Scan report · 9 days agoPublic

paymentsecurelink.vercel.app

216.198.79.195AS16509 · US

Submittedhttps://paymentsecurelink.vercel.app/

Suspicious: this page offers the visitor no link at all, yet its own script carries the address pq.npljlip.net

a different site from the one being visitedand navigates there with what the visitor types. A page whose only destination is somewhere else is a hand-off, not a document

Engine tags

Verdict

2 of 9 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 9.0 s · 20 requests

01 · Visitor openspaymentsecurelink.vercel.app

02 · Page shown

Microsoft | Loginstyled as Microsoft · high

03 · OutcomeCredential phishingA login page wearing a brand it does not own.

Dangerous — confirmed threat

Automated

It presents itself as Microsoft while being hosted somewhere Microsoft does not own. It asks you to enter a password. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

SupportingBrand impersonation detected

Microsoft · high

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteHigh confidence: brand keywords AND a password field — classic credential phishing.

InfoSelf-hosted product check: no-fingerprint

no server fingerprint of the brand's own product

The brand fired at high confidence on a credential page, so the page was checked against the brand's self-hosted products (server fingerprint, the product's own credential sink on this host, return address, the organisation's mail records). It did not pass: refused: no server fingerprint of a Microsoft self-hosted product among 11 detected technologies

Analyst noteAn ordinary clone: the brand is on the page but the server is not the brand's product, or the credentials leave for somewhere that is not the product's own endpoint. Read the brand impersonation card below.

Infrastructure

IP: 216.198.79.195AMAZON-02 - Amazon.com, Inc., US · AS16509US
TLS: CN=WR1, O=Google Trust Services, C=US · expires Nov 27, 2026

36 malicious16 suspicious

Hashes & fingerprints

Page Hashf5e42378712616ae6b1a66a46b8181c0147b2d4dae2130ff4acfb16877e92c35 Favicon Hash90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21 DOM Hash883fe05eb3998d7395933e22d6fdbddd1140196648e2b6017c2e4d1c7df579d3 Screenshot pHash87681d62e3994de6 JARM3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fb JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert ThumbprintE9FE9E58E9B395781F9AAEFE41C40164C9FB2ABC Cert IssuerCN=WR1, O=Google Trust Services, C=US

Page capture

Live

Title “Microsoft | Login” · brand shown: Microsoft (high)

Visit Site

Engines

9 · time to verdict