Security Scan Report: bretil.netlify.app

Redirected to:
https://bretil.netlify.app/page
Site favicon
Submitted: Completed: publiccompleted
This website contacted 2 IPs in 1 country across 1 domain to perform 9 HTTP transactions. The main domain is netlify.app and was registered 8 years ago.

Submitted URL: https://bretil.netlify.app/

Effective URL:
https://bretil.netlify.app/page
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

Bell Canada-branded credential phishing on a free netlify.app subdomain: login form captures email/password and a Telegram bot token in the page script can ship them to an attacker chat.

Risk Factors (5)
Brand impersonation of Bell Canada on a non-official domain
Credential harvesting login form (email + password) on a shared hosting subdomain
Embedded Telegram bot token in page JavaScript enabling exfiltration of submitted data
Deceptive bill-review pretext with fabricated support number
Unranked, unknown-age subdomain on a free hosting platform
Domain age information unavailable

Details

Page Title

Bell Business Site

Scan Type

public

Domain Name Analysis

Within the application-focused generic top-level domain (.app), 'bretil.netlify.app' is registered; it also runs on subdomain 'bretil'. The core label 'netlify' covers 7 characters split between 2 vowels and 5 consonants. Tokenizing the label suggests 3 words: net, li, fy. Median word length is 2 characters. No strong language cues emerged from the frequency lists.

Screenshot

Bu Review Your Monthly Bill & oe

Page Load Overview

0.23s
Total Load Time
265 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:272 chars
Detector Agreement:50%

Website Classification

Primary Category

unknown0% confidence
Type: webapp
Method: structural

All Detected Categories

No categories detected

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
535.157.26.135Aws · CLOUDFrankfurt am Main, Hesse, Germany
AS16509Amazon.com, Inc.
463.176.8.218Aws · CLOUDFrankfurt am Main, Hesse, Germany
AS16509Amazon.com, Inc.
92--

Detected Technologies2

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T13962A622623246B7602FF86E36F273D974A78747EB029BC07EED83D40F85C5A2553608

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:ZscDRFS1TLrgLENyWu4fRDk8WeHEjHkv8LdFWqz1DW52VurfIn1zEezXxefRH:ZFW3Dk8WuEjHkv8BFWqg24W4eFefRH

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:15785:ykSaGRMEskwABWqgMBYjQAeD40aRxMGjgRBUAhAIG0ABMYEQdggIRNYopATADFVQhQDJlAHpIpwMJCMGCGgJQAi0QCIchgAG

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00f9f0f0f8f8b868
Perceptual Hash:caac0b3c333d7705
Difference Hash:53e1c589a02051c9
Wavelet Hash:00f9f8f0f8f8b868
Color Hash:N/A

Scan History

Scan history not available

Unable to load historical scan data