URL THREAT INTELLIGENCE · v0.5.0 · OPERATIONAL
The full anatomy of a phishing site,
one URL at a time.
ZeroPhish renders the page, runs twelve detection signals against the DOM, certificate chain, brand fingerprint and threat feeds, and returns a typed verdict. Built for security teams and product engineers.
100 scans / day · free
·
typical scan 2–4 s
·
try
SAFE · HIGH CONFIDENCE
No phishing signals detected
Risk score
0.06
6 / 100 · Low risk
URL anatomy
https
://
amzn
.
to
/4x8FtvN
flagged
registered domain
path
protocol / query
Why this verdict
Brand typo-squat detected
amzn ↔ amazon · Levenshtein 2 · brand: Amazon
↑ risk
Visual similarity to known brand
100% structural similarity to Amazon
↑ risk
CAA issuer restriction
No CAA record — any certificate authority may issue a cert for this domain (phishing infra rarely sets CAA)
↑ risk
DNSSEC signing
Zone is not DNSSEC-signed — phishing domains are almost never signed
↑ risk
Credential collection form
No credential collection form on visible content
↓ risk
Favicon impersonation
Favicon matches the registered owner
↓ risk
SSL certificate
Served over HTTPS · valid TLS certificate
↓ risk
Brand-in-subdomain attack
No known brand label in subdomain
↓ risk
Homoglyph attack
ASCII only · no mixed-script characters detected
↓ risk
Email-auth posture (SPF/DMARC)
DMARC p=reject — domain is protected against direct spoofing
↓ risk
Page language
Detected page language: English (en) — best-effort
↓ risk
enrichment used:
dns
network
jarm
asn
Indicators of compromise
| URL | hxxps://amzn[.]to/4x8FtvN | |
| Host | amzn[.]to | |
| Brand | Amazon | |
| Screenshot | https://cdn.zerophish.ai/b8ea6c09-4167-4937-8117-767ae34ddd27.jpg | |
| Scan ID | 544cfe43-10ce-4c55-8729-1a537f0b5571 |
Related detections
|
4 h ago
|
SAFE | amzn.to | safe |
|
4 h ago
|
SAFE | amzn.to | safe |
|
14 h ago
|
SAFE | amzn.to | safe |
|
15 h ago
|
SAFE | amzn.to | safe |
|
15 h ago
|
SAFE | amzn.to | safe |
|
23 h ago
|
SAFE | amzn.to | safe |
|
1 d ago
|
SAFE | amzn.to | safe |
|
1 d ago
|
SAFE | amzn.to | safe |
Detection signals
Brand typo-squat detected
amzn ↔ amazon · Levenshtein 2 · brand: Amazon
critical
Domain age
Awaiting analysis
high
Threat intel blocklists
Awaiting analysis
critical
Credential collection form
No credential collection form on visible content
high
Visual similarity to known brand
100% structural similarity to Amazon
high
Favicon impersonation
Favicon matches the registered owner
medium
SSL certificate
Served over HTTPS · valid TLS certificate
low
DNS reputation
Awaiting analysis
medium
showing 8 of 25 ·
Captured page
Brand impersonation
A
Amazon
amazon.com
100%
Technical profile
| Host | amzn.to |
| Registered domain | amzn.to |
| Scheme | https |
| Content length | 1372978 B |
| HTTP | 200 · text/html |
| DMARC policy | p=reject |
| SPF policy | strict |
| MX records | none |
Analyst summary
Initial scan
Conclusion: Legitimate (Amazon)
The page appears to be a normal Amazon.in search/results page for “nike shoes”. The HTML and OCR text show standard Amazon navigation and product listing elements (e.g., “Delivering to Mumbai 400001”, “Hello, sign in”, “Account & Lists”, “Cart”, and “37 results for \”nike shoes\””).
Suspicious elements found
- None indicating phishing credential theft: there is no visible password/OTP/credential-collection form in the provided content. The only login-related text shown is the normal header link “Hello, sign in”.
- No fake security warnings / urgency scams: the text emphasizes typical e-commerce details like pricing, delivery dates, and discounts (e.g., “FREE delivery …”, “Limited time deal”, “% off”), not account-compromise threats.
-
URL/domain consistency: the URL uses the well-known short link pattern
amzn.to, which commonly redirects into Amazon domains; the page title is “Amazon.in : nike shoes” and the content matches Amazon’s structure.
Brand identification
- Brand presented: Amazon.
-
Brand match: The DOM/visible content is highly consistent with Amazon (layout, navigation items, product card patterns).
brand_matchis therefore set very high.
Why this verdict
The provided HTML/OCR reflect a standard Amazon search results experience and include no harvesting form, no mismatched branding, and no prominent scam tactics. While shortened URLs can sometimes mask destinations, the landing page content strongly matches Amazon.in conventions, so confidence is high.