brand spelled with digits “lotus44→usaa”brand plus digits “lotus44”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more
Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.
one-letter brand typo “finance≈binance”brand name on a rarely-seen nameserver “mitelis.cc”brand name at a retail registrar “Hosting Concepts B.V. d/b/a Registrar.eu”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 68%. An opinion, not a finding.
one-letter brand typo “kraiken≈kraken”brand name on a rarely-seen nameserver “webgalaxy.hu”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
Model opinion: looks benign, confidence 88%. An opinion, not a finding.
brand in the name “usaa”brand name at a retail registrar “Synergy Wholesale Accreditations Pty Ltd”form on a brand-styled page “has_form”brand name redirects elsewhere “com.au”
Model opinion: looks benign, confidence 96%. An opinion, not a finding.
brand in the name “ebay”brand name at a retail registrar “DreamHost, LLC”form on a brand-styled page “has_form”form submits over plain HTTP “http://www.pikebaytownship.org/”
Model opinion: looks benign, confidence 95%. An opinion, not a finding.
page asks for credentials “Log in to your account”login form “has_form+login words”
Model opinion: looks like phishing (target: Global Credit Union (Global Federal Credit Union)), confidence 85%. An opinion, not a finding.
page asks for credentials “Sign in to your account”login form “has_form+login words”
Model opinion: looks benign, confidence 78%. An opinion, not a finding.
brand in the name “telegram”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Fewmoretaps OU d/b/a Trustname.com”
Model opinion: suspicious (target: Telegram), confidence 72%. An opinion, not a finding.
lure words (login, verify, secure…) “support”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
brand in the name “telegram”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Fewmoretaps OU d/b/a Trustname.com”
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
page impersonates a brand “Binance”brand in page title, not in the name “telegram”
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”
Model opinion: suspicious, confidence 65%. An opinion, not a finding.
brand in page title, not in the name “gmail”form on a brand-styled page “has_form”
brand in page title, not in the name “google”form on a brand-styled page “has_form”
brand in page title, not in the name “wordpress”form on a brand-styled page “has_form”
brand in page title, not in the name “google”form on a brand-styled page “has_form”
brand in the name “telegram”brand name at a retail registrar “GoDaddy.com, LLC”
brand in page title, not in the name “chase”form on a brand-styled page “has_form”
brand in page title, not in the name “nationwide”form on a brand-styled page “has_form”
brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
brand in page title, not in the name “nationwide”form on a brand-styled page “has_form”
brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
brand in page title, not in the name “zoom”form on a brand-styled page “has_form”
brand in page title, not in the name “google”form on a brand-styled page “has_form”
brand in page title, not in the name “chase”form on a brand-styled page “has_form”
brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
brand in page title, not in the name “wordpress”form on a brand-styled page “has_form”
brand in page title, not in the name “google”form on a brand-styled page “has_form”
one-letter brand typo “telergram≈telegram”brand name at a retail registrar “West263 International Limited”
lure words (login, verify, secure…) “member,members”brand in page title, not in the name “cloudflare”
page asks for credentials “Sign In to Your Account”
brand in page title, not in the name “hostinger”identical page on many newborns “56 identical pages”
brand in page title, not in the name “hostinger”identical page on many newborns “56 identical pages”
page asks for credentials “sign in to your account”
brand in page title, not in the name “hostinger”identical page on many newborns “56 identical pages”
brand in page title, not in the name “hostinger”identical page on many newborns “56 identical pages”
lure words (login, verify, secure…) “limited”page impersonates a brand “binance”
lure words (login, verify, secure…) “access,account”login form “has_form+login words”
many hyphens “3”brand in page title, not in the name “cloudflare”
nameserver domain born the same day “onebet303.info”
very long name “29”brand in page title, not in the name “hostinger”
very long name “39”brand in page title, not in the name “wordpress”
punycode name “남대문평생주소 scripts=HANGUL”random-looking name “H=3.86”
punycode name “海豚加速器 scripts=CJK”random-looking name “H=3.83”
page impersonates a brand “Netflix”
page impersonates a brand “Netflix”
page impersonates a brand “Apple ID”
page impersonates a brand “USPS”
page impersonates a brand “PayPal”
page impersonates a brand “IRS”