Scan report · 13 days agoPublic

security-server-landing-page--spencer-hunt1.replit.app

34.117.33.233AS396982 · US

Submittedhttps://security-server-landing-page--spencer-hunt1.replit.app/

the page matches the catalogued phishing kit "Microsoft tenant-branding harvester (revisasen xx/)"

it requested that kit's own files from the kit's infrastructure

Verdict

2 of 9 enginesMaliciousAutomated

Own this site?

Dangerous — confirmed threat

Automated

It asks you to enter a password. Its page code matches a known phishing kit (brand-clone). We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

StrongKnown phishing-kit signature matched

Microsoft tenant-branding harvester (revisasen xx/) · brand-clone · high

The page's structure/assets match a catalogued phishing kit — pre-built attacker software for cloning a brand's login.

Analyst noteKit rated high and flagged for auto-escalation — treat as malicious.

SupportingPage matches a protected brand's fingerprint

Microsoft · logoPhash d=0 (60) + credentialForm (15) · confidence 75

This page's fingerprint — its logo, screenshot, favicon, page structure or scripts — matches a brand's protected baseline, and the page is served from a host that brand does not own. The baseline's owner has been alerted separately.

Analyst noteThe strongest shape this matcher knows: the page serves the brand's own logo file byte-for-byte (Hamming 0) AND asks for a credential, on a host the brand does not own. A review page or a partner page carries the same asset; it does not ask for the password. Check where the form posts.

File

The file was not analysed, so the scan carries no verdict on the file itself.

Infrastructure

IP: 34.117.33.233GOOGLE-CLOUD-PLATFORM - Google LLC, US · AS396982US
TLS: CN=WR3, O=Google Trust Services, C=US · expires Dec 1, 2026

18 malicious16 suspicious

Hashes & fingerprints

Page Hashf03d5ea27bfa8d3df35c36aa2798e27e3067d6d587b36db42c404bdda78a2e40 Favicon Hash84f4badf3fb954dc937eee380ffafa76b7f3f6a6aa966e64474647bd356840a1 DOM Hash96069204aca3820db3ebf6c0f130073bed8c93bba47958d6feb44af0cc410b02 Screenshot pHash872a34acd7b2d46c JARM29d3fd00029d29d00042d43d00041d6f940079659edb62e1c38c38bd26ee84 JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert ThumbprintA649B610DD87BE8081AA7F64500736E6E0AB000E Cert IssuerCN=WR3, O=Google Trust Services, C=US

Page capture

Live

Title “Sign in to your account”

Visit Site

Engines

9 · time to verdict