brand in the name “paypal”lure words (login, verify, secure…) “service”brand plus digits “paypal-kundenservice26”page impersonates a brand “PayPal”+2 more
Model opinion: looks like phishing (target: PayPal), confidence 97%. An opinion, not a finding.
brand in the name “costco”lure words (login, verify, secure…) “reward,rewards”brand plus digits “mycostcorewards0029”form on a brand-styled page “has_form”+1 more
Model opinion: looks like abuse (target: Costco), confidence 80%. An opinion, not a finding.
brand in the name “twitter”TLD with a high abuse rate “click”brand name and brand-styled page “twitter”form on a brand-styled page “has_form”
Model opinion: looks like abuse (target: Twitter), confidence 62%. An opinion, not a finding.
page asks for credentials “Sign in to your account”brand in page title, not in the name “amazon”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 75%. An opinion, not a finding.
TLD with a high abuse rate “lol”page impersonates a brand “Netflix”brand in page title, not in the name “amazon”form on a brand-styled page “has_form”
Model opinion: looks like a scam, confidence 80%. An opinion, not a finding.
free DNS provider “dnsowl.com”page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”
Model opinion: looks like phishing (target: Microsoft), confidence 97%. An opinion, not a finding.
TLD with a high abuse rate “fun”page impersonates a brand “FedEx”brand in page title, not in the name “fedex”form on a brand-styled page “has_form”
Model opinion: looks like phishing (target: FedEx), confidence 86%. An opinion, not a finding.
TLD with a high abuse rate “xyz”page impersonates a brand “Coinbase”brand in page title, not in the name “apple”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 62%. An opinion, not a finding.
page asks for credentials “log in to your account”brand in page title, not in the name “facebook”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 75%. An opinion, not a finding.
punycode name “三毛机场 scripts=CJK”TLD with a high abuse rate “click”page impersonates a brand “Netflix”brand in page title, not in the name “netflix”
Model opinion: looks benign, confidence 66%. An opinion, not a finding.
TLD with a high abuse rate “fun”page impersonates a brand “Amazon Prime”brand in page title, not in the name “amazon”form on a brand-styled page “has_form”
Model opinion: looks like a scam, confidence 85%. An opinion, not a finding.
brand in the name “tiktok”page impersonates a brand “PayPal”brand name and brand-styled page “tiktok”
Model opinion: looks like phishing (target: TikTok), confidence 74%. An opinion, not a finding.
lure words (login, verify, secure…) “alert”page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 86%. An opinion, not a finding.
brand in the name “vanguard”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more
Model opinion: looks benign, confidence 80%. An opinion, not a finding.
brand in the name “tmobile”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”brand in page title, not in the name “nationwide”
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
brand in the name “amazon”brand name and brand-styled page “amazon”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
brand in the name “booking”lure words (login, verify, secure…) “confirm,confirmation”
Model opinion: looks like phishing (target: Le Collectionist), confidence 80%. An opinion, not a finding.
brand in the name “booking”lure words (login, verify, secure…) “confirm,confirmation”
Model opinion: looks like phishing (target: Le Collectionist), confidence 80%. An opinion, not a finding.
one-letter brand typo “finance≈binance”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand in page title, not in the name “wordpress”
Model opinion: looks like abuse (target: Muthoot Finance), confidence 80%. An opinion, not a finding.
brand in the name “vanguard”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 93%. An opinion, not a finding.
page impersonates a brand “Netflix”brand in page title, not in the name “google”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 72%. An opinion, not a finding.
page impersonates a brand “Apple ID”brand in page title, not in the name “apple”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 60%. An opinion, not a finding.
page impersonates a brand “Netflix”brand in page title, not in the name “apple”form on a brand-styled page “has_form”
Model opinion: looks like abuse, confidence 55%. An opinion, not a finding.
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
one-letter brand typo “finance≈binance”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 80%. An opinion, not a finding.
page impersonates a brand “Netflix”brand in page title, not in the name “amazon”form on a brand-styled page “has_form”
Model opinion: looks like abuse, confidence 92%. An opinion, not a finding.
page impersonates a brand “Coinbase”brand in page title, not in the name “schwab”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 86%. An opinion, not a finding.
page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 86%. An opinion, not a finding.
page impersonates a brand “Netflix”brand in page title, not in the name “apple”form on a brand-styled page “has_form”
Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 60%. An opinion, not a finding.
page impersonates a brand “PayPal”brand in page title, not in the name “amazon”form on a brand-styled page “has_form”
Model opinion: looks like a scam, confidence 74%. An opinion, not a finding.
page impersonates a brand “PayPal”brand in page title, not in the name “amazon”form on a brand-styled page “has_form”
Model opinion: looks like a scam, confidence 74%. An opinion, not a finding.
brand in the name “amazon”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”brand name and brand-styled page “amazon”
Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.
brand in the name “google”TLD with a high abuse rate “lol”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “google”
Model opinion: looks like phishing (target: Google), confidence 70%. An opinion, not a finding.
brand in the name “google”TLD with a high abuse rate “lol”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “google”
Model opinion: looks like phishing (target: Google), confidence 68%. An opinion, not a finding.
brand in the name “adobe”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
Model opinion: looks like abuse (target: Adobe), confidence 88%. An opinion, not a finding.
brand in the name “intuit”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
Model opinion: looks benign, confidence 80%. An opinion, not a finding.
brand in the name “tiktok”brand name on a rarely-seen nameserver “fastnestbd.click”brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”
Model opinion: looks like abuse (target: TikTok), confidence 62%. An opinion, not a finding.
brand in the name “intuit”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot, LLC”+1 more
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
lure words (login, verify, secure…) “service,services”TLD with a high abuse rate “homes”brand in page title, not in the name “booking”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
ambiguous brand word “phantom”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+2 more
Model opinion: looks benign, confidence 86%. An opinion, not a finding.
ambiguous brand word “starling”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+2 more
Model opinion: looks like a scam, confidence 90%. An opinion, not a finding.
ambiguous brand word “starling”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+2 more
Model opinion: looks like a scam, confidence 88%. An opinion, not a finding.
brand in the name “facebook”brand name at a retail registrar “Tucows Domains Inc.”form on a brand-styled page “has_form”
Model opinion: looks like abuse (target: Facebook), confidence 60%. An opinion, not a finding.
brand in the name “intuit”brand name at a retail registrar “GoDaddy.com, LLC”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 95%. An opinion, not a finding.
one-letter brand typo “kraken6≈kraken”brand plus digits “kraken6”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
Model opinion: looks like abuse, confidence 62%. An opinion, not a finding.
brand in the name “shopify”brand name at a retail registrar “GoDaddy.com, LLC”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 60%. An opinion, not a finding.
brand in the name “zelle”brand name at a retail registrar “Squarespace Domains II LLC”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 95%. An opinion, not a finding.
lure words (login, verify, secure…) “track”TLD with a high abuse rate “homes”page impersonates a brand “Coinbase”brand in page title, not in the name “coinbase”
Model opinion: looks benign, confidence 60%. An opinion, not a finding.