m365003573-shared-live-document-review-sign.live-shared-m365039.workers.dev
188.114.97.1AS13335 · USpage navigated to a document it built in memory (blob:) claiming Microsoft, on non-legit host m365003573-shared-live-d…ed-m365039.workers.dev; the payload never crossed the network
- Browser Analysissuspicious
- Content Inspectionsuspicious
- Threat Intelligenceclean
- Network & Hostingclean
- Related Infrastructureclean
- Domain Intelligenceunknown
- TLS Fingerprintunknown
- Lexical Url Heuristicunknown
What happened
Step by step, from what the scanner recorded.Be careful — warning signs found
AutomatedIts page title claims to be Microsoft, which this address is not associated with. This site shows signs commonly seen in scams or impersonation, but we could not confirm it for certain. It may be a real threat, or it may be a legitimate site that simply looks unusual to our automated checks.
What to do
Avoid entering passwords or payment details until you are sure it is genuine. Open the company directly from its known website or app instead of this link. Check the evidence below and escalate to your analyst if unsure.
"Suspicious" is a caution, not a confirmation — it can be a false alarm. The evidence below explains why it was flagged.
Findings
Strongest firstOur Content Inspection engine downloaded the file this URL serves and analyzed it. The payload shows traits commonly seen in malware. Treat it as unsafe until verified.
Success
SHA-256 53dde8a3138f3fb73b53ba44a44694e1eb2ad5066dba803cb17974cb969c1183
The page assembled its next screen in memory and navigated to it as a blob: document. Nothing was fetched, so the page you would see never crossed the network — and it claims a brand this host does not own.
Analyst noteThere is no second URL to submit anywhere: a blob URL lives only in the tab that made it. Pivot on THIS host, on the script that builds the document, and on any external script it pulls into the blob — that host is usually the kit, and it is configuration, so expect it to rotate.
The page presents itself as a known brand (brand keywords/branding detected).
Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.
Infrastructure
- IP
- 188.114.97.1CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
- TLS
- CN=WE1, O=Google Trust Services, C=US · expires Nov 30, 2026
Hashes & fingerprints
Page capture
LiveTitle “OneDrive — Sign in to continue” · brand shown: Microsoft (medium)
Engines
8 · time to verdictPage
- HTTP
- 200 · Completed
- Title
- OneDrive — Sign in to continue
- Load
- 1.45 s · 2 requests