Security Scan Report: www.roundcubenewupdateserviceverificati.vercel.app

Redirected to:
https://roundcubenewupdateserviceverificati.vercel.app/
Site favicon
Submitted: Completed: publiccompleted
This website contacted 4 IPs in 2 countries across 3 domains to perform 19 HTTP transactions. The main domain is vercel.app and was registered 6 years ago.

Submitted URL: http://www.roundcubenewupdateserviceverificati.vercel.app/

Effective URL:
https://roundcubenewupdateserviceverificati.vercel.app/
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 95%

10
Risk Score

Phishing page impersonating Roundcube Webmail on a vercel.app subdomain; a username/password form feeds inline JavaScript carrying a Telegram bot token, exfiltrating captured credentials to the attacker. Do not enter credentials.

Risk Factors (6)
Deceptive hostname impersonating the Roundcube webmail login on a free shared-hosting subdomain
Credential-harvesting login form (username + password) presented as a webmail sign-in
Telegram bot token embedded in page JavaScript for off-site credential exfiltration
External beaconing to api.telegram.org and api.ipify.org
Unranked domain with unknown age; subdomain creation date cannot be attributed to the platform apex
Page loads JavaScript from unranked third-party host webmail.supremecluster.com
Domain age information unavailable

Details

Page Title

Roundcube Webmail :: Welcome to Roundcube Webmail

Scan Type

public

Domain Name Analysis

Domain 'www.roundcubenewupdateserviceverificati.vercel.app' uses the application-focused generic top-level domain (.app) and includes subdomain 'www.roundcubenewupdateserviceverificati'. The registrable portion 'vercel' spans 6 characters with 2 vowels and 4 consonants. Breaking it apart gives 2 words: ver, cel. Median word length is three characters. No strong language cues emerged from the frequency lists.

Screenshot

Username Password GIN Roundcube Webmail

Page Load Overview

1.56s
Total Load Time
310 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:293 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software45% confidence
Type: webapp
Method: ml+structural

All Detected Categories

technology software
45%
documentation technical
43%
phishing scam
43%
adult content
37%
news media journalism
33%

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1694.136.171.57United Kingdom
AS42831UK Dedicated Servers Limited
464.29.17.67Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
4216.198.79.67Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
1216.198.79.131Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
194--

Detected Technologies6

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T13A32E54769154E372AB301E8BBCFF204A4EAC11BCA20D890F5FD91981F99F9561723DE

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:W24D3YTbCawNDGFoWl7ZGw4o/VtU5e2bCUkSN4S5slSseiJ89c/DgQlU/:Z4D3YTbVw18l7ZGwQEA35s43Qq

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:11661:0WEIEMQGC4iwAAakQ6COVBm7BgIs6ggAxClsDCGVAIRXSNaCAFIWMQUCRBcInBqgcBNU0IDNYLJBUCGICVJQIIEICI9AFSmw

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffe7e7e7ffffffff
Perceptual Hash:b333cccc6c668ccc
Difference Hash:00080c0c00000000
Wavelet Hash:3c242424f0f0f0f0
Color Hash:070000001c0

Other Hashes

Crop Resistant:00080c0c00000000

Scan History

Scan history not available

Unable to load historical scan data