zos8u1fw4t.fultonhogans.com.au
188.114.96.1AS13335 · USAn interaction gate (e.g. Cloudflare Turnstile) blocked full analysis, but a detection rule identified this page anyway. The pre-gate score below rates only what was visible before the gate — not the evidence this verdict rests on.
the verification control on this page opens onto https://zos8u1fw4t.fulto…aa95f2fa58d4ca4261008a, which runs a Microsoft device-code sign-in flow, and it was read past an anti-bot gate on a throwaway copy
- Browser Analysismalicious
- Threat Intelligenceclean
- Network & Hostingclean
- Content Inspectionunknown
- Domain Intelligenceunknown
- TLS Fingerprintunknown
What happened
Step by step, from what the scanner recorded.Dangerous — confirmed threat
Preliminary / could not fully loadIts verification check opens onto a page that shows a sign-in code and sends you to the real Microsoft login page — a technique used to take over an account without ever seeing your password. It shows a bot-check screen that it draws itself — it copies a protection provider's wording but never contacts that provider. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.
What to do
Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.
This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.
Findings
Strongest firstEntering this trap's code at the real Microsoft device-login screen authorizes an attacker's session — MFA included. Sign-in tokens are stolen, not passwords, so no credential form ever has to appear — which is why this slips normal phishing checks.
The gate carries no branding itself, which is expected — the sign-in costume is on the page it opens, one step past the verification click, where the code is asked for.
https://zos8u1fw4t.fultonhogans.com.au/l/ySCWc9WN1W8?key=2daa95f2fa58d4ca4261008a · Microsoft
The verification control on this page leads to https://zos8u1fw4t.fultonhogans.com.au/l/ySCWc9WN1W8?key=2daa95f2fa58d4ca4261008a, which we opened and analysed: it runs a Microsoft device-code sign-in flow. The visitor is shown a code and sent to the REAL Microsoft sign-in page to enter it, so what they approve is the attacker's session — including the multi-factor step — without a password ever being typed. That is why there is no login form to find here.
Analyst noteThe address above is where the code is displayed; the provider named beside it is the takedown and abuse target. Tokens are stolen rather than passwords, so an affected user's sessions have to be revoked — a password reset alone does not end the access.
A bot-protection challenge (e.g. Cloudflare Turnstile) blocked full analysis, so the verdict relies on pre-gate evidence (see the Gated Risk Assessment).
Analyst noteThe gate alone is NOT suspicious — many legitimate sites use it. Read the Gated Risk Assessment for the actual pre-gate risk.
File
The file was not analysed, so the scan carries no verdict on the file itself.
Gated Risk Assessment
This page sits behind a bot-protection gate, but it was already identified by a detection rule — see the verdict reason for what fired. The score below reflects ONLY the weak pre-gate signals (score 0) and does not override that finding.
Pre-gate signals
No pre-gate risk signals detected.
Path to gate (1 hops)
Infrastructure
- IP
- 188.114.96.1CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
- TLS
- CN=YE2, O=Let's Encrypt, C=US · expires Dec 16, 2026
Hashes & fingerprints
Page capture
LiveTitle “Grain”
Engines
6 · time to verdictPage
- HTTP
- 200 · AntiBotChallenged
- Title
- Grain
- Load
- 25.64 s · 1 requests