Scan report · 2 months agoPublic

104.223.50.181

104.223.50.181AS36352 · US

Submittedhttp://104.223.50.181/

Landed onhttps://104.223.50.181/

Engine tags

Verdict

2 of 6 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 1.5 s · 1 requests

01 · Visitor opens104.223.50.181

02 · Redirected · 1 hopSame host, another address

03 · Page shown

Windows Update Assistant - Microsoft Supportstyled as Microsoft · high

04 · OutcomeCredential phishingA login page wearing a brand it does not own.

Dangerous — confirmed threat

Automated

It presents itself as Microsoft, but it is served from a raw IP address instead of a domain name. Microsoft does not publish pages that way. It asks for a password in a sign-in box that stays hidden in the page until you click — so the request only appears once you interact with it. It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

SupportingBrand impersonation detected

Microsoft · high

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteHigh confidence: brand keywords AND a password field — classic credential phishing.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Downloaded fileCleanThe engine stored it under a generated name

SHA-2561dd91e9a67f62d9c1f268f0b62c5b0123bb456f6cd075e077d01a6dee2fc5355

Infrastructure

IP: 104.223.50.181AS-COLOCROSSING - HostPapa, US · AS36352US
Redirects: 0 hops · / → /

9 malicious

Hashes & fingerprints

Page Hashb8ff0a54f5a9d320ff2b4fd8da5aaf918792070853fd0c8dda3ffd969c1ca5d9 DOM Hashffee3b1755c721887fe450ac725dd63afef2c4247a38b274723d312a856786dc Screenshot pHasha7646c0ff09093db

Page capture

Live

Title “Windows Update Assistant - Microsoft Support” · brand shown: Microsoft (high)

Visit Site

Engines

6 · time to verdict