Scan report · 27 days agoPublic

webmail.hanz.health.nz

185.125.84.79AS16509 · NZ

Submittedhttps://webmail.hanz.health.nz

Landed onhttps://webmail.hanz.health.nz/OWA/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fwebmail.hanz.health.nz%2fowa%2f· 3 redirects

Verdict

0 of 7 enginesCleanAutomated

Own this site?

Looks safe

Automated

It runs Microsoft's Outlook Web App on the organisation's own domain; the Microsoft branding is the licensed product's, not an impersonation. It asks you to enter a password. Our automated checks did not find known threat signals on this site at the time of the scan.

What to do

No action needed. Stay alert as usual — a clean result reflects this scan only, and sites can change after they are checked.

A clean result means no known threat signals were found in this scan — it is not an absolute guarantee, and a site can change after it is checked.

Runs Microsoft's Outlook Web App on the organisation's own domain — brand accepted (autodiscover-points-here)

Findings

Strongest first

InfoSelf-hosted Microsoft Outlook Web App verified

Outlook Web App 15.1.2507 · organisation tie: autodiscover-points-here

This host runs Microsoft's licensed Outlook Web App on the customer's own domain, and the organisation's DNS ties the domain to it. The Microsoft branding is the product's, not an impersonation, so the brand claim was withdrawn. Evidence: fingerprint: Outlook Web App 15.1.2507 at technology confidence 100 (X-OWA-Version response header / versioned /owa/auth/<v>/themes/resources link / IsOwaPremiumBrowser global) · credential sink: 1 form(s) post to /owa/auth.owa on webmail.hanz.health.nz · return address: url= points back to webmail.hanz.health.nz · organisation: autodiscover.hanz.health.nz resolves to webmail.hanz.health.nz itself — hanz.health.nz's own DNS names this host as its server; MX hanz-health-nz.mail.protection.outlook.com

Analyst noteDecided from the server's own headers, the rendered form's sink and DNS — never from page text, which a clone copies. The one shape this cannot see is a reverse proxy in front of the real server on a domain that also publishes mail records; if that is your suspicion, check certificate and domain age.

Infrastructure

IP: 185.125.84.79AMAZON-02 - Amazon.com, Inc., US · AS16509NZ
TLS: CN=Entrust OV TLS Issuing RSA CA 2, O=Entrust Limited, C=CA · expires Oct 14, 2026
Redirects: 3 hops · / → /OWA/auth/logon.aspx?replace…ail.hanz.health.nz%2fowa%2f

2 malicious22 suspicious

Hashes & fingerprints

Page Hashf39e63f59e274f5bb7632d7d1bdfcbaf11ca2749fff4211e2ac6acdc1b3a6181 Favicon Hashcf0808a61ec571e0c4975663903b288009d55502ac0445d9948983b339a5cf6e DOM Hasha07c0a9df85b1d77bee8244817dba82a4254ce43972e44b875f98eb596db4234 Screenshot pHashce4747063cf1b1b8 JARM29d29d00029d29d00041d41d00041d01a05e5e7e28522d5dc83e0500c983cf JA4Xa373a9f83c6b_2e9214a636bc_f0323fc993b9 Cert ThumbprintEF828570C35CAC1CF654FED1DE4E6980335A33DB Cert IssuerCN=Entrust OV TLS Issuing RSA CA 2, O=Entrust Limited, C=CA

Page capture

Live

Title “Outlook”

Visit Site

Engines

7 · time to verdict