Scan report · 10 days agoPublic

fuzzy-tan-h6iahs7m.edgeone.dev

43.174.247.29AS139341 · SG

Submittedhttps://fuzzy-tan-h6iahs7m.edgeone.dev/?/#temp@microsoft.com

Suspicious: this page offers the visitor no link at all, yet its own script carries the address submit-form.com

a different site from the one being visitedand navigates there with what the visitor types. A page whose only destination is somewhere else is a hand-off, not a document

Engine tags

Verdict

2 of 8 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 10.5 s · 8 requests

01 · Visitor opensfuzzy-tan-h6iahs7m.edgeone.dev/?/

02 · Page shown

fuzzy-tan-h6iahs7m.edgeone.devstyled as Microsoft · low

03 · OutcomeSession hijack through a proxyThe brand's real pages are relayed through the attacker, who keeps the session.

Dangerous — confirmed threat

Automated

Its page title claims to be Microsoft, which this address is not associated with. It asks you to enter a password. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

SupportingAiTM: brand assets served through a proxy

Microsoft

Images/scripts belonging to a real brand were loaded THROUGH the attacker's host — the hallmark of an adversary-in-the-middle (Evilginx-style) proxy that relays the real login to steal the session.

Analyst noteStrong AiTM indicator when paired with a password form or a form-action mismatch. The brand whose assets are proxied is the impersonation target.

InfoBrand impersonation detected

Microsoft · low

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

Infrastructure

IP: 43.174.247.29ACE-AS-AP - ACE, SG · AS139341SG
TLS: CN=YR1, O=Let's Encrypt, C=US · expires Dec 16, 2026

WHOIS

Registrar: MarkMonitor Inc.
Created: Jun 9, 2025
Expires: Jun 9, 2027
Nameservers: ns3.dnsv2.comns4.dnsv2.com

39 malicious8 suspicious

Hashes & fingerprints

Page Hashf3782486e4b40b9fc67c22fe16e2c905f1d0ef6301604f50aac28603e212bff1 Favicon Hash2336be022fea58d7cfa7d3e4b76a459af15f4dce718f6935d45d405780ccf68d DOM Hashd04a044cf14ebac6397d07bbefc3807fc61e54fc24369c9ab330f7d17e7f9d80 Screenshot pHashcdb2309bcdb53348 JARM2ad2ad0002ad2ad22c42d42d0000008a5941c13f67e0c0a2c8a36bfeef6920 JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint11C04B486D6D45604DA0D67A2230E4163EC0C14E Cert IssuerCN=YR1, O=Let's Encrypt, C=US

Page capture

Live

brand shown: Microsoft (low)

Visit Site

Engines

8 · time to verdict