ibtuxr641i.c4-explosive-workshops.de
172.67.197.7AS13335 · USthe verification control on this page opens onto https://ibtuxr641i.c4-ex…0b13c516ae45667be4132f, which runs a Microsoft device-code sign-in flow
- Browser Analysismalicious
- Network & Hostingclean
- Threat Intelligenceclean
- Content Inspectionclean
- Related Infrastructureclean
- TLS Fingerprintunknown
- Domain Intelligenceunknown
What happened
Step by step, from what the scanner recorded.Dangerous — confirmed threat
AutomatedIts verification check opens onto a page that shows a sign-in code and sends you to the real Microsoft login page — a technique used to take over an account without ever seeing your password. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.
What to do
Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.
This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.
Findings
Strongest firstEntering this trap's code at the real Microsoft device-login screen authorizes an attacker's session — MFA included. Sign-in tokens are stolen, not passwords, so no credential form ever has to appear — which is why this slips normal phishing checks.
The gate carries no branding itself, which is expected — the Microsoft costume is on the page it opens, one step past the verification click, where the code is asked for.
Device code on the page the gate opened
GCPPX42YV
Session-specific: the trap mints a fresh code for every visitor. This one was live for our scanner — a victim gets a different string, so read it as evidence of the flow, not as an identifier to hunt on.
The verification control on this page leads to https://ibtuxr641i.c4-explosive-workshops.de/l/dN8uUIAgPm0?key=da0b13c516ae45667be4132f, which we opened and analysed: it runs a Microsoft device-code sign-in flow. The visitor is shown a code and sent to the REAL Microsoft sign-in page to enter it, so what they approve is the attacker's session — including the multi-factor step — without a password ever being typed. That is why there is no login form to find here. That page is dressed as Microsoft, which this one is not — the gate carries no brand of its own, so the impersonation only becomes visible one document further on. Evidence: Microsoft device-login ref: login.microsoftonline.com/common/oauth2/deviceauth (via frame-inline-script-sink); on non-legit host ibtuxr641i.c4-explosive-workshops.de; code "GCPPX42YV"; device-code instructions present.
Analyst noteThe address above is where the code is displayed and the provider beside it is the takedown and abuse target. The code quoted here is the one OUR session was shown: this kit mints a fresh one per visitor, so it identifies the attacker's pending sign-in at the time of the scan, not the one any victim saw. Tokens are stolen rather than passwords, so an affected user's sessions have to be revoked — a password reset alone does not end the access.
The page prints a verification prompt, but no challenge provider is behind it and its form asks the visitor for nothing: every field is hidden state about whoever arrived (whether scripting is on, a mouse-movement count, how long they took, the device type) or a honeypot they cannot see. A page that SCORES its visitor instead of challenging them is deciding who is allowed to reach what is behind it — the shape of a phishing kit's doorway.
Analyst noteOpen the page's own script and look for the SCORE, not for a particular obfuscation: both kits seen so far start at 70 and subtract for the signs of an automated browser (navigator.webdriver, 'headless' in the user agent, an empty navigator.plugins), add for mouse movement, and submit anyway above a floor. The 2026-09-17 kit shipped it as a single eval(atob(...)) with ten named hidden fields; the 2026-10-01 one XOR-encrypts the same six measurements into ONE field and randomises its heading, subtitle and checkbox label on every fetch, so neither the wording nor the field count identifies it. A genuine challenge is served by its provider and never scores you in page script. If an address is named above, treat it as the targeted recipient and check whether that mailbox got the message.
Infrastructure
- IP
- 172.67.197.7CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
- TLS
- CN=YE2, O=Let's Encrypt, C=US · expires Dec 29, 2026
Hashes & fingerprints
Page capture
LiveTitle “nginx”
Engines
7 · time to verdictPage
- HTTP
- 200 · Completed
- Title
- nginx
- Load
- 8.82 s · 1 requests