The full anatomy of a phishing site,
one URL at a time.
ZeroPhish renders the page, runs twelve detection signals against the DOM, certificate chain, brand fingerprint and threat feeds, and returns a typed verdict. Built for security teams and product engineers.
Phishing detected
| URL | hxxps://zerophishex[.]fly[.]dev/scans/bd0d82da-f491-4d30-8177-9f39aa6db25e | |
| Host | zerophishex[.]fly[.]dev | |
| Registered domain | fly[.]dev | |
| Brand | banco-nacional | |
| Screenshot | https://cdn.zerophish.ai/30d4c5a7-6642-45f3-9e0c-7d1622fad371.jpg | |
| Scan ID | c7f56c55-f3d8-4ece-994b-632e19be2ee7 |
|
16 d ago
|
PHISHING | zerophishex.fly.dev | view → |
| Host | zerophishex.fly.dev |
| Registered domain | fly.dev |
| Scheme | https |
| Content length | 62428 B |
| HTTP | 200 · text/html |
The page is presented as “banco-nacional” (shown in the scan verdict as brand banco-nacional), but the provided URL is on an unrelated domain: https://zerophishex.fly.dev/… (and the OCR also references other non–brand domains such as registro-digital-…/workers.dev). The scan result itself flags phishing with “PHISHING · MEDIUM CONFIDENCE” and a “Risk score 0.90”. No evidence of a live credential form is present in the provided simplified HTML (it appears to be a ZeroPhish scan console), so credential harvesting UI is not directly observable here; however, the OCR claims a sign-in form on the scanned content, which is a common phishing pattern. Overall, the mismatch between brand and hosting domain plus the scan verdict leads to a phishing conclusion.