Security Scan Report: auth-secure-portal.vercel.app

Redirected to:
https://block-orcin-alpha.vercel.app/
Submitted: Completed: publiccompleted
This website contacted 9 IPs in 1 country across 6 domains to perform 19 HTTP transactions. The main domain is vercel.app and was registered 6 years ago.

Submitted URL: http://auth-secure-portal.vercel.app/

Effective URL:
https://block-orcin-alpha.vercel.app/
Redirected

AI Security Verdict

High Risk

Confidence: 74%

7
Risk Score

Title claims to be Netflix on a free .vercel.app subdomain reached via a redirect from an 'auth-secure-portal' host, with a Netflix-themed Railway back end. No live credential form, but the Netflix brand is used on a non-Netflix domain — brand impersonation risk.

Risk Factors (5)
Impersonation of the Netflix brand on a non-Netflix domain
Domain not in Cisco Umbrella top 1M (unranked) while claiming a major brand
Subdomain created under a free shared-hosting namespace with unknown creation date
Auth-themed subdomain name ("auth-secure-portal") inconsistent with the deployed content
External Netflix-themed back end on abused cloud hosting (railway.app)
Domain age information unavailable

Details

Page Title

Netflix

Scan Type

public

Domain Name Analysis

Within the application-focused generic top-level domain (.app), 'auth-secure-portal.vercel.app' is registered; it also runs on subdomain 'auth-secure-portal'. The core label 'vercel' covers 6 characters containing two vowels alongside 4 consonants. Segmentation suggests two words: ver, cel. Average segment length settles at 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of http://auth-secure-portal.vercel.app/

Page Load Overview

1.20s
Total Load Time
426 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:92 chars
Detector Agreement:50%

Website Classification

Primary Category

government public service57% confidence
Type: static
Method: ml+structural

All Detected Categories

government public service
57%
healthcare medical
55%
cryptocurrency blockchain
54%
news media journalism
54%
real estate property
52%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
364.29.17.131Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
269.46.46.18Mukilteo, Washington, United States
AS400940Railway
2104.26.12.205Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2216.198.79.195Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
2142.251.151.119Google · CDNUnited States
AS15169Google LLC
2216.198.79.131Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
2142.251.157.119Google · CDNUnited States
AS15169Google LLC
2142.251.14.94Google · CDNUnited States
AS15169Google LLC
264.29.17.195Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
199--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T18DF0C9815AB04009633403402DE0F8184C59A746C2829F20BAA2A0A84FE8686CC4F96C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6:h4hqC6YOLBrAMMJAGKNmI9fAbpli7vkMiBJAqIbR2+MvfWHwlT3AV4LKTj+GwlJO:hQn5KHKy7IMqsKW7VWqAEd1

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:512:AAAAAAAAAAACAAEAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAFAAAACAAAAAAAAIAAAAAAAAAAAAAAAAABEACAAAAAAAA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0000000000ffffff
Perceptual Hash:956e95906e95943d
Difference Hash:4040800040e0e0e0
Wavelet Hash:00000000ffffffff
Color Hash:#d2512d

Other Hashes

Crop Resistant:4040800040e0e0e0

Scan History

Scan history not available

Unable to load historical scan data