ScanMalware.com

Security Scan Report: corpmail.vercel.app

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/001e24db-90d3-4772-8dec-b6c859bb48ecDomain and IP registration (RDAP)/api/v1/rdap/001e24db-90d3-4772-8dec-b6c859bb48ecHow often this domain was scanned/api/v1/domain/stats/corpmail.vercel.appScan history for this domain/api/v1/domain/history/corpmail.vercel.app?limit=15
This website contacted 7 IPs in 1 country across 5 domains to perform 10 HTTP transactions. The main domain is vercel.app and was registered 6 years ago.

Submitted URL: https://corpmail.vercel.app/

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

Confirmed phishing: a fake Korean 'account verification' login page on a free vercel.app subdomain whose script sends the entered email and password, plus the victim's IP, to a Telegram bot.

Risk Factors (5)
Credential exfiltration to a third-party messaging bot (Telegram bot token embedded in inline script)
Password collection form on an anonymous free-hosting subdomain
External IP-lookup call used to enrich stolen credentials
Threat-intel phishing report against the primary domain
Network IDS flagged actor-abused cloud hosting service and external IP-lookup traffic
Domain age information unavailable

Details

Page Title

계정 인증

Scan Type

public

Domain Name Analysis

Domain 'corpmail.vercel.app' uses the application-focused generic top-level domain (.app) and includes subdomain 'corpmail'. Count 6 characters in 'vercel' split between two vowels and 4 consonants. Word splitting yields 2 words: ver, cel. Median word length comes out to three characters. No strong language cues emerged from the frequency lists.

Screenshot

AAO] BIAN2 ojo HS | B ojo wseise eyo Ous acta Forgot password?

Page Load Overview

0.66s
Total Load Time
261 KB
Total Size

Language Analysis

Primary Language

🇰🇷Korean
Code: ko
Confidence:60%
Script:Hangul
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:71 chars
Detector Agreement:100%
Language mismatch: Declared as en but detected as ko

Website Classification

Primary Category

phishing scam61% confidence
Type: static
Method: ml+structural

All Detected Categories

phishing scam
61%
finance banking
37%
adult content
32%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
464.29.17.67Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
1216.198.79.67Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
1209.94.90.1United States
AS40680Protocol Labs
1142.251.110.95Google · CDNUnited States
AS15169Google LLC
1142.251.20.94Google · CDNUnited States
AS15169Google LLC
1172.67.74.152Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.26.12.205Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
107--

Detected Technologies2

Vercel
40%
HSTS
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1F882835B24F720516A93E4BC3BAF53053265E0039A09CD287F9C53498F46B99ACB37DD

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:vJ+U3RWl0Kikc+3eVPH1hPRHa4sx8utqqnA65Fk619uY/cQ5uG9Rk4HyfAy+ylJw:vIGaFmIofsiJ6eGCIdrfis3b

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:19151:CwMBlUsYAUZAGGAEocgORTkQIWKwm1CCNoCAQwRyTu2BTqHSQRpiUsxkAQRGFAzQiKEwrAH4gSZEAisWMJOigDDECECQGKpS

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:181c180018000000
Perceptual Hash:9999cc66663331d9
Difference Hash:32b2b24c300c0000
Wavelet Hash:3c3c3820dcccc0c0
Color Hash:070000001c0

Other Hashes

Crop Resistant:32b2b24c300c0000

Scan History

Scan history not available

Unable to load historical scan data