Phishing detection: hsbc.dev

HSBC
https://hsbc.dev Access site
Screenshot
Screenshot of hsbc.dev
Investigate
Domain hsbc.dev2 CT hosts on apex
urlscan page.domain VirusTotal Whois

See every phishunt record for this domain

IP 104.21.36.32
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://hsbc.dev
urlscan Wayback archive.today
Cert Google Trust Services
crt.sh Censys Google CT
Phishunt analysis Beta
29 low suspicionheuristic risk score · not a probability
Why?
  • +5.3 Keyword match
  • +5.1 Site cluster
  • +5.1 urlscan.io
  • +4.1 Brand in screenshot
  • +2.2 ASN reputation
  • +2.2 Country mismatch
  • +1.3 Brand typo
  • +1.1 No CSP header
  • +0.7 Brand in cert SAN
  • +0.6 Registrar reputation
  • +0.6 Suspicious TLD
  • +0.5 Young certificate
  • +0.3 Free CA
  • +0.2 Long domain
  • +0.1 External scripts
17 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Site impersonates HSBC bank using the exact brand name under a .dev TLD, hosted on Cloudflare. Outbound links point away from genuine HSBC infrastructure, the keyword classifier scores at maximum, and urlscan independently flags it as malicious — a pattern consistent with credential harvesting.

Keyword matchNo brand linksurlscan.io
AI-generated from stored detector signals - the AI never visited the site. · 2026-07-23 · confidence 62%
Domain & Network
Whois
Registrar Squarespace Domains II LLC.
Network
IP 104.21.36.32
Country United StatesUnited States
Hosting Cloudflare, Inc.
ASN AS13335
TLS Cert Google Trust Services
External detection urlscan.io
CleanGoogle Safe Browsing · OpenPhish · PhishTank · TweetFeed
Report this phishing
Network / ASN Cloudflare, Inc.
Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-05-10 19:21 UTC  ·  Last refreshed 2026-08-23 21:30 UTC