Security Scan Report: protonvpn.vercel.app

Submitted: Completed: publiccompleted
This website contacted 9 IPs in 2 countries across 5 domains to perform 54 HTTP transactions. The main domain is vercel.app and was registered 6 years ago.

Submitted URL: https://protonvpn.vercel.app/

AI Security Verdict

High Risk

Confidence: 88%

8
Risk Score

Proton VPN-branded lookalike hosted on a vercel.app subdomain, flagged as phishing by two independent threat feeds; no credential form on this capture, but do not sign in or download anything from it.

Risk Factors (4)
Brand impersonation of Proton VPN on an unrelated hosting-platform subdomain
Multi-source phishing threat-intel match against the primary domain
Instant/free vercel.app subdomain with unknown creation date and no domain reputation
External IP-echo lookup script (api.ipify.org)
Domain age information unavailable

Details

Page Title

Proton VPN: Secure, fast VPN service in 110+ countries

Scan Type

public

Domain Name Analysis

The domain name 'protonvpn.vercel.app' uses the application-focused generic top-level domain (.app) and includes subdomain 'protonvpn'. The second-level label 'vercel' is 6 characters long holding two vowels versus four consonants. Segmentation suggests 2 words: ver, cel. Expect three characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://protonvpn.vercel.app/

Page Load Overview

0.53s
Total Load Time
763 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:57%
Script:Latin
Direction:ltr

Detection Details

Text Length:10,213 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software86% confidence
Type: spa
Method: ml+structural

All Detected Categories

technology software
86%
government public service
77%
documentation technical
76%
corporate business
74%
blog personal website
74%

Detected Features

OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
664.29.17.3Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
6104.16.79.6Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6146.75.122.208Fastly · CDNFrankfurt am Main, Hesse, Germany
AS54113Fastly, Inc.
6104.26.12.205Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6162.159.135.232Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6216.198.79.3Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
6104.16.78.6Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6172.67.74.152Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6162.159.136.232Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
549--

Detected Technologies5

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1A834B33149F0557F418381E97A72EA69FF9AA213E866C182B22C87901FD6CE7CD5335C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:kQorDP23616Vz4+zYpKytOLH9C85GFm8tm6atA41HdOmQPr5f9WLhOioT7dsGsCt:Erm1CJPr5fzLt

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:249083:ABoEDBRmclpbCIMNYmU6FQI1KXQhR50piIGVAkCBEEFTAAQaAwcQCARMkAQaLAADAAAUJGAOBQmkBBAJbOQ0shKGIYCK9CoG

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:fbe7e7e787e7e5e7
Perceptual Hash:e699cc339c439966
Difference Hash:1b8e4d8e2e0f4f2d
Wavelet Hash:89c3e7c78381c1e7
Color Hash:#40acbf

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data