The full anatomy of a phishing site,
one URL at a time.
ZeroPhish renders the page, runs twelve detection signals against the DOM, certificate chain, brand fingerprint and threat feeds, and returns a typed verdict. Built for security teams and product engineers.
Phishing detected
| URL | hxxps://usaa-checklist[.]help/secure-message | |
| Brand | usaa | |
| Screenshot | https://cdn.zerophish.ai/de7d2144-57eb-4962-b3e3-9dde5045dd17.jpg | |
| Scan ID | 94336fbb-444c-430b-b7b9-319da638632e |
No detection signals on this scan — it predates the signal pipeline. Re-analyze to capture them.
No brand impersonation signals available.
No technical metadata captured for this scan.
The URL contains a brand name, ‘usaa’, but the domain does not match the official domain for the company (usaa.com). The subdomain ‘usaa-checklist’ and the domain ‘help/secure-message’ appear to be engineered to entice users to trust the site. The site displays a ‘403 Forbidden’ message, which could be an attempt to fake an error to avoid being flagged as phishing. The HTML shows a plain ‘403 Forbidden’ page with no costumed branding elements, which is another suspicious sign. Overall, the site is highly suspect.