Security Scan Report: expressil-a749b.web.app

Submitted: Completed: publiccompleted
This website contacted 2 IPs in 1 country across 2 domains to perform 6 HTTP transactions. The main domain is web.app and was registered 7 years ago.

Submitted URL: https://expressil-a749b.web.app/

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Analyst-vetted phishing kit: a throwaway Firebase Hosting stub that instantly redirects into a Codeanywhere container running 'parcel on hold' postal/customs phishing. Do not follow the redirect.

Risk Factors (4)
Known malicious phishing kit identified by analyst-vetted roster (firebase-codeanywhere-redirect-2026-11)
Instant-redirect stub designed to move victims off the entry host into a disposable Codeanywhere container
Postal/customs 'parcel on hold' social-engineering lure in the redirect target name
Throwaway Firebase Hosting subdomain with no independent reputation
Domain age information unavailable

Details

Page Title

parcel-onholdn223-waitingiss-ipmanta932206.codeanyapp.comother network

Scan Type

public

Domain Name Analysis

Domain 'expressil-a749b.web.app' uses the application-focused generic top-level domain (.app) and includes subdomain 'expressil-a749b'. Count 3 characters in 'web' with one vowel and two consonants. Segmentation suggests 1 word: web. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://expressil-a749b.web.app/

Page Load Overview

N/A
Total Load Time
1 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:867 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software73% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
73%
documentation technical
46%
adult content
33%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
3199.36.158.100Fastly · CDNUnited States
AS54113Fastly, Inc.
3198.199.109.95San Francisco, California, United States
AS14061DigitalOcean, LLC
02--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T126048F773296063986558498E45B830D9F20B543F506C8BCB9BCBAD8BFDED06107BB78

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:x/Qho9PKBbl8Vrq9Jzbs6tlg1ySBKw4Q9gcoIsPy2bMy8OldM:ShoCl8Bqzzbs6okSCggcps62eAK

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:188334:R8BAFExggjBIEVAEJISSQpAgFmrCCBCMm5BQdwBBwPkQqI0QALBybjFCCJAUAqGUYMMUGBAcwoyiiSwYCgBAkAqgCEoIJ5Fg

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffcfc3c3d3ffffff
Perceptual Hash:b1319eccccb33364
Difference Hash:00181c1c16000000
Wavelet Hash:f0d0c0c4c0fcfcfc
Color Hash:#3a2dd2

Other Hashes

Crop Resistant:00181c1c16000000

Scan History

Scan history not available

Unable to load historical scan data