Security Scan Report: o2-billing-recovery.web.app

Site favicon
Submitted: Completed: publiccompleted
This website contacted 4 IPs in 1 country across 6 domains to perform 24 HTTP transactions. The main domain is web.app and was registered 7 years ago.

Submitted URL: https://o2-billing-recovery.web.app/

AI Security Verdict

High Risk

Confidence: 82%

8
Risk Score

Page claims the O2 telecom brand on an unofficial web.app subdomain, contacts an unrelated API host and hides behind a CAPTCHA gate. Classic brand-impersonation setup; do not enter any details.

Risk Factors (5)
Brand impersonation of O2 on a non-official domain
Free shared-hosting subdomain (web.app) of unknown creation date
Low/no domain reputation while using a major brand name
Contact with suspicious third-party endpoint c0dersapi.pro
Content gated behind a CAPTCHA with almost no visible page text, consistent with cloaking
Domain age information unavailable

Details

Page Title

o2

Scan Type

public

Domain Name Analysis

You're looking at domain 'o2-billing-recovery.web.app' on the application-focused generic top-level domain (.app), featuring subdomain 'o2-billing-recovery'. The registrable portion 'web' spans 3 characters with one vowel and 2 consonants. Tokenizing the label suggests one word: web. No strong language cues emerged from the frequency lists.

Screenshot

Le] I'm not a robot 2 reCAPTCHA SeGABTOHA is changing its tes of service ‘Take ston

Page Load Overview

0.73s
Total Load Time
1.6 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:2 chars
Detector Agreement:0%

Website Classification

Primary Category

government public service70% confidence
Type: dynamic
Method: ml+structural+ocr_tiebreaker

All Detected Categories

government public service
70%
adult content
65%
documentation technical
44%
technology software
30%
healthcare medical
26%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
6199.36.158.100Fastly · CDNUnited States
AS54113Fastly, Inc.
6104.26.9.44Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6142.251.20.94Google · CDNUnited States
AS15169Google LLC
6142.251.14.94Google · CDNUnited States
AS15169Google LLC
244--

Detected Technologies6

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T13335CFBBAE476FCABF71140755DE12C30D0EDB03A16622B5B70D90AA590EA746BF940C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

12288:/iOqX+YIU/xZXLby4i6rrx0jk/UFsPHngdbbOqX+YIU/x4jc4i6rrx0jk/UFsPHx:/+OFU/Pvy5EofOFU/Ojc5Eow

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:1067000:KLiWBIBDFjoAODACPBzg2hCBAFIUI+gYSUgE5UBChKySgMQkLyNgJAwiBy4IgCgNzU+RYAVJOFBQHCsgh0h0ACJsTDgpQDUx

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffffe7e7ffffff
Perceptual Hash:b38ccc3333cccc33
Difference Hash:0000100c0c100000
Wavelet Hash:33332727070f0f0f
Color Hash:N/A

Other Hashes

Crop Resistant:0000100c0c100000

Scan History

Scan history not available

Unable to load historical scan data