Security Scan: EE

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/2cf23cde-e168-405c-8dfb-b61f0d57072a Domain and IP registration (RDAP)/api/v1/rdap/2cf23cde-e168-405c-8dfb-b61f0d57072aHow often this domain was scanned/api/v1/domain/stats/ee-pending-payment.web.app Scan history for this domain/api/v1/domain/history/ee-pending-payment.web.app?limit=15

This website contacted 66 IPs in 3 countries across 52 domains to perform 302 HTTP transactions. The main domain is web.app and was registered 7 years ago.

Submitted URL: https://ee-pending-payment.web.app/

Effective URL:

https://ee.co.uk/

Redirected

AI Security Verdict

Confirmed Scam

Confidence: 93%

Risk Score

Free-hosting page named 'ee-pending-payment' matched the analyst-vetted UK mobile account-recovery phishing kit by both kit roster and a critical YARA rule; treat as an EE phishing lure despite cloaked, formless capture.

Risk Factors (5)

Known phishing kit identified on the page by two independent detections (kit roster + native YARA)

Impersonation of EE (UK mobile carrier) from a free-hosting subdomain, with the capture redirecting off-domain to ee.co.uk as an apparent exit/cloak

Cloaked content: different page served to the datacenter scanner than to the residential client

Phishing-style hostname lure ('pending-payment') matching the kit's documented naming pattern

Unknown subdomain age on a namespace anyone can publish to; no domain reputation

Domain age information unavailable

Details

Page Title

Scan Type

public

Favicon Hash

MMH3: -1275292909

MD5: d305fe9e943bf60cafac9e56c34b844c

Domain Name Analysis

Within the application-focused generic top-level domain (.app), 'ee-pending-payment.web.app' is registered, featuring subdomain 'ee-pending-payment'. Its registrable label 'web' stretches across 3 characters with one vowel and 2 consonants. Splitting it apart reveals 1 word: web. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

2.58s

Total Load Time

10.3 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:13 chars

Detector Agreement:0%

Website Classification

Primary Category

unknown0% confidence

Type: dynamic

Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
42	199.36.158.100Fastly · CDN	United States	AS54113Fastly, Inc.
4	45.60.65.23Incapsula · WAF	United States	AS19551Incapsula Inc
4	142.251.14.94Google · CDN	United States	AS15169Google LLC
4	45.60.72.23Incapsula · WAF	United States	AS19551Incapsula Inc
4	23.52.181.12Akamai · CDN	Frankfurt am Main, Hesse, Germany	AS16625Akamai Technologies, Inc.
4	104.18.0.97Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	104.18.32.137Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	172.64.155.119Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	142.251.20.97Google · CDN	United States	AS15169Google LLC
4	34.107.184.205Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
302	66	-	-