Security Scan Report: security-server--faifranhondyout.replit.app

Site favicon
Submitted: Completed: publiccompleted
This website contacted 6 IPs in 2 countries across 5 domains to perform 6 HTTP transactions. The main domain is replit.app and was registered 5 years ago.

Submitted URL: https://security-server--faifranhondyout.replit.app/

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

Adobe-branded credential phishing on a replit.app subdomain: a fake 'email verification' login whose email/password are exfiltrated to api.web3forms.com and a Telegram bot. Confirmed by network IDS phishing signatures.

Risk Factors (5)
Impersonation of Adobe's brand on a domain Adobe does not own
Credential harvesting form (email + password) disguised as document verification
Confirmed credential exfiltration to an external endpoint and to Telegram via bot token
Free shared-hosting subdomain with unknown creation date and no domain ranking
Phishing-specific network IDS signatures fired twice at HIGH severity
Domain age information unavailable

Details

Page Title

ADOBE PDF

Scan Type

public

Domain Name Analysis

The domain name 'security-server--faifranhondyout.replit.app' uses the application-focused generic top-level domain (.app); it also runs on subdomain 'security-server--faifranhondyout'. The core label 'replit' covers 6 characters containing two vowels alongside four consonants. It segments into two words: rep, lit. Median word length is 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://security-server--faifranhondyout.replit.app/

Page Load Overview

0.69s
Total Load Time
851 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:165 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical80% confidence
Type: webapp
Method: ml+structural+ocr_tiebreaker

All Detected Categories

documentation technical
80%
adult content
65%
healthcare medical
62%
cryptocurrency blockchain
62%
government public service
62%

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
134.117.33.233Google · CDNKansas City, Missouri, United States
AS396982Google LLC
12.16.168.51Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
135.190.3.23Google · CDNKansas City, Missouri, United States
AS396982Google LLC
1188.114.96.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
134.120.149.37Google · CDNKansas City, Missouri, United States
AS396982Google LLC
12.16.168.52Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
66--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1F0F1925756B308111A53E0B97BEBB1003122D00B2E09ECAA7BDD839C4F4EF2496B37D9

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:BrFA63OgspimCq689uJoTVgD3Am+aQbU5luAALsu:BrOCOHpZGQgoRgHYbOXAwu

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:7539:hAgRhgYW3S0pSQC6mqKgExlyCEpKKgAAQAIgAR0EwpJOENYHCSBqBwhA7AiCmaMAJIIgEBACIQURAo0LJjoLUzYU1DXQSSYy

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffb9f7a3e1f0f1f0
Perceptual Hash:ec92d8ab67b0918b
Difference Hash:2735674743233306
Wavelet Hash:ff91f183a1e0d0f0
Color Hash:#1f5393

Other Hashes

Crop Resistant:2735674743233306

Scan History

Scan history not available

Unable to load historical scan data