zerophish / console
Register Sign in
URL THREAT INTELLIGENCE · v0.5.0 · OPERATIONAL

The full anatomy of a phishing site,
one URL at a time.

ZeroPhish renders the page, runs twelve detection signals against the DOM, certificate chain, brand fingerprint and threat feeds, and returns a typed verdict. Built for security teams and product engineers.

scan
100 scans / day · free · typical scan 2–4 s ·
try
Result scan 82d4c953
Scan another →
CACHED Showing previous scan from 24 d ago. Click Reanalyze to run a fresh scan.
SAFE · HIGH CONFIDENCE

No phishing signals detected

brand Amazon scan id 82d4c953 duration 17.34s signals 2 failing / 25
Risk score 0.03
3 / 100 · Low risk
Tags
URL anatomy amzn.to
https :// amzn . to /45Ai1w7
flagged registered domain path protocol / query
Why this verdict 11 contributing signals · model gpt-5.4-nano
×
Brand typo-squat detected
amzn ↔ amazon · Levenshtein 2 · brand: Amazon
↑ risk
×
Visual similarity to known brand
100% structural similarity to Amazon
↑ risk
!
CAA issuer restriction
No CAA record — any certificate authority may issue a cert for this domain (phishing infra rarely sets CAA)
↑ risk
!
DNSSEC signing
Zone is not DNSSEC-signed — phishing domains are almost never signed
↑ risk
Credential collection form
No credential collection form on visible content
↓ risk
Favicon impersonation
Favicon matches the registered owner
↓ risk
SSL certificate
Served over HTTPS · valid TLS certificate
↓ risk
Brand-in-subdomain attack
No known brand label in subdomain
↓ risk
Homoglyph attack
ASCII only · no mixed-script characters detected
↓ risk
Email-auth posture (SPF/DMARC)
DMARC p=reject — domain is protected against direct spoofing
↓ risk
Page language
Detected page language: English (en) — best-effort
↓ risk
enrichment used: dns network jarm asn
Indicators of compromise 5 · click any row to copy
URL hxxps://amzn[.]to/45Ai1w7
Host amzn[.]to
Brand Amazon
Screenshot https://cdn.zerophish.ai/069f805f-3950-4cd4-870e-813c1b15ecb8.jpg
Scan ID 82d4c953-3dac-4e3c-b89c-03addff18046
Related detections 24 other scans on this registered domain
3 h ago
 SAFE amzn.to safe
3 h ago
 SAFE amzn.to safe
14 h ago
 SAFE amzn.to safe
14 h ago
 SAFE amzn.to safe
15 h ago
 SAFE amzn.to safe
23 h ago
 SAFE amzn.to safe
1 d ago
 SAFE amzn.to safe
1 d ago
 SAFE amzn.to safe
Detection signals 2 fail · 2 warn · 7 pass
×
Brand typo-squat detected
amzn ↔ amazon · Levenshtein 2 · brand: Amazon
critical
Domain age
Awaiting analysis
high
Threat intel blocklists
Awaiting analysis
critical
Credential collection form
No credential collection form on visible content
high
×
Visual similarity to known brand
100% structural similarity to Amazon
high
Favicon impersonation
Favicon matches the registered owner
medium
SSL certificate
Served over HTTPS · valid TLS certificate
low
DNS reputation
Awaiting analysis
medium
showing 8 of 25 ·
Captured page from scan
Captured page
screenshot · captured at scan live page render
Brand impersonation ecommerce
A
Amazon
amazon.com
100%
Technical profile resolved at scan time
Host amzn.to
Registered domain amzn.to
Scheme https
Content length 1662949 B
HTTP 200 · text/html
DMARC policy p=reject
SPF policy strict
MX records none
Analyst summary AI-generated
Initial scan heuristic + LLM

Verdict: Legitimate (Amazon product page)

What the page presents

The content is a standard Amazon India product detail page for a clothing item: “Buy SOJANYA (Since 1958) Men’s Silk Blend Cream Kurta Churidaar Pyjama & Maroon Jacket COMBO” with typical sections like “Add to cart,” “Buy Now,” “Product details,” and “Customer reviews.”

Suspicious elements checked (and not found)

  • No credential-harvesting form visible: The OCR shows “Hello, sign in” and account navigation, but the page section shown is product information, reviews, shipping, and checkout options—there is no visible login/password/OTP form in the provided HTML/OCR.
  • No fake security or urgency warnings: There are no messages like “account locked,” “verify now,” “unusual activity,” or time-critical threats.
  • No mismatched branding: The page consistently matches Amazon’s layout and wording (“Delivering to Mumbai 400001,” “Secure transaction,” “Amazon Pay,” etc.).
  • No suspicious redirects in the provided content: The URL uses an Amazon short link host (amzn.to). The HTML includes Amazon asset hosts (e.g., m.media-amazon.com, fls-eu.amazon.in), which is consistent with legitimate Amazon rendering.

URL vs. brand

  • Identified brand: Amazon.
  • URL: https://amzn.to/45Ai1w7 is an Amazon-owned short-link domain structure used to redirect to Amazon destinations.
  • Result: The URL/hosts and page content align with Amazon; there’s no strong indicator of impersonation.

Conclusion

Given the consistent Amazon DOM signals (product title, reviews, “Amazon Pay,” delivery location, and Amazon-hosted resources) and the absence of credential-collection or phishing-style warnings, this appears to be a legitimate Amazon product page rather than a phishing site.