Security Scan: Gencat Office Portal

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/8ba3af4c-9fe4-4743-8329-5c8a9e4e8d80 Domain and IP registration (RDAP)/api/v1/rdap/8ba3af4c-9fe4-4743-8329-5c8a9e4e8d80How often this domain was scanned/api/v1/domain/stats/icsgencat-office-portal.vercel.app Scan history for this domain/api/v1/domain/history/icsgencat-office-portal.vercel.app?limit=15

This website contacted 5 IPs in 3 countries across 3 domains to perform 5 HTTP transactions. The main domain is vercel.app and was registered 6 years ago.

Submitted URL: https://icsgencat-office-portal.vercel.app/

AI Security Verdict

Confirmed Scam

Confidence: 93%

Risk Score

Fake Generalitat de Catalunya / Gencat login on a vercel.app subdomain that harvests email and password and exfiltrates them cross-origin to submit-form.com. Confirmed credential phishing.

Risk Factors (5)

Brand impersonation of Generalitat de Catalunya (Gencat) on an unrelated vercel.app subdomain

Harvests credentials and posts them cross-origin to a third-party form endpoint

Domain unranked in Cisco Umbrella with unknown actual creation date (shared hosting tenant)

IDS HIGH severity alert for form exfiltration

Hidden password field not visible in the rendered page

Domain age information unavailable

Details

Page Title

Gencat Office Portal

Scan Type

public

Domain Name Analysis

The domain 'icsgencat-office-portal.vercel.app' uses the application-focused generic top-level domain (.app), featuring subdomain 'icsgencat-office-portal'. The core label 'vercel' covers 6 characters holding two vowels versus four consonants. Segmentation suggests two words: ver, cel. Median word length comes out to three characters. No strong language cues emerged from the frequency lists.

Screenshot

Generalitat de Catalunya Correu electronic Contrasenya Azure Multi-Factor Authentication (©2028 Micrasait

Page Load Overview

8.20s

Total Load Time

45 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:364 chars

Detector Agreement:100%

Website Classification

Primary Category

malicious40% confidence

Type: webapp

Method: ml+structural+ocr_tiebreaker

All Detected Categories

malicious

40%

suspicious phishing

39%

other

25%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
1	64.29.17.195Aws · CLOUD	United States	AS16509Amazon.com, Inc.
1	195.77.128.93	Madrid, Madrid, Spain	AS210158Agencia Para La Adminitracion Digital De La Comunidad De Madrid
1	23.50.131.133Akamai · CDN	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
1	64.29.17.3Aws · CLOUD	United States	AS16509Amazon.com, Inc.
1	23.50.131.141Akamai · CDN	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
5	5	-	-