The full anatomy of a phishing site,
one URL at a time.
ZeroPhish renders the page, runs twelve detection signals against the DOM, certificate chain, brand fingerprint and threat feeds, and returns a typed verdict. Built for security teams and product engineers.
No phishing signals detected
| URL | hxxps://amzn[.]to/4glkJe1 | |
| Host | amzn[.]to | |
| Brand | Dove | |
| Screenshot | https://cdn.zerophish.ai/eed8f98a-10a5-4c18-9fa9-6af6402970fc.jpg | |
| Scan ID | 9cae5a04-a87c-4110-ab66-e01172c0e42f |
|
3 h ago
|
SAFE | amzn.to | safe |
|
3 h ago
|
SAFE | amzn.to | safe |
|
14 h ago
|
SAFE | amzn.to | safe |
|
14 h ago
|
SAFE | amzn.to | safe |
|
15 h ago
|
SAFE | amzn.to | safe |
|
23 h ago
|
SAFE | amzn.to | safe |
|
1 d ago
|
SAFE | amzn.to | safe |
|
1 d ago
|
SAFE | amzn.to | safe |
| Host | amzn.to |
| Registered domain | amzn.to |
| Scheme | https |
| Content length | 2151049 B |
| HTTP | 200 · text/html |
| DMARC policy | p=reject |
| SPF policy | strict |
| MX records | none |
Verdict: Legitimate (not phishing)
What the page presents
The URL resolves to an Amazon product detail page titled: “Buy Dove Fresh Moisture Beauty Bathing Bar… Online at Low Prices in India - Amazon.in”. The content is consistent with a standard Amazon listing: product title, seller information (“Ships from Amazon” / “Sold by RK World Infocom Pvt Ltd”), pricing, delivery estimate, reviews, and Amazon footer links.
Suspicious elements checked (and not found)
- No credential/identity collection: The OCR shows “Hello, sign in” and “Account & Lists”, but there is no visible password/login form or payment credential capture on the provided HTML/OCR excerpt.
- No fake security urgency: There are no messages like account compromise warnings, “verify now,” or threats of account closure.
-
No mismatched branding/phoney domain: Although the short URL is
amzn.to/..., the page content and metadata are clearly for Amazon and the product brand is Dove (e.g., “Brand Dove”, “Top Brand Dove”). This is not a classic lookalike of a financial brand or a fake checkout page.
Brand and URL relationship
- Identified brand (presented product brand): Dove.
-
The page is hosted under Amazon’s infrastructure (product listing page elements, Amazon footer, Amazon delivery language). The short-link host
amzn.tois consistent with legitimate Amazon URL redirection, not an unrelated domain attempting to impersonate Dove/PayPal/etc.
Conclusion
Based on the strong presence of authentic Amazon e-commerce page structure (product details, seller/delivery/reviews) and the absence of credential-collection or urgency-based social engineering cues, this page is highly likely legitimate and not phishing.