Security Scan Report: smtp-authentication-resolve.netlify.app

Submitted: Oct 8, 2026, 1:26:38 PMCompleted: Oct 8, 2026, 1:27:14 PMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Fake mail-authentication portal on a free netlify subdomain that collects email and password and ships it to a Telegram bot; Google Safe Browsing flags it for social engineering. Do not enter credentials.

Risk Factors (5)
Credential capture form (password field) on a shared hosting-platform subdomain of unknown age
Telegram bot token embedded in page script — a live exfiltration channel for submitted data
Google Safe Browsing Social Engineering threat match
Deceptive hostname ('smtp-authentication-resolve') and 'Mail Authentication' portal framing unrelated to any legitimate provider
Full-screen lockout style messaging with fake attempt counters and date/user-agent spoof text
Domain age information unavailable

Details

Page Title

PORTAL - Mail Authentication

Scan Type

public

Domain Name Analysis

Domain 'smtp-authentication-resolve.netlify.app' uses the application-focused generic top-level domain (.app), featuring subdomain 'smtp-authentication-resolve'. The core label 'netlify' covers 7 characters containing two vowels alongside 5 consonants. Tokenizing the label suggests 3 words: net, li, fy. Expect 2 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://smtp-authentication-resolve.netlify.app/

Page Load Overview

1.27s
Total Load Time
413 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:323 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software66% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

technology software
66%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
835.157.26.135Aws · CLOUDFrankfurt am Main, Hesse, Germany
AS16509Amazon.com, Inc.
1178.237.33.50Barendrecht, South Holland, Netherlands
AS8455atom86 BV
1104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1184.24.77.64Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
113.107.246.44Azure · CLOUDUnited States
AS8075Microsoft Corporation
1151.101.65.155Fastly · CDNUnited States
AS54113Fastly, Inc.
1104.18.10.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.251.20.95Google · CDNUnited States
AS15169Google LLC
1104.18.11.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.18.1.22Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2114--

Detected Technologies11

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1DD0497A9D14C04D16772C41BAF78B3E8A1B9F73AC8550CAAF82E580C4FC9B5525C2F79

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:nOwMCMPMCMjMCM4MCMwMCM3sVMX709gbPMfjSFOTyPGuuprrlCFLVSG/y5lZf95A:S709gMGFiyPGuuprlCFLVSG/yHIgVi5t

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:187195:SCXjEAYQAkU6FNKEsUNADQaMuiMIIhhKBIwAGTQQQQYqyThAMihOyioadAFU0IoFViaUkCgVU5Bi7CEEIACKPAC0C2KGhUKM

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffe7e7ffffffffff
Perceptual Hash:f733998ccccc6423
Difference Hash:00080c0000000000
Wavelet Hash:cec6c0e4f0f0f0f0
Color Hash:#d22d51

Other Hashes

Crop Resistant:00080c0000000000

Scan History

Scan history not available

Unable to load historical scan data