/storage subdomain (jimcooks211.github.io) — consistent with credential phishing.", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (jimcooks211.github.io)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-23View scan →
vault-web-v2o3.p-6tukr95y.workers.devShared documentPage text{"verdict": "Medium Risk", "confidence": 38, "risk level": "medium", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 38, "recommendations": ["⚡ Exercise caution when visiting this website", "🛡️ Ensure your browser and antivirus are up to date"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (vault-web-v2o3.p-6tukr95y.workers.dev)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 2, "total risk": 0, "valid count": 2, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 2, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 10, "rdap data": null, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (vault-web-v2o3.p-6tukr95y.workers.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-23View scan →
sharepointonedriveaaqkada0yja1yji5l.jamejampaintingservice.com.auMicrosoft 365 - Protected Content AccessPage text{"verdict": "Low Risk", "confidence": 73, "risk level": "low", "risk factors": ["Brand Impersonation (Microsoft)"], "overall score": 27, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (sharepointonedriveaaqkada0yja1yji5l.jamejampaintingservice.com.au)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 4, "total risk": 0, "valid count": 4, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 5, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 45, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 1, "distinct redirect patterns": 1, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (sharepointonedriveaaqkada0yja1yji5l.jamejampaintingservice.com.au)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-23View scan →
pub-de59803496c8489585895b6917266e7c.r2.devFiles | OneDrivePage text{"verdict": "Low Risk", "confidence": 67, "risk level": "low", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Onedrive)"], "overall score": 33, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Onedrive branding on non-official domain (pub-de59803496c8489585895b6917266e7c.r2.dev)"], "password fields": 0, "impersonated brand": "Onedrive", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 10, "total risk": 0, "valid count": 10, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 14, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 5, "rdap data": {"domain": "r2.dev", "age days": 1429, "category": "ESTABLISHED", "registrar": "CloudFlare, Inc.", "registration date": "2022-08-23T14:38:38.654000+00:00"}, "has login forms": true, "is hosting subdomain": true}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Onedrive branding on non-official domain (pub-de59803496c8489585895b6917266e7c.r2.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-22View scan →
mynah.pages.devMicrosoft SharePoint | File SharePage text{"verdict": "Low Risk", "confidence": 73, "risk level": "low", "risk factors": ["Brand Impersonation (Microsoft)"], "overall score": 27, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (mynah.pages.dev)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 2, "total risk": 0, "valid count": 2, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (mynah.pages.dev)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-22View scan →
secure-static-page--clarewemyss.replit.appSign in to your accountPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (secure-static-page--clarewemyss.replit.app)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 6, "total risk": 0, "valid count": 6, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 9, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 75, "issues": [], "details": {"matched brand": "Microsoft 365", "signals detected": ["title domain mismatch"], "is legitimate domain": false}, "warnings": ["Page title matches Microsoft 365 login pattern but domain 'secure-static-page--clarewemyss.replit.app' is not a legitimate Microsoft 365 domain"]}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (secure-static-page--clarewemyss.replit.app)", "Google Safe Browsing detected phishing"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": ["Page title matches Microsoft 365 login pattern but domain 'secure-static-page--clarewemyss.replit.app' is not a legitimate Microsoft 365 domain"]}}2026-07-22View scan →
sanghagarageservices.caContact & Free Quote | Sangha Garage Services — Greater Toronto AreaPage text{"verdict": "Medium Risk", "confidence": 52, "risk level": "medium", "risk factors": ["Brand Impersonation (Outlook.Com)"], "overall score": 52, "recommendations": ["⚡ Exercise caution when visiting this website", "🛡️ Ensure your browser and antivirus are up to date"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Outlook.Com branding on non-official domain (sanghagarageservices.ca)"], "password fields": 0, "impersonated brand": "Outlook.Com", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 65, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": []}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 5, "total risk": 0, "valid count": 5, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}, "domain age scoring": {"penalty": 25, "rdap data": {"domain": "sanghagarageservices.ca", "age days": 1, "category": "CRITICAL", "registrar": null, "registration date": "2026-07-20T14:42:26+00:00"}, "has login forms": true, "is hosting subdomain": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Outlook.Com branding on non-official domain (sanghagarageservices.ca)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-22View scan →
