Security Scan Report: qorlixva-mek572918463.vercel.app

Site favicon
Submitted: Completed: publiccompleted
This website contacted 25 IPs in 1 country across 12 domains to perform 34 HTTP transactions. The main domain is vercel.app and was registered 6 years ago.

Submitted URL: https://qorlixva-mek572918463.vercel.app/index1.html

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Fake 'Meta Verified' badge page on an unrelated vercel.app subdomain harvesting Facebook email/password logins, with a Telegram bot token in its script for exfiltrating stolen credentials.

Risk Factors (6)
Brand impersonation of Meta/Facebook on a non-Meta domain with a credential form (defining phishing shape)
Credential collection: email/phone + password login fields presented as 'Meta Verified' activation
Telegram bot token embedded in page script enabling exfiltration of submitted data
Random, brand-unrelated subdomain on a free hosting platform with unknown creation date
Unranked domain (not in Cisco Umbrella top 1M) while claiming a major social-media brand
External IP-geolocation lookups and IDS alerts for actor-abused cloud hosting
Domain age information unavailable

Details

Page Title

Blaues Häkchen verifiziert

Scan Type

public

Domain Name Analysis

You're looking at domain 'qorlixva-mek572918463.vercel.app' on the application-focused generic top-level domain (.app), featuring subdomain 'qorlixva-mek572918463'. Count 6 characters in 'vercel' holding 2 vowels versus 4 consonants. It segments into 2 words: ver, cel. Expect three characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://qorlixva-mek572918463.vercel.app/index1.html

Page Load Overview

10.99s
Total Load Time
1.9 MB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:de
Text Length:3,068 chars
Detector Agreement:100%

Website Classification

Primary Category

social media network87% confidence
Type: webapp
Method: ml+structural+ocr_tiebreaker

All Detected Categories

social media network
87%

Detected Features

Login Form
Search
OG: article

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
10216.198.79.67Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
1216.198.79.131Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
1151.101.65.155Fastly · CDNUnited States
AS54113Fastly, Inc.
1104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.251.110.138Google · CDNUnited States
AS15169Google LLC
1142.251.154.120Google · CDNUnited States
AS15169Google LLC
1142.251.20.95Google · CDNUnited States
AS15169Google LLC
134.117.59.81Google · CDNKansas City, Missouri, United States
AS396982Google LLC
1172.67.70.233Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.251.13.94Google · CDNUnited States
AS15169Google LLC
3425--

Detected Technologies9

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1DDF25F11A9A5DC2A80CF59D866B3612525B99307C2124A8CFE7DABF10FAFC7CC777148

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:rnMQ4HFIIACADGkJZUCQYRFgG1y33Mu80lO9aUT7FDy:rKFIZfJN9RFLlmO957FDy

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:37434:kYIilyEAQBQkYUETgQBRxgQAAhRSAQJpBAVAFUkRDkwCpAdIFZRAB6elkmhPk53HEFRaQuIALKQBBS5DAKBojMICJwIAEoQJ

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ff9f9f3f0d0f0f0f
Perceptual Hash:9bccf101c2e7b06b
Difference Hash:2d29296b79585bdc
Wavelet Hash:3f1d1f1f090f0707
Color Hash:#1f5393

Scan History

Scan history not available

Unable to load historical scan data