Security Scan Report: nkbihfbeogaeaoehlefnkodbefgpgknn-reset.vercel.app

Redirected to:
https://nkbihfbeogaeaoehlefnkodbefgpgknn-reset.vercel.app/
Submitted: Completed: publiccompleted
This website contacted 2 IPs in 1 country across 1 domain to perform 3 HTTP transactions. The main domain is vercel.app and was registered 6 years ago.

Submitted URL: http://nkbihfbeogaeaoehlefnkodbefgpgknn-reset.vercel.app/

Effective URL:
https://nkbihfbeogaeaoehlefnkodbefgpgknn-reset.vercel.app/
Redirected

AI Security Verdict

Moderate Risk

Confidence: 62%

5
Risk Score

Dead 404 page on a vercel.app subdomain whose name copies MetaMask's extension ID plus 'reset' — phishing naming with nothing deployed. No forms or scripts present; can go live anytime, so treat as hostile.

Risk Factors (3)
Deceptive hostname built from MetaMask's extension ID with a 'reset' suffix, indicating wallet-credential phishing intent
Shared platform subdomain with unknown creation date and no reputation
Dead/dormant deployment: content could be republished at any time under this already-suspicious name
Safety Factors (4)
No forms at all: 0 password fields, 0 disguised password fields, 0 payment fields, 0 total forms
No JavaScript malware (hunting rule) matches, no known malicious kit, no obfuscated or exfiltrating scripts
No Indicators of Compromise matches against the page or its resources
No cross-origin requests, no third-party script hosts, no credential exfiltration detected
Domain age information unavailable

Details

Page Title

404: NOT_FOUND

Scan Type

public

Domain Name Analysis

You're looking at domain 'nkbihfbeogaeaoehlefnkodbefgpgknn-reset.vercel.app' on the application-focused generic top-level domain (.app); it also runs on subdomain 'nkbihfbeogaeaoehlefnkodbefgpgknn-reset'. Its registrable label 'vercel' stretches across 6 characters with two vowels and 4 consonants. Breaking it apart gives two words: ver, cel. The median word length lands at 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

This page doesn’t exist It may have been moved, removed, or never existed. 404 DEPLOYMENT_NOT_FOUND arn: :mh91w-1794362627863-6cbaec6Tb534 VIEW DOCUMENTATION / COPY DEBUG PROMPT

Page Load Overview

0.19s
Total Load Time
20 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:198 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical58% confidence
Type: static
Method: ml+structural

All Detected Categories

documentation technical
58%
news media journalism
30%
technology software
29%
government public service
29%
healthcare medical
28%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
2216.198.79.3Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
164.29.17.3Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
32--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T103D2CF7371952A3DF223CC22089BE01C347DD05BED066B8B9A19D6F0DADB5D1263BD82

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:HE+rfPXBcAFmvgTd/4+LLLTx/7nNmzD41tNaocIm:HEgfPLLftn8QtaD

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:30643:YmKGDcDigB6OLptSTgfIrGAzASWIYYBRQiZBICVgDIRBBNTETIvGoBAKjoABVhIDghMJ2jYCrEWEBAABTAE9RFk2RdQOkHvQ

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffffe7e7ffffe7
Perceptual Hash:b389cccc3333cccc
Difference Hash:0000000c0c00000c
Wavelet Hash:c0c0d0c0e4fcfce4
Color Hash:07000000000

Other Hashes

Crop Resistant:0000000c0c00000c

Scan History

Scan history not available

Unable to load historical scan data