php-web-server--unitech2factor.replit.appIniciar sesión en tu cuenta MicrosoftPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (php-web-server--unitech2factor.replit.app)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 45, "issues": [], "total redirects": 1, "blob url detected": false, "protocol downgrades": 0, "same site redirects": 0, "suspicious patterns": 0, "cross domain redirects": 1, "distinct redirect patterns": 1, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (php-web-server--unitech2factor.replit.app)", "Google Safe Browsing detected phishing"], "positive": ["HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-07-22View scan →
php-web-server--zurdacovas.replit.appIniciarPage text{"verdict": "Low Risk", "confidence": 72, "risk level": "low", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 28, "recommendations": [], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (php-web-server--zurdacovas.replit.app)"], "password fields": 0, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 5, "total risk": 0, "valid count": 5, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 11, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": [], "security indicators": {"negative": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (php-web-server--zurdacovas.replit.app)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-22View scan →
php-web-server--zurdacovas.replit.appIniciarPage text{"verdict": "High Risk (Possible Microsoft Phishing on cloud hosting)", "confidence": 80, "risk level": "high", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)"], "overall score": 60, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (php-web-server--zurdacovas.replit.app)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 100, "issues": [], "threats": [], "positive signals": ["No Google Safe Browsing threats detected"]}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 6, "total risk": 0, "valid count": 6, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 14, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["Microsoft brand impersonation with a credential form on a disposable cloud-hosting/storage subdomain (php-web-server--zurdacovas.replit.app) — consistent with credential phishing.", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (php-web-server--zurdacovas.replit.app)"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No Google Safe Browsing threats detected", "No visual similarity to known brand sites"], "warnings": []}}2026-07-22View scan →
secure-index-edit--mlcrawford.replit.appSign in to OutlookPage text{"verdict": "Malicious", "confidence": 95, "risk level": "malicious", "risk factors": ["Suspicious URL Patterns", "Brand Impersonation (Microsoft)", "Threat-intel IoC on scanned domain (phishing): secure-index-edit--mlcrawford.replit.app", "Google Safe Browsing Threats"], "overall score": 80, "recommendations": ["⚠️ Avoid visiting this website - high security risk detected", "🔒 Use additional security measures if access is necessary", "🚫 Google Safe Browsing detected security threats - avoid interaction", "🛡️ Enable browser security warnings and avoid downloading files"], "detailed analysis": {"html forms": {"score": 10, "issues": ["⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (secure-index-edit--mlcrawford.replit.app)"], "password fields": 1, "impersonated brand": "Microsoft", "brand mismatch detected": true, "impersonated brand slug": "microsoft", "disguised password fields": 0, "brand impersonation detected": true}, "ioc matches": {"primary": [{"indicator": "secure-index-edit--mlcrawford.replit.app", "threat type": "phishing"}], "infra ip": [], "score floor": 60}, "url analysis": {"score": 50, "issues": [], "positive signals": ["HTTPS encryption used"], "suspicious patterns": ["Suspicious domain pattern detected"]}, "safe browsing": {"score": 0, "issues": ["Google Safe Browsing detected phishing"], "threats": {"SOCIAL ENGINEERING": 1}, "threat summary": ["1 phishing/social engineering threat(s) detected"], "positive signals": []}, "clone detection": {"score": 100, "issues": [], "warnings": [], "positive signals": ["No visual similarity to known brand sites"]}, "rpki validation": {"total": 5, "total risk": 0, "valid count": 5, "invalid count": 0, "not found count": 0}, "network security": {"score": 65, "issues": [], "mixed content": false, "secure requests": 8, "security headers": {"detected": true}, "insecure requests": 0, "certificate issues": []}, "phishing signals": {"score": 100, "issues": [], "details": {"matched brand": null, "signals detected": [], "is legitimate domain": false}, "warnings": []}, "technology risks": {"score": 50, "issues": [], "security technologies": [], "vulnerable technologies": []}, "redirect analysis": {"score": 50, "issues": [], "total redirects": 0, "blob url detected": false, "protocol downgrades": 0, "suspicious patterns": 0, "cross domain redirects": 0, "compromised wordpress detected": false}}, "threat categories": ["Credential Phishing"], "security indicators": {"negative": ["Matched 1 threat-intel indicator(s) on site infrastructure: secure-index-edit--mlcrawford.replit.app", "⚠️ CRITICAL: Brand impersonation detected - Microsoft branding on non-official domain (secure-index-edit--mlcrawford.replit.app)", "Google Safe Browsing detected phishing"], "positive": ["Server IPs have valid RPKI ROA coverage", "HTTPS encryption used", "Good network security practices", "No visual similarity to known brand sites"], "warnings": []}}2026-07-22View scan →
← All monitored brands