URL THREAT INTELLIGENCE · v0.5.0 · OPERATIONAL
The full anatomy of a phishing site,
one URL at a time.
ZeroPhish renders the page, runs twelve detection signals against the DOM, certificate chain, brand fingerprint and threat feeds, and returns a typed verdict. Built for security teams and product engineers.
100 scans / day · free
·
typical scan 2–4 s
·
try
SUSPICIOUS · LOW CONFIDENCE
Suspicious — review required
Risk score
0.42
42 / 100 · Medium risk
URL anatomy
https
://
formulario-digital-2026-apknm.cr-web
.
workers
.
dev
/
flagged
registered domain
path
protocol / query
Indicators of compromise
| URL | hxxps://formulario-digital-2026-apknm[.]cr-web[.]workers[.]dev/ | |
| Host | formulario-digital-2026-apknm[.]cr-web[.]workers[.]dev | |
| Registered domain | workers[.]dev | |
| Brand | Lafise | |
| Screenshot | https://cdn.zerophish.ai/8f6ff33c-8321-484d-b049-b82688f63efd.jpg | |
| Scan ID | d36e1361-ac6f-4a96-b244-811817a49810 |
Related detections
|
17 d ago
|
SAFE | formulario-digital-2026-apknm.cr-web.workers.dev | safe |
|
17 d ago
|
SUSPICIOUS | formulario-digital-2026-apknm.cr-web.workers.dev | safe |
|
17 d ago
|
PHISHING | registro-digital-ahop-2026.cr-web.workers.dev | view → |
|
17 d ago
|
PHISHING | registro-digital-ahop-2026.cr-web.workers.dev | view → |
|
17 d ago
|
PHISHING | formulario-digital-2026-apknm.cr-web.workers.dev | view → |
|
17 d ago
|
PHISHING | formulario-digital-2026-apknm.cr-web.workers.dev | view → |
Detection signals
Brand typo-squat detected
No similar legitimate brand within edit-distance 2
critical
Domain age
Awaiting analysis
high
Threat intel blocklists
Awaiting analysis
critical
Credential collection form
No credential collection form on visible content
high
Visual similarity to known brand
60% partial similarity to Lafise
high
Favicon impersonation
Favicon matches the registered owner
medium
SSL certificate
Served over HTTPS · valid TLS certificate
low
DNS reputation
Awaiting analysis
medium
showing 8 of 12 ·
Captured page
Brand impersonation
L
Lafise
60%
Technical profile
| Host | formulario-digital-2026-apknm.cr-web.workers.dev |
| Registered domain | workers.dev |
| Scheme | https |
| Content length | 44139 B |
| HTTP | 200 · text/html |
Analyst summary
Initial scan
The page is trying to present itself as some kind of digital government formular for taxes. There’s no obvious phishing activity, but the disparity between the URL and presented institution could raise some suspicions. I consider the page as possibly dangerous, but more analysis would be needed for a definitive judgment.