Scan report · 29 days agoPublic

grupoimpaktu.ao

135.181.34.42AS24940 · DE

Submittedhttps://grupoimpaktu.ao/quotesss/onedrive-verify-obf.html

this page funnels its visitors to m365003573-shared-live-d…ed-m365039.workers.dev, which runs a Microsoft device-code sign-in flow: the visitor is sent to the real provider to type a code, and what they authorise is the attacker's session, not their own

Engine tags

Verdict

3 of 8 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 0.8 s · 2 requests

01 · Visitor opensgrupoimpaktu.ao/quotesss/onedrive-verify-obf.html

02 · Page shown

Access your file - OneDrivestyled as Microsoft · medium

03 · OutcomeToken theft — MFA includedThe code authorises the attacker's own sign-in at the real provider. Tokens are taken, not passwords.

Dangerous — confirmed threat

Automated

Its page title claims to be Microsoft, which this address is not associated with. It sends you on to another site (m365003573-shared-live-document-review-sign.live-shared-m365039.workers.dev) that shows a sign-in code and sends you to the real Microsoft login page — a technique used to take over an account without ever seeing your password. It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

Token theftFunnels to a device-code sign-in trap

Entering this trap's code at the real Microsoft device-login screen authorizes an attacker's session — MFA included. Sign-in tokens are stolen, not passwords, so no credential form ever has to appear — which is why this slips normal phishing checks.

This page carries no branding itself, which is expected — it hands the visitor on to m365003573-shared-live-document-review-sign.live-shared-m365039.workers.dev where the code is shown.

m365003573-shared-live-document-review-sign.live-shared-m365039.workers.dev · Microsoft

This page sends its visitor to m365003573-shared-live-document-review-sign.live-shared-m365039.workers.dev, which we opened and analysed: it runs a Microsoft device-code sign-in flow. In that flow the victim authenticates on the REAL provider — password, MFA and all — and the session they approve belongs to whoever started the flow.

Analyst noteNothing is stolen on this page, so credential and form signals are blind here by design. Treat m365003573-shared-live-document-review-sign.live-shared-m365039.workers.dev as the phishing host, and check conditional-access and sign-in logs for device-code grants rather than for a leaked password.

InfoBrand impersonation detected

Microsoft · medium

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

Infrastructure

IP: 135.181.34.42HETZNER-AS - Hetzner Online GmbH, DE · AS24940DE
TLS: CN=YR2, O=Let's Encrypt, C=US · expires Oct 7, 2026

87 malicious2 suspicious

Hashes & fingerprints

Page Hashd76b908404e0fcb95a494fcf75ee420a57043b909ca3cc013f91c064fb0cb292 DOM Hash205f6f6c2c0c4711e9266d456cff5f617d40a2ef242ee6eb52f1fc0f27e0b8f3 Screenshot pHasheb003213edec92bb JARM29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint2AA8A977C2A8AEB81C482DB82F1ACC2709CC1A55 Cert IssuerCN=YR2, O=Let's Encrypt, C=US

Page capture

Live

Title “Access your file - OneDrive” · brand shown: Microsoft (medium)

Visit Site

Engines

8 · time to verdict