Security Scan Report: a1ga5c9aidk28unglku.vercel.app

Redirected to:
https://pswb39bcra-h01a.vercel.app/10025078036/hsg5hwabt3bgfdsht5dfA.h...
Submitted: Completed: publiccompleted
This website contacted 8 IPs in 1 country across 6 domains to perform 22 HTTP transactions. The main domain is vercel.app and was registered 6 years ago.

Submitted URL: https://a1ga5c9aidk28unglku.vercel.app/hfgdkjmd456thwsfedvf

Effective URL:
https://pswb39bcra-h01a.vercel.app/10025078036/hsg5hwabt3bgfdsht5dfA.h...
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 80%

9
Risk Score

Cloaked credential-harvesting page on a random .vercel.app subdomain that serves a fake 'Meta Advertising Standards' page to scanners; hidden password field and forms posting to a second throwaway subdomain.

Risk Factors (6)
Hidden password field not rendered to the user
Cross-origin form submission to an unrelated randomized throwaway subdomain
Cloaking: different content served to scanner vs real clients, with a fake 'Meta Advertising Standards' page shown to bots
Randomized domain names and file paths on shared free hosting (.vercel.app), no domain reputation
External IP-lookup endpoints (ipapi.co, ipwho.is) contacted by page scripts
IDS phishing/mirrored-website and actor-abused-hosting alerts
Domain age information unavailable

Details

Page Title

Home

Scan Type

public

Domain Name Analysis

Within the application-focused generic top-level domain (.app), 'a1ga5c9aidk28unglku.vercel.app' is registered; it also runs on subdomain 'a1ga5c9aidk28unglku'. Count 6 characters in 'vercel' holding two vowels versus four consonants. Segmentation suggests 2 words: ver, cel. Median word length comes out to three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://a1ga5c9aidk28unglku.vercel.app/hfgdkjmd456thwsfedvf

Page Load Overview

0.99s
Total Load Time
633 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:12 chars
Detector Agreement:0%

Website Classification

Primary Category

unknown0% confidence
Type: static
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
8216.198.79.195Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
2216.198.79.131Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
264.29.17.195Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
2104.17.207.5Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2172.67.69.226Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2104.21.31.228Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2104.20.44.133Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2172.67.180.104Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
228--

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T150C17E73ADDC01525DC2CAD4D4C93718B29FC52B0AA5DE37B116161CA72B7E3FC66288

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

48:TBI+aislWFmqr/1p6FSuMm9VJysNF6O5W05sIHop+42:TBxolWFzRkOmV6eW05Ac42

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:5614:AAoL9EYAYgReU0AAwBYZARAgEABQCggBBAAAAUCBiBAEgBCopoxiiYVQJhYCAhGIABMYCgAAAAGUFuCJkMoILKSAhJElMACk

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0000000000000000
Perceptual Hash:a222888822228888
Difference Hash:0000000808000000
Wavelet Hash:3f3f3f27243c3030
Color Hash:#ac539c

Other Hashes

Crop Resistant:0000000808000000

Scan History

Scan history not available

Unable to load historical scan data