Security Scan Report: paymentsecurelink.vercel.app

Site favicon
Submitted: Completed: publiccompleted
This website contacted 17 IPs in 2 countries across 10 domains to perform 15 HTTP transactions. The main domain is vercel.app and was registered 6 years ago.

Submitted URL: https://paymentsecurelink.vercel.app/

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

Confirmed Microsoft credential-phishing page on vercel.app: fake Microsoft sign-in with its favicon, a password-only field, and credentials POSTed to pq.npljlip.net. Flagged by Safe Browsing.

Risk Factors (5)
Impersonation of Microsoft's sign-in interface and favicon on a domain Microsoft does not own
Password-only credential field matching Microsoft's password-reentry phishing step
Credentials submitted via cross-origin POST to pq.npljlip.net (unrelated to the hosting domain)
Page hosted on a free vercel.app subdomain of unknown creation date
Google Safe Browsing Social Engineering detection
Domain age information unavailable

Details

Page Title

Microsoft | Login

Scan Type

public

Domain Name Analysis

The domain 'paymentsecurelink.vercel.app' uses the application-focused generic top-level domain (.app) and includes subdomain 'paymentsecurelink'. The core label 'vercel' covers 6 characters with two vowels and 4 consonants. Splitting it apart reveals two words: ver, cel. Average segment length settles at three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://paymentsecurelink.vercel.app/

Page Load Overview

0.99s
Total Load Time
245 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:329 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software30% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

technology software
30%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
15216.198.79.67Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
064.29.17.67Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
0192.178.183.95Google · CDNUnited States
AS15169Google LLC
0104.18.40.68Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
013.107.246.45Azure · CLOUDUnited States
AS8075Microsoft Corporation
0142.251.14.95Google · CDNUnited States
AS15169Google LLC
0151.101.65.155Fastly · CDNUnited States
AS54113Fastly, Inc.
0104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0104.18.11.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0146.75.120.193Fastly · CDNFrankfurt am Main, Hesse, Germany
AS54113Fastly, Inc.
1517--

Detected Technologies11

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1F634541FE4F212991C43947817EA6BA57379C003CA19FEBA7D8E6354CF4E6C48D62B48

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:ffB0VjSXf28PNJuzkXWHE9uc6BcgGk9Byf/MuSj+Yrj0YMM2pNuULmDfraz/0:2SXefuSj+Yrj0YMXLmDTaz/0

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:242713:EQAVDQAI0iaFBGiUMLcRHk05AkCvCEGYiARIUIlIQ5GCGDBIK4IgZzwoICATQCsAZTAEh8jBYypAAhqQEKBOCgiAJEFqyJyA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffcfe7e7eff7fffe
Perceptual Hash:e623d99946666699
Difference Hash:00180c0d10000000
Wavelet Hash:24242424e4fcf3f2
Color Hash:#40bf60

Other Hashes

Crop Resistant:00180c0d10000000

Scan History

Scan history not available

Unable to load historical scan data