URL THREAT INTELLIGENCE · v0.5.0 · OPERATIONAL
The full anatomy of a phishing site,
one URL at a time.
ZeroPhish renders the page, runs twelve detection signals against the DOM, certificate chain, brand fingerprint and threat feeds, and returns a typed verdict. Built for security teams and product engineers.
100 scans / day · free
·
typical scan 2–4 s
·
try
SUSPICIOUS · LOW CONFIDENCE
Suspicious — review required
Risk score
0.54
54 / 100 · Medium risk
URL anatomy
https
://
formulario-digital-2026-apknm.cr-web
.
workers
.
dev
/
flagged
registered domain
path
protocol / query
Indicators of compromise
| URL | hxxps://formulario-digital-2026-apknm[.]cr-web[.]workers[.]dev/ | |
| Host | formulario-digital-2026-apknm[.]cr-web[.]workers[.]dev | |
| Registered domain | workers[.]dev | |
| Screenshot | https://cdn.zerophish.ai/fb709ff6-2fcb-490c-9def-bef7e880cdf4.jpg | |
| Scan ID | 49109ac7-46da-4745-83f8-c4cd946ac87d |
Related detections
|
17 d ago
|
SUSPICIOUS | formulario-digital-2026-apknm.cr-web.workers.dev | safe |
|
17 d ago
|
SAFE | formulario-digital-2026-apknm.cr-web.workers.dev | safe |
|
17 d ago
|
PHISHING | registro-digital-ahop-2026.cr-web.workers.dev | view → |
|
17 d ago
|
PHISHING | registro-digital-ahop-2026.cr-web.workers.dev | view → |
|
17 d ago
|
PHISHING | formulario-digital-2026-apknm.cr-web.workers.dev | view → |
|
17 d ago
|
PHISHING | formulario-digital-2026-apknm.cr-web.workers.dev | view → |
Detection signals
Brand typo-squat detected
No similar legitimate brand within edit-distance 2
critical
Domain age
Awaiting analysis
high
Threat intel blocklists
Awaiting analysis
critical
Credential collection form
Credential collection form detected on the page
high
Visual similarity to known brand
Brand presentation matches the registered owner
high
Favicon impersonation
Favicon matches the registered owner
medium
SSL certificate
Served over HTTPS · certificate validated by ApiFlash
low
DNS reputation
Awaiting analysis
medium
showing 8 of 12 ·
Captured page
Brand impersonation
No brand impersonation signals available.
Technical profile
| Host | formulario-digital-2026-apknm.cr-web.workers.dev |
| Registered domain | workers.dev |
| Scheme | https |
| Content length | 44139 B |
| HTTP | 200 · text/html |
Analyst summary
Initial scan
The site presents itself as a government tax declaration platform, but the suspicious domain and the presence of credential collection forms suggest it might be phishing. There’s no clear brand impersonation, and the degree to which it mimics a legitimate service is unclear due to lack of a reference brand. Further examination would be needed for full confidence.