Security Report: security-server-landing-page--009wq.replit.app - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/51d22473-d0df-4330-a16c-2249dcfa46d2 Domain and IP registration (RDAP)/api/v1/rdap/51d22473-d0df-4330-a16c-2249dcfa46d2How often this domain was scanned/api/v1/domain/stats/security-server-landing-page--009wq.replit.app Scan history for this domain/api/v1/domain/history/security-server-landing-page--009wq.replit.app?limit=15

This website contacted 13 IPs in 2 countries across 11 domains to perform 16 HTTP transactions. The main domain is replit.app and was registered 5 years ago.

Submitted URL: https://security-server-landing-page--009wq.replit.app/

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Microsoft-branded credential phishing kit on a replit.app subdomain: password-only sign-in form plus a Telegram bot exfiltration channel. Do not enter credentials.

Risk Factors (6)

Brand impersonation of Microsoft on an unrelated shared-hosting subdomain

Credential capture form (password field) with no legitimate relationship to the impersonated brand

Password field without a username field — suspicious credential harvesting pattern

Telegram bot token embedded in inline JavaScript — messaging-bot exfiltration channel

Social-engineering 'sensitive file' verification pretext

Noindex not set, free-instant-subdomain hosting, unranked domain

Domain age information unavailable

Details

Page Title

Microsoft | Login

Scan Type

public

Favicon Hash

MMH3: 1847123250

MD5: be877650fd09d4c73cf80321cd07fe80

Domain Name Analysis

The domain name 'security-server-landing-page--009wq.replit.app' uses the application-focused generic top-level domain (.app) and includes subdomain 'security-server-landing-page--009wq'. The core label 'replit' covers 6 characters holding two vowels versus 4 consonants. Breaking it apart gives two words: rep, lit. Median word length comes out to three characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

1.00s

Total Load Time

793 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:437 chars

Detector Agreement:100%

Website Classification

Primary Category

documentation technical47% confidence

Type: dynamic

Method: ml+structural+ocr_tiebreaker

All Detected Categories

documentation technical

47%

technology software

45%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
4	34.117.33.233Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
1	142.251.110.95Google · CDN	United States	AS15169Google LLC
1	151.101.193.155Fastly · CDN	United States	AS54113Fastly, Inc.
1	142.251.20.95Google · CDN	United States	AS15169Google LLC
1	172.67.142.245Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	13.107.246.44Azure · CLOUD	United States	AS8075Microsoft Corporation
1	104.17.24.14Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	104.18.11.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	35.190.3.23Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
1	195.80.159.133	France	AS29152Decknet SARL
16	13	-	-