Security Scan Report: emzy-li-dpb7940xq7sj.edgeone.dev

Submitted: Completed: publiccompleted
This website contacted 9 IPs in 2 countries across 7 domains to perform 11 HTTP transactions. The main domain is edgeone.dev and was registered 1 year 5 months ago.

Submitted URL: https://emzy-li-dpb7940xq7sj.edgeone.dev/

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Fake 'example.com Mail Authentication' portal on an edgeone.dev subdomain that harvests email passwords and ships them to a Telegram bot while fingerprinting the visitor's IP — credential phishing.

Risk Factors (5)
Credential-harvesting login form (email + password) on a domain that is not the claimed provider's
Brand impersonation of 'example.com' mail authentication on an unrelated hosting subdomain
Telegram bot token embedded in inline JavaScript — a live exfiltration channel for submitted data
Cross-origin calls to IP-geolocation services used for victim fingerprinting
Deceptive 'secure settings / Secure Portal' framing with a fake 'Authentication error, please try again' retry lure
Domain age information unavailable

Details

Page Title

PORTAL - example.com Mail Authentication

Scan Type

public

Domain Name Analysis

Domain 'emzy-li-dpb7940xq7sj.edgeone.dev' uses the developer-focused generic top-level domain (.dev) and includes subdomain 'emzy-li-dpb7940xq7sj'. Count 7 characters in 'edgeone' with 4 vowels and 3 consonants. Splitting it apart reveals 2 words: edge, one. The median word length lands at 3.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

HAART) + TORRE o SRE URS + TS Fa Pines BAY Lusage de ce domaine est réservé 4 des exemples de documentation, sans autorisation préalable. Il ne s'agit pas d'un service ; son utilisation 4 des fins d...

Page Load Overview

1.30s
Total Load Time
461 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:404 chars
Detector Agreement:81%

Website Classification

Primary Category

technology software73% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
73%
government public service
32%
documentation technical
29%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
3104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
143.174.247.29Singapore
1104.26.8.44Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1100.48.33.35Aws · CLOUDAshburn, Virginia, United States
AS14618Amazon.com, Inc.
1142.251.150.119Google · CDNUnited States
AS15169Google LLC
1142.251.20.105Google · CDNUnited States
AS15169Google LLC
1104.26.9.44Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.251.20.99Google · CDNUnited States
AS15169Google LLC
1104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
119--

Detected Technologies1

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T17DA2D65649F30415B523E1783FFB830C3A7180079606CD68B95C5394DFC8DA26ABBBE9

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:5BIBfVKD0d2X4sGMflldD+3P2bsBQf2OP:52BfVOnosfN/WmsBK

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:22164:UTMFDJJZbCGGpQdAYBSEAgxhQi9GkpGgIAiYUAKoBMKCggTAFIAEakYBUWhQou3oEhgWSwaJYINAChhkM8gDCEIJgkIoKIVI

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0018181818181800
Perceptual Hash:c998367673cc3299
Difference Hash:4cb2b2b2b2b2b24c
Wavelet Hash:1b1b1b1b1b1b1b03
Color Hash:070000001c0

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data