brand in the name “tiktok”brand name at a retail registrar “GoDaddy.com, LLC”brand name and brand-styled page “tiktok”form on a brand-styled page “has_form”
Model opinion: looks like a scam, confidence 72%. An opinion, not a finding.
brand in the name “tiktok”brand name at a retail registrar “Hosting Concepts B.V. d/b/a Registrar.eu”brand name and brand-styled page “tiktok”form on a brand-styled page “has_form”
Model opinion: suspicious, confidence 58%. An opinion, not a finding.
one-letter brand typo “docsign≈docusign”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+1 more
Model opinion: looks like abuse (target: DocuSign), confidence 85%. An opinion, not a finding.
brand in the name “bestbuy”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”form on a brand-styled page “has_form”
Model opinion: looks like phishing (target: Best Buy), confidence 97%. An opinion, not a finding.
brand in the name “adobe”lure words (login, verify, secure…) “update”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+3 more
brand in the name “fedex”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”brand name and brand-styled page “fedex”
Model opinion: looks like phishing (target: FedEx), confidence 93%. An opinion, not a finding.
brand in the name “adobe”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
page impersonates a brand “Netflix”brand in page title, not in the name “apple”
page impersonates a brand “Netflix”brand in page title, not in the name “apple”
page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”
brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”
brand in page title, not in the name “amazon”form on a brand-styled page “has_form”
lure words (login, verify, secure…) “win”page asks for credentials “Log in to your account”
one-letter brand typo “whatsapi≈whatsapp”brand name at a retail registrar “GoDaddy.com, LLC”
nameserver domain born the same day “backnorosi-gygy.com”form submits over plain HTTP “http://royalen-games.live/login.php”
lure words (login, verify, secure…) “verify”brand in page title, not in the name “telegram”
page impersonates a brand “Binance”
brand in page title, not in the name “whatsapp”
brand in page title, not in the name “telegram”
brand in page title, not in the name “chase”
brand in page title, not in the name “wordpress”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “namecheap”
brand in page title, not in the name “namecheap”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “robinhood”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “robinhood”
brand in page title, not in the name “wordpress”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “telegram”
login form “has_form+login words”
random-looking name “H=3.73”free DNS provider “dnsowl.com”
lure words (login, verify, secure…) “reward,rewards”
lure words (login, verify, secure…) “recover,recovery”
lure words (login, verify, secure…) “recover,support”
lure words (login, verify, secure…) “service,support”
lure words (login, verify, secure…) “alert,alerts”
many hyphens “3”random-looking name “H=4.25”