Security Scan Report: auth-secure-portal.vercel.app

Redirected to:
https://block-orcin-alpha.vercel.app/
Submitted: Completed: publiccompleted
This website contacted 10 IPs in 1 country across 6 domains to perform 18 HTTP transactions. The main domain is vercel.app and was registered 6 years ago.

Submitted URL: https://auth-secure-portal.vercel.app/

Effective URL:
https://block-orcin-alpha.vercel.app/
Redirected

AI Security Verdict

High Risk

Confidence: 72%

8
Risk Score

Netflix-branded page on an unrelated, unranked vercel.app subdomain named like an auth portal, with a phishing threat-intel report and dodgy redirect/backend hosting — strong impersonation risk even though no form was captured.

Risk Factors (5)
Display of the Netflix brand on a domain that does not belong to Netflix (impersonation of a different entity)
Deceptive hostname 'auth-secure-portal' on free/shared hosting with no attributable creation date
Single-source phishing threat-intel match on the primary domain
Redirect between mismatched vercel.app subdomains and external railway.app backend
IP-reconnaissance (ipify.org) lookups and abused-cloud-hosting IDS signatures
Domain age information unavailable

Details

Page Title

Netflix

Scan Type

public

Domain Name Analysis

Domain 'auth-secure-portal.vercel.app' uses the application-focused generic top-level domain (.app) and includes subdomain 'auth-secure-portal'. Count 6 characters in 'vercel' split between 2 vowels and 4 consonants. It segments into 2 words: ver, cel. Average segment length settles at three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://auth-secure-portal.vercel.app/

Page Load Overview

2.39s
Total Load Time
426 KB
Total Size

Language Analysis

Primary Language

🇩🇰Danish
Code: da
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:da
Text Length:7 chars
Detector Agreement:0%

Website Classification

Primary Category

unknown0% confidence
Type: static
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
9216.198.79.131Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
169.46.46.18Mukilteo, Washington, United States
AS400940Railway
1104.26.12.205Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.251.154.119Google · CDNUnited States
AS15169Google LLC
164.29.17.131Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
1216.198.79.3Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
1216.198.79.195Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
1142.251.151.119Google · CDNUnited States
AS15169Google LLC
164.29.17.67Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
1142.251.13.94Google · CDNUnited States
AS15169Google LLC
1810--

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T18DF0C9815AB04009633403402DE0F8184C59A746C2829F20BAA2A0A84FE8686CC4F96C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6:h4hqC6YOLBrAMMJAGKNmI9fAbpli7vkMiBJAqIbR2+MvfWHwlT3AV4LKTj+GwlJO:hQn5KHKy7IMqsKW7VWqAEd1

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:512:AAAAAAAAAAACAAEAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAFAAAACAAAAAAAAIAAAAAAAAAAAAAAAAABEACAAAAAAAA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0000000000ffffff
Perceptual Hash:956e95906e95943d
Difference Hash:4040800040e0e0e0
Wavelet Hash:00000000ffffffff
Color Hash:#5340bf

Other Hashes

Crop Resistant:4040800040e0e0e0

Scan History

Scan history not available

Unable to load historical scan data