The full anatomy of a phishing site,
one URL at a time.
ZeroPhish renders the page, runs twelve detection signals against the DOM, certificate chain, brand fingerprint and threat feeds, and returns a typed verdict. Built for security teams and product engineers.
Suspicious — review required
| URL | hxxp://allegro[.]623687211-oferta-apple-watch-ultra-3-49mm[.]digital/ | |
| Host | allegro[.]623687211-oferta-apple-watch-ultra-3-49mm[.]digital | |
| Registered domain | 623687211-oferta-apple-watch-ultra-3-49mm[.]digital | |
| Brand | Plesk | |
| Screenshot | https://cdn.zerophish.ai/b00ab14f-a192-46df-a672-0203b9f20871.jpg | |
| Scan ID | 3f5a2d5d-5569-4151-9051-bd438a3c979e |
| Host | allegro.623687211-oferta-apple-watch-ultra-3-49mm.digital |
| Registered domain | 623687211-oferta-apple-watch-ultra-3-49mm.digital |
| Scheme | http |
| Content length | 56139 B |
| HTTP | 200 · text/html |
The page is a generic “Web Server’s Default Page” generated by Plesk, shown because “there is no Web site at this address.” It presents hosting/control-panel marketing content such as “Log in to Plesk to create websites and set up hosting” but the provided HTML contains only a Plesk logo and informational links—there is no visible credential/username/password form on the page.
Suspicious phishing elements are limited: while the URL contains unusual components related to “allegro” and “apple-watch…digital,” the content itself consistently references Plesk (e.g., “This page is generated by Plesk” and links to plesk.com). There are no fake security warnings, urgency/limited-time cues, or brand mismatch (the dominant brand is Plesk and the links go to plesk.com).
Given the evidence, this looks like a misconfigured server showing a default Plesk page rather than a phishing capture page. Confidence is kept low only because we cannot verify runtime behavior (e.g., whether the “Log in to Plesk” link leads to a credential form elsewhere), but based on the supplied content there is no direct harvesting form